@attalabs/vinaya 0.1.0 → 0.1.1

package/dist/index.js

@@ -1,63 +1,12 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync10 } from "node:fs";
-import { dirname as dirname7, join as join12 } from "node:path";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
+import { readFileSync as readFileSync11 } from "node:fs";
+import { dirname as dirname5, join as join14 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 
-// src/commands/check.ts
+// src/commands/archive.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-
-// src/checks/contract.ts
-var CHECK_SCHEMA_VERSION = 1;
-function emitCheckError(error) {
-  process.stderr.write(`${JSON.stringify(error)}
-`);
-}
-
-// src/checks/registry.ts
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-var CLI_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
-var BIN_DIR = join(CLI_ROOT, "src", "checks", "bin");
-function coreCheckRegistry() {
-  return [
-    {
-      name: "brief-shape",
-      run: join(BIN_DIR, "check-brief-shape.ts"),
-      scope: "diff",
-      timeoutMs: 15000
-    },
-    {
-      name: "doc-coverage",
-      run: join(BIN_DIR, "check-doc-coverage.ts"),
-      scope: "diff",
-      timeoutMs: 15000
-    },
-    {
-      name: "coherence",
-      run: join(BIN_DIR, "check-coherence.ts"),
-      scope: "full",
-      timeoutMs: 30000
-    },
-    {
-      name: "dispatch-readiness",
-      run: join(BIN_DIR, "check-dispatch-readiness.ts"),
-      scope: "full",
-      timeoutMs: 30000
-    },
-    {
-      name: "reader-resolvable-prose",
-      run: join(BIN_DIR, "check-reader-resolvable-prose.ts"),
-      scope: "full",
-      timeoutMs: 30000
-    }
-  ];
-}
-
-// src/checks/runner.ts
-import { spawn } from "node:child_process";
-import { cpus } from "node:os";
 // ../../../packages/aeg-core/src/anchored-region.ts
 function maskCode(body) {
   const fill = (line) => " ".repeat(line.length);
@@ -151,6 +100,8 @@ function anchoredRegion(body, field) {
     return null;
   return body.slice(afterStart, afterStart + end.index);
 }
+// ../../../packages/aeg-forge-state/src/parse-rationale-deps.ts
+var SECTION_HEADER = /\*\*Dependency rationale\*\*/i;
 // ../../../packages/aeg-forge-state/src/gh.ts
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
@@ -370,17 +321,12 @@ var DERIVED_STATUSES = [
   "incoherent"
 ];
 var DERIVABLE_STATUSES = DERIVED_STATUSES.filter((s) => s !== "backlog");
-// ../../../packages/aeg-core/src/file-classify.ts
-var FROZEN_ARCHIVES = new Set([
-  "docs/decisions-legacy.md",
-  "apps/herald-ai/docs/herald-decisions-legacy.md",
-  "apps/vada-ai/docs/vada-decisions-legacy.md"
-]);
 // ../../../packages/aeg-core/src/waiver-label.ts
 var WAIVER_LABEL = label("waiver-docs");
 var WAIVER_LABEL_REVIEW = label("waiver-review");
 
 // ../../../packages/aeg-core/src/doc-owners.ts
+var DOC_OWNERS_PATH = ".vinaya/doc-owners";
 function globToRegex(pat) {
   let re = "^";
   let i = 0;
@@ -620,7 +566,7 @@ function checkForgeTitle(title) {
 }
 // ../../../packages/aeg-core/src/issue-validation.ts
 function hasRationaleField(body, labelPattern) {
-  const re = new RegExp(`(?:\\*\\*|^#{1,4}\\s+)\\s*${labelPattern}`, "im");
+  const re = new RegExp(`(?:\\*\\*|^#{1,4}\\s+)\\s*(?:${labelPattern})`, "im");
   return re.test(body);
 }
 var RATIONALE_FIELDS = [
@@ -633,8 +579,18 @@ var RATIONALE_FIELDS = [
   { name: "Stop-and-escalate", pattern: "Stop-and-escalate" },
   { name: "Docs to keep coherent", pattern: "Docs to keep coherent|§7" }
 ];
+var DEPENDENCY_RATIONALE_FIELD_NAME = "Dependency rationale";
 function checkIssueRationale(body) {
-  const errors = RATIONALE_FIELDS.filter((f) => !hasRationaleField(body, f.pattern)).map((f) => `issue-validation ${f.name}: rationale field not found in the Issue body — every task Issue carries the full Planner's rationale (aeg-root/contracts/planner-brief.md).`);
+  const errors = [];
+  for (const f of RATIONALE_FIELDS) {
+    if (!hasRationaleField(body, f.pattern)) {
+      errors.push(`issue-validation ${f.name}: rationale field not found in the Issue body — every task Issue carries the full Planner's rationale (aeg-root/contracts/planner-brief.md).`);
+      continue;
+    }
+    if (f.name === DEPENDENCY_RATIONALE_FIELD_NAME && !SECTION_HEADER.test(body)) {
+      errors.push(`issue-validation ${f.name}: rationale field found, but not in the form amend-deps requires — ` + "write `**Dependency rationale** — …`, not `**Dependency rationale:** …`. " + "`amendRationaleDeps` (the only sanctioned way to edit Depends-on/Conflicts-with) locates this " + "section by the exact anchor `**Dependency rationale**`; a colon inside the bold breaks that match " + "and the Issue becomes unamendable.");
+    }
+  }
   return { status: errors.length > 0 ? "fail" : "pass", errors };
 }
 function isTaskIssueLabelSet(labels) {
@@ -643,116 +599,873 @@ function isTaskIssueLabelSet(labels) {
 
 // ../../../packages/aeg-core/src/coherence-checks.ts
 var R1_GRANDFATHERED_ISSUES = new Set([279, 280, 281, 282]);
+// ../../../packages/aeg-core/src/verdict-extraction.ts
+function extractVerdict(comments, valuePattern, missingLabel) {
+  const clearHits = comments.filter((c) => valuePattern.test(c));
+  if (clearHits.length > 0) {
+    const latest = clearHits[clearHits.length - 1];
+    const m = latest.match(valuePattern);
+    return { value: m[1].toUpperCase().replace(/[_-]/g, " "), danglingNote: null };
+  }
+  return {
+    value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
+    danglingNote: `no ${missingLabel} verdict comment found on this PR`
+  };
+}
+function extractCodeReviewVerdict(comments) {
+  return extractVerdict(comments, /^[ \t]*(?:\*{1,3}|_{1,3})?VERDICT:\s*(APPROVE|REQUEST[ _-]?CHANGES|LGTM)(?![A-Za-z0-9])/im, "code-reviewer");
+}
+function extractSecurityReviewVerdict(comments) {
+  return extractVerdict(comments, /^[ \t]*(?:\*{1,3}|_{1,3})?VERDICT:\s*(PASS|FAIL)(?![A-Za-z0-9])/im, "security-review");
+}
+
+// ../../../packages/aeg-core/src/archive-task.ts
+var TASK_BRANCH_PATTERN = /^task\/([^/]+)\/([^/]+)$/;
+function taskRefFromBranch(branch) {
+  const m = branch.match(TASK_BRANCH_PATTERN);
+  if (!m)
+    return null;
+  return { tranche: m[1], taskId: m[2] };
+}
+function isEligibleForProvenance(ref, issueLabels) {
+  if (ref !== null)
+    return true;
+  return hasLabel("tranche", issueLabels);
+}
+var PROVENANCE_HEADING = "### AEG provenance";
+function hasProvenance(comments) {
+  return comments.some((c) => c.includes(PROVENANCE_HEADING));
+}
+function extractField(body, labelPattern, anchor) {
+  const anchored = anchor !== undefined ? anchoredRegion(body, anchor) : null;
+  const region = anchored ?? headerRegion(body);
+  const re = new RegExp(`^(?:\\*\\*)?\\s*${labelPattern}\\s*(?:\\*\\*)?\\s*:\\s*(?:\\*\\*)?\\s*([^\\n·]+)`, "im");
+  const m = region.match(re);
+  if (!m)
+    return null;
+  const value = m[1].trim();
+  return value.length > 0 ? value : null;
+}
+function closesRefs(text) {
+  return [...new Set([...text.matchAll(/Closes #(\d+)/gi)].map((m) => Number(m[1])))];
+}
+function extractIssue(body) {
+  const stripped = stripCode(body);
+  const bodyNums = closesRefs(stripped);
+  const anchored = anchoredRegion(stripped, "CLOSES");
+  if (anchored !== null) {
+    const anchorNums = closesRefs(anchored);
+    if (anchorNums.length === 0)
+      return { issue: null, extraIssues: bodyNums, outsideHeader: false };
+    const issue2 = anchorNums[0];
+    return { issue: issue2, extraIssues: bodyNums.filter((n) => n !== issue2), outsideHeader: false };
+  }
+  const headerNums = closesRefs(headerRegion(stripped));
+  if (bodyNums.length === 0)
+    return { issue: null, extraIssues: [], outsideHeader: false };
+  const issue = headerNums.length > 0 ? headerNums[0] : bodyNums[0];
+  return { issue, extraIssues: bodyNums.filter((n) => n !== issue), outsideHeader: headerNums.length === 0 };
+}
+function buildProvenanceBlock(facts) {
+  const ref = taskRefFromBranch(facts.headRefName);
+  const dangling = [];
+  const { issue, extraIssues, outsideHeader } = extractIssue(facts.body);
+  if (issue === null) {
+    dangling.push("no `Closes #N` found in PR body — Issue field is DANGLING, no Issue will be closed");
+  }
+  if (outsideHeader) {
+    dangling.push(`\`Closes #${issue}\` was found outside the PR body's header block — the canonical form places it before the first \`##\` heading`);
+  }
+  if (extraIssues.length > 0) {
+    dangling.push(`PR body references additional Issues (${extraIssues.map((n) => `#${n}`).join(", ")}) beyond the first — closing only #${issue}, the rest are flagged, not closed`);
+  }
+  const tier = readTierFromPrBody(facts.body);
+  if (tier === null)
+    dangling.push("no `Tier:` field found in PR body — Tier field is DANGLING");
+  const project = extractField(facts.body, "Project(?:\\(s\\))?", "PROJECT");
+  if (!project)
+    dangling.push("no `Project:` field found in PR body — Project(s) field is DANGLING");
+  const forField = extractField(facts.body, "For");
+  if (!forField)
+    dangling.push("no `For:` field found in PR body — Model/agent field is DANGLING");
+  const codeReview = extractCodeReviewVerdict(facts.comments);
+  if (codeReview.danglingNote)
+    dangling.push(codeReview.danglingNote);
+  const security = extractSecurityReviewVerdict(facts.comments);
+  if (security.danglingNote)
+    dangling.push(security.danglingNote);
+  const ticket = extractField(facts.body, "Ticket") ?? "none";
+  const taskLabel = ref ? `task ${ref.taskId} (tranche ${ref.tranche})` : `task (branch ${facts.headRefName})`;
+  const lines = [
+    `${PROVENANCE_HEADING} — ${taskLabel}`,
+    `- Issue:        ${issue !== null ? `#${issue}  (closed by merge)` : "DANGLING — no Closes #N in PR body"}`,
+    `- Tier:         ${tier !== null ? tier : "DANGLING — no Tier field in PR body"}`,
+    "- Brief:        in this PR body (the frozen intent)",
+    `- Project(s):   ${project ?? "DANGLING — no Project field in PR body"}`,
+    `- Model/agent:  ${forField ?? "DANGLING — no For field in PR body"}`,
+    `- Code review:  ${codeReview.value}`,
+    `- Security:     ${security.value}`,
+    `- Ticket:       ${ticket}`,
+    `- Merged:       ${facts.mergeSha} at ${facts.mergedAt}`
+  ];
+  if (dangling.length > 0) {
+    lines.push("", `DANGLING: ${dangling.join("; ")}`);
+  }
+  return { block: lines.join(`
+`), issue, dangling };
+}
 // ../../../packages/aeg-core/src/diagram-model.ts
 import matter from "gray-matter";
 // ../../../packages/aeg-core/src/reader-resolvable-prose.ts
 var SWEPT_CLASSES = new Set(["ships", "reader-facing"]);
-// src/checks/runner.ts
-function defaultParallelism() {
-  return Math.max(1, cpus().length);
+// ../../../packages/aeg-core/src/direct-main-push.ts
+function checkDirectMainPush(fact) {
+  const [first] = fact.associatedMergedPrNumbers;
+  if (first !== undefined)
+    return { verdict: "legitimate", mergedPrNumber: first };
+  return { verdict: "direct-push", sha: fact.sha };
+}
+// ../../../packages/aeg-core/src/dead-branch-push-audit.ts
+function findDeadBranchPushes(facts) {
+  return facts.filter((f) => new Date(f.latestCommitAt).getTime() > new Date(f.resolvedAt).getTime()).map(({ branch, prNumber, prState, resolvedAt, latestCommitAt }) => ({
+    branch,
+    prNumber,
+    prState,
+    resolvedAt,
+    latestCommitAt
+  }));
 }
-function isCheckError(value) {
-  if (typeof value !== "object" || value === null)
-    return false;
-  const v = value;
-  return v.schema === CHECK_SCHEMA_VERSION && typeof v.check === "string" && (v.severity === "error" || v.severity === "warning") && typeof v.message === "string" && typeof v.agent_recovery_prompt === "string";
+// src/lib/detect.ts
+import { execFile as execFile4 } from "node:child_process";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { promisify as promisify4 } from "node:util";
+var execFileAsync4 = promisify4(execFile4);
+async function detectGitRepo() {
+  try {
+    const { stdout: root } = await execFileAsync4("git", ["rev-parse", "--show-toplevel"]);
+    const repoRoot = root.trim();
+    let owner = "";
+    let repo = "";
+    try {
+      const { stdout: url } = await execFileAsync4("git", ["remote", "get-url", "origin"]);
+      const m = url.trim().match(/github\.com[/:]([^/]+)\/([^/]+?)(?:\.git)?$/);
+      if (m) {
+        owner = m[1] ?? "";
+        repo = m[2] ?? "";
+      }
+    } catch {}
+    return { repoRoot, owner, repo };
+  } catch {
+    return null;
+  }
 }
-function shouldSkip(spec, opts) {
-  if (spec.scope !== "diff")
-    return false;
-  if (!opts.diffOnly)
-    return false;
-  if (opts.changedFiles === null)
-    return false;
-  if (!spec.include || spec.include.length === 0)
+async function checkGhAuth() {
+  try {
+    await execFileAsync4("gh", ["auth", "status"]);
+    return true;
+  } catch {
     return false;
-  const regexes = spec.include.map(globToRegex);
-  return !opts.changedFiles.some((f) => regexes.some((re) => re.test(f)));
+  }
 }
-var KILL_GRACE_MS = 2000;
-async function runOne(spec, timeoutMs) {
-  const start = performance.now();
-  const proc = spawn(spec.run, spec.args ?? [], {
-    stdio: ["ignore", "pipe", "pipe"]
-  });
-  let timedOut = false;
-  let killTimer;
-  const timer = setTimeout(() => {
-    timedOut = true;
-    proc.kill("SIGTERM");
-    killTimer = setTimeout(() => proc.kill("SIGKILL"), KILL_GRACE_MS);
-  }, timeoutMs);
-  let stderrText = "";
-  proc.stderr.setEncoding("utf-8");
-  proc.stderr.on("data", (chunk) => {
-    stderrText += chunk;
-  });
-  proc.stdout.resume();
-  let spawnError;
-  const exitCode = await new Promise((resolve) => {
-    proc.on("close", (code) => resolve(code));
-    proc.on("error", (err) => {
-      spawnError = err;
-      resolve(null);
-    });
-  });
-  clearTimeout(timer);
-  clearTimeout(killTimer);
-  const durationMs = performance.now() - start;
-  if (timedOut) {
-    return { name: spec.name, status: "timeout", exitCode: null, errors: [], durationMs };
+async function ghAuthStatus() {
+  try {
+    const { stderr, stdout } = await execFileAsync4("gh", ["auth", "status"]);
+    return { authenticated: true, detail: (stderr || stdout).trim() };
+  } catch (err) {
+    const stderr = err.stderr;
+    return { authenticated: false, detail: stderr?.trim() || "gh is not authenticated" };
   }
-  if (spawnError) {
-    const code = spawnError.code;
-    return {
-      name: spec.name,
-      status: "error",
-      exitCode: null,
-      errors: [
-        {
-          schema: 1,
-          check: spec.name,
-          severity: "error",
-          message: code === "ENOENT" ? `Could not run check "${spec.name}": executable \`${spec.run}\` was not found on PATH.` : `Could not run check "${spec.name}": ${spawnError.message}`,
-          agent_recovery_prompt: code === "ENOENT" ? `Install \`${spec.run}\` or correct the \`run\` field for check "${spec.name}" in vinaya.config.json, then re-run.` : `Inspect the \`run\` and \`args\` fields for check "${spec.name}" in vinaya.config.json, then re-run.`
-        }
-      ],
-      durationMs
-    };
+}
+async function branchProtectionConfigured(owner, repo) {
+  if (!owner || !repo)
+    return null;
+  try {
+    await execFileAsync4("gh", ["api", `repos/${owner}/${repo}/branches/main/protection`]);
+    return true;
+  } catch (err) {
+    const stderr = err.stderr ?? "";
+    if (/\b404\b/.test(stderr))
+      return false;
+    return null;
   }
-  const lines = stderrText.split(`
-`).map((l) => l.trim()).filter(Boolean);
-  const errors = [];
-  let malformed = false;
-  for (const line of lines) {
-    try {
-      const parsed = JSON.parse(line);
-      if (isCheckError(parsed)) {
-        errors.push(parsed);
-      } else {
-        malformed = true;
+}
+function resolveHookDir(repoRoot) {
+  return existsSync(join(repoRoot, ".husky")) ? ".husky" : ".git/hooks";
+}
+function hookDirFromManifest(manifest, fallback) {
+  const block = manifest.blocks.find((b) => b.path.startsWith(".husky/") || b.path.startsWith(".git/hooks/"));
+  if (block?.path.startsWith(".husky/"))
+    return ".husky";
+  if (block?.path.startsWith(".git/hooks/"))
+    return ".git/hooks";
+  return fallback;
+}
+async function customHooksPath(repoRoot) {
+  try {
+    const { stdout } = await execFileAsync4("git", ["-C", repoRoot, "config", "--get", "core.hooksPath"]);
+    const v = stdout.trim();
+    if (!v)
+      return null;
+    if (v === ".husky" || v === ".husky/_")
+      return null;
+    return v;
+  } catch {
+    return null;
+  }
+}
+function ghLabelGateway(repoRoot) {
+  return {
+    async exists(name) {
+      try {
+        const { stdout } = await execFileAsync4("gh", ["label", "list", "--json", "name"], { cwd: repoRoot });
+        const names = JSON.parse(stdout);
+        return names.some((l) => l.name === name);
+      } catch {
+        return false;
       }
-    } catch {
-      malformed = true;
+    },
+    async create(name, color, description) {
+      await execFileAsync4("gh", ["label", "create", name, "--color", color, "--description", description], {
+        cwd: repoRoot
+      });
     }
-  }
-  let status;
-  if (malformed) {
-    status = "error";
-  } else if (exitCode === 0) {
-    status = "pass";
-  } else if (exitCode === 1) {
-    status = "fail";
-  } else {
-    status = "error";
-  }
-  return { name: spec.name, status, exitCode, errors, durationMs };
+  };
 }
-async function runChecks(specs, opts) {
-  const results = new Array(specs.length);
-  const toRun = [];
-  for (let i = 0;i < specs.length; i++) {
-    const spec = specs[i];
+
+// src/commands/archive.ts
+function realDeps() {
+  return { detectRepo: detectGitRepo };
+}
+function sh(args, input) {
+  return execFileSync2(args[0], args.slice(1), { encoding: "utf8", input }).trim();
+}
+function shJson(args) {
+  return JSON.parse(sh(args));
+}
+function parseMergeSha(args) {
+  for (const a of args) {
+    const m = a.match(/^--merge-sha=(.+)$/);
+    if (m)
+      return m[1];
+  }
+  return null;
+}
+async function runArchive(args, deps) {
+  const repo = await deps.detectRepo();
+  if (!repo) {
+    console.error("Error: not a git repository. Run `vinaya archive` from inside your repo.");
+    return 1;
+  }
+  if (!repo.owner || !repo.repo) {
+    console.error("Error: could not resolve a GitHub owner/repo from the `origin` remote.");
+    return 1;
+  }
+  const repoFlag = `${repo.owner}/${repo.repo}`;
+  const mergeSha = parseMergeSha(args) ?? sh(["git", "rev-parse", "HEAD"]);
+  const associated = shJson(["gh", "api", `repos/${repoFlag}/commits/${mergeSha}/pulls`]);
+  if (associated.length === 0) {
+    console.log(`[vinaya archive] no associated PR for merge ${mergeSha} — skip.`);
+    return 0;
+  }
+  const prNumber = associated[0].number;
+  const pr = shJson([
+    "gh",
+    "pr",
+    "view",
+    String(prNumber),
+    "-R",
+    repoFlag,
+    "--json",
+    "number,headRefName,body,mergedAt,comments"
+  ]);
+  const ref = taskRefFromBranch(pr.headRefName);
+  let issueLabels = [];
+  if (ref === null) {
+    const { issue: candidateIssue } = extractIssue(pr.body);
+    if (candidateIssue !== null) {
+      issueLabels = shJson([
+        "gh",
+        "issue",
+        "view",
+        String(candidateIssue),
+        "-R",
+        repoFlag,
+        "--json",
+        "labels"
+      ]).labels.map((l) => l.name);
+    }
+  }
+  if (!isEligibleForProvenance(ref, issueLabels)) {
+    console.log(`[vinaya archive] non-task branch (${pr.headRefName}) and closing Issue carries no vinaya/tranche:* label — skip.`);
+    return 0;
+  }
+  const comments = pr.comments.map((c) => c.body);
+  if (hasProvenance(comments)) {
+    console.log(`[vinaya archive] provenance already present on PR #${pr.number} — skip (idempotent).`);
+    return 0;
+  }
+  const facts = {
+    number: pr.number,
+    headRefName: pr.headRefName,
+    body: pr.body,
+    mergedAt: pr.mergedAt,
+    mergeSha,
+    comments
+  };
+  const { block, issue, dangling } = buildProvenanceBlock(facts);
+  console.log(`[vinaya archive] posting provenance block to PR #${pr.number}...`);
+  sh(["gh", "pr", "comment", String(pr.number), "-R", repoFlag, "--body-file", "-"], block);
+  console.log(`[vinaya archive] provenance block posted to PR #${pr.number}.`);
+  if (dangling.length > 0) {
+    console.log(`[vinaya archive] DANGLING (${dangling.length}): ${dangling.join("; ")}`);
+  }
+  if (issue !== null) {
+    console.log(`[vinaya archive] closing Issue #${issue}...`);
+    sh(["gh", "issue", "close", String(issue), "-R", repoFlag]);
+    const state = shJson([
+      "gh",
+      "issue",
+      "view",
+      String(issue),
+      "-R",
+      repoFlag,
+      "--json",
+      "state"
+    ]).state;
+    if (state !== "CLOSED") {
+      console.error(`[vinaya archive] FAILED — Issue #${issue} did not confirm CLOSED (state: ${state}).`);
+      return 1;
+    }
+    console.log(`[vinaya archive] Issue #${issue} confirmed CLOSED.`);
+  } else {
+    console.log("[vinaya archive] no Issue to close — Closes #N absent from PR body.");
+  }
+  console.log("[vinaya archive] PASS.");
+  return 0;
+}
+async function archiveCommand(args) {
+  process.exit(await runArchive(args, realDeps()));
+}
+
+// src/commands/audit.ts
+import { execFileSync as execFileSync3 } from "node:child_process";
+
+// src/lib/envelope.ts
+var ENVELOPE_SCHEMA_VERSION = 1;
+function toEnvelope(data) {
+  return { schema: ENVELOPE_SCHEMA_VERSION, data };
+}
+function printJson(data) {
+  process.stdout.write(`${JSON.stringify(toEnvelope(data), null, 2)}
+`);
+}
+
+// src/commands/audit.ts
+function realDeps2() {
+  return { detectRepo: detectGitRepo };
+}
+var COMMAND_TIMEOUT_MS = 20000;
+var DEAD_BRANCH_LABEL = label("dead-branch-push");
+var DEAD_BRANCH_MARKER = `<!-- ${DEAD_BRANCH_LABEL} -->`;
+var DEAD_BRANCH_LABEL_DESCRIPTION = "daily-drift: commits landed on this branch after its PR already resolved";
+var DIRECT_PUSH_LABEL = label("direct-main-push");
+var DIRECT_PUSH_MARKER = `<!-- ${DIRECT_PUSH_LABEL} -->`;
+var DIRECT_PUSH_LABEL_DESCRIPTION = "A commit landed on main with no associated merged PR (ring-2 detection)";
+function shSoft(args, input) {
+  try {
+    return execFileSync3(args[0], args.slice(1), {
+      encoding: "utf8",
+      input,
+      timeout: COMMAND_TIMEOUT_MS
+    }).trim();
+  } catch (err) {
+    const stderr = err.stderr;
+    const message = stderr ? stderr.toString().trim() : err.message;
+    console.log(`[vinaya audit] non-fatal: command failed — ${message}`);
+    return "";
+  }
+}
+function shSoftJson(args) {
+  const out = shSoft(args);
+  if (!out)
+    return null;
+  try {
+    return JSON.parse(out);
+  } catch {
+    return null;
+  }
+}
+function sh2(args, input) {
+  return execFileSync3(args[0], args.slice(1), { encoding: "utf8", input }).trim();
+}
+function listTaskBranches() {
+  const out = shSoft(["git", "ls-remote", "--heads", "origin", "task/*"]);
+  if (!out)
+    return [];
+  return out.split(`
+`).map((line) => line.trim()).filter(Boolean).map((line) => {
+    const [sha, ref] = line.split("\t");
+    return { name: ref.replace(/^refs\/heads\//, ""), sha };
+  });
+}
+function mostRecentPr(branch, repoFlag) {
+  const entries = shSoftJson([
+    "gh",
+    "pr",
+    "list",
+    "--head",
+    branch,
+    "-R",
+    repoFlag,
+    "--state",
+    "all",
+    "--json",
+    "number,state,mergedAt,closedAt",
+    "--limit",
+    "1"
+  ]);
+  return entries?.[0] ?? null;
+}
+function commitDate(sha, repoFlag) {
+  const json = shSoftJson([
+    "gh",
+    "api",
+    `repos/${repoFlag}/commits/${sha}`
+  ]);
+  return json?.commit?.committer?.date ?? null;
+}
+function gatherDeadBranchFacts(repoFlag) {
+  const facts = [];
+  for (const { name, sha } of listTaskBranches()) {
+    const pr = mostRecentPr(name, repoFlag);
+    if (!pr)
+      continue;
+    if (pr.state !== "MERGED" && pr.state !== "CLOSED")
+      continue;
+    const resolvedAt = pr.state === "MERGED" ? pr.mergedAt : pr.closedAt;
+    if (!resolvedAt)
+      continue;
+    const latestCommitAt = commitDate(sha, repoFlag);
+    if (!latestCommitAt)
+      continue;
+    facts.push({ branch: name, prNumber: pr.number, prState: pr.state, resolvedAt, latestCommitAt });
+  }
+  return facts;
+}
+function ensureLabelExists(repoFlag, name, description) {
+  const existing = shSoftJson(["gh", "label", "list", "-R", repoFlag, "--json", "name", "--limit", "200"]) ?? [];
+  if (existing.some((l) => l.name === name))
+    return;
+  shSoft(["gh", "label", "create", name, "-R", repoFlag, "--color", "B60205", "--description", description]);
+}
+function commentIdFromUrl(url) {
+  const match = url.match(/issuecomment-(\d+)/);
+  return match ? match[1] : null;
+}
+function flagDeadBranchPush(finding, repoFlag) {
+  shSoft(["gh", "pr", "edit", String(finding.prNumber), "-R", repoFlag, "--add-label", DEAD_BRANCH_LABEL]);
+  const body = [
+    DEAD_BRANCH_MARKER,
+    "**Dead-branch push detected by `vinaya audit`.**",
+    "",
+    `Branch \`${finding.branch}\` has a ${finding.prState} PR (#${finding.prNumber}, resolved ${finding.resolvedAt}), ` + `but its remote tip commit is dated ${finding.latestCommitAt} — after that resolution. ` + "This is a notification, not a merge gate — nothing was reverted or mutated."
+  ].join(`
+`);
+  const prJson = shSoftJson([
+    "gh",
+    "pr",
+    "view",
+    String(finding.prNumber),
+    "-R",
+    repoFlag,
+    "--json",
+    "comments"
+  ]);
+  const existing = prJson?.comments.find((c) => c.body.includes(DEAD_BRANCH_MARKER));
+  const existingId = existing ? commentIdFromUrl(existing.url) : null;
+  if (existingId) {
+    shSoft(["gh", "api", `repos/${repoFlag}/issues/comments/${existingId}`, "-X", "PATCH", "-F", "body=@-"], body);
+  } else {
+    shSoft(["gh", "pr", "comment", String(finding.prNumber), "-R", repoFlag, "--body-file", "-"], body);
+  }
+}
+function runDeadBranchAudit(repoFlag) {
+  try {
+    const facts = gatherDeadBranchFacts(repoFlag);
+    const findings = findDeadBranchPushes(facts);
+    if (findings.length > 0) {
+      ensureLabelExists(repoFlag, DEAD_BRANCH_LABEL, DEAD_BRANCH_LABEL_DESCRIPTION);
+      for (const finding of findings)
+        flagDeadBranchPush(finding, repoFlag);
+    }
+    return { scanned: facts.length, findings };
+  } catch (err) {
+    console.log(`[vinaya audit] dead-branch scan error (never-red, reporting only): ${err.message}`);
+    return { scanned: 0, findings: [] };
+  }
+}
+function fetchAssociatedMergedPrs(sha, repoFlag) {
+  const out = sh2(["gh", "api", `repos/${repoFlag}/commits/${sha}/pulls`]);
+  const prs = JSON.parse(out);
+  return prs.filter((pr) => pr.merged_at !== null).map((pr) => pr.number);
+}
+function incidentAlreadyOpen(sha, repoFlag) {
+  const out = sh2([
+    "gh",
+    "issue",
+    "list",
+    "-R",
+    repoFlag,
+    "--label",
+    DIRECT_PUSH_LABEL,
+    "--state",
+    "open",
+    "--search",
+    sha,
+    "--json",
+    "number"
+  ]);
+  const issues = JSON.parse(out || "[]");
+  return issues.length > 0;
+}
+function openDirectPushIncident(sha, repoFlag) {
+  ensureLabelExists(repoFlag, DIRECT_PUSH_LABEL, DIRECT_PUSH_LABEL_DESCRIPTION);
+  if (incidentAlreadyOpen(sha, repoFlag)) {
+    console.error(`[vinaya audit] incident already open for ${sha} — not duplicating.`);
+    return;
+  }
+  const body = [
+    DIRECT_PUSH_MARKER,
+    "**Direct push to `main` detected — no associated merged PR.**",
+    "",
+    `Commit \`${sha}\` landed on \`main\` but the commits→pulls association API reports no merged pull request that introduced it.`,
+    "",
+    "This is a detection-only finding — nothing was reverted or mutated."
+  ].join(`
+`);
+  sh2([
+    "gh",
+    "issue",
+    "create",
+    "-R",
+    repoFlag,
+    "--title",
+    `Direct push to main detected: ${sha.slice(0, 12)}`,
+    "--body",
+    body,
+    "--label",
+    DIRECT_PUSH_LABEL
+  ]);
+}
+function runDirectMainPushCheck(sha, repoFlag) {
+  const associatedMergedPrNumbers = fetchAssociatedMergedPrs(sha, repoFlag);
+  const result = checkDirectMainPush({ sha, associatedMergedPrNumbers });
+  if (result.verdict === "direct-push") {
+    openDirectPushIncident(sha, repoFlag);
+    return { verdict: "direct-push" };
+  }
+  return { verdict: "legitimate", mergedPrNumber: result.mergedPrNumber };
+}
+function parseSha(args) {
+  for (const a of args) {
+    const m = a.match(/^--sha=(.+)$/);
+    if (m)
+      return m[1];
+  }
+  return null;
+}
+function parseOnly(args) {
+  for (const a of args) {
+    const m = a.match(/^--only=(dead-branches|direct-push)$/);
+    if (m)
+      return m[1];
+  }
+  return null;
+}
+async function runAudit(args, deps) {
+  const jsonOutput = args.includes("--json");
+  const only = parseOnly(args);
+  const repo = await deps.detectRepo();
+  if (!repo) {
+    console.error("Error: not a git repository. Run `vinaya audit` from inside your repo.");
+    return 1;
+  }
+  if (!repo.owner || !repo.repo) {
+    console.error("Error: could not resolve a GitHub owner/repo from the `origin` remote.");
+    return 1;
+  }
+  const repoFlag = `${repo.owner}/${repo.repo}`;
+  const sha = parseSha(args) ?? sh2(["git", "rev-parse", "HEAD"]);
+  const deadBranch = only === "direct-push" ? { scanned: 0, findings: [] } : runDeadBranchAudit(repoFlag);
+  const directPush = only === "dead-branches" ? null : runDirectMainPushCheck(sha, repoFlag);
+  const failed = directPush?.verdict === "direct-push";
+  if (jsonOutput) {
+    printJson({
+      deadBranchAudit: only === "direct-push" ? null : { scanned: deadBranch.scanned, findings: deadBranch.findings },
+      directMainPush: directPush ? { sha, ...directPush } : null
+    });
+  } else {
+    process.stdout.write(`vinaya audit
+
+`);
+    if (only !== "direct-push") {
+      process.stdout.write(`· [dead-branch-push] task branches scanned: ${deadBranch.scanned}, flagged: ${deadBranch.findings.length}
+`);
+      for (const f of deadBranch.findings) {
+        process.stdout.write(`  ⚠ ${f.branch} — PR #${f.prNumber} (${f.prState}) resolved ${f.resolvedAt}, tip commit ${f.latestCommitAt}
+`);
+      }
+    }
+    if (directPush) {
+      if (directPush.verdict === "legitimate") {
+        process.stdout.write(`✓ [direct-main-push] ${sha} is legitimate — introduced by merged PR #${directPush.mergedPrNumber}.
+`);
+      } else {
+        process.stdout.write(`✗ [direct-main-push] VIOLATION: ${sha} has no associated merged PR.
+`);
+      }
+    }
+  }
+  return failed ? 1 : 0;
+}
+async function auditCommand(args) {
+  process.exit(await runAudit(args, realDeps2()));
+}
+
+// src/commands/check.ts
+import { execFileSync as execFileSync4 } from "node:child_process";
+
+// src/checks/contract.ts
+var CHECK_SCHEMA_VERSION = 1;
+function emitCheckError(error) {
+  process.stderr.write(`${JSON.stringify(error)}
+`);
+}
+
+// src/checks/registry.ts
+import { join as join3 } from "node:path";
+
+// src/lib/package-root.ts
+import { existsSync as existsSync2 } from "node:fs";
+import { dirname, join as join2 } from "node:path";
+import { fileURLToPath } from "node:url";
+function packageRoot(moduleUrl) {
+  let dir = dirname(fileURLToPath(moduleUrl));
+  while (!existsSync2(join2(dir, "package.json"))) {
+    const parent = dirname(dir);
+    if (parent === dir)
+      break;
+    dir = parent;
+  }
+  return dir;
+}
+
+// src/checks/registry.ts
+var BIN_DIR = join3(packageRoot(import.meta.url), "src", "checks", "bin");
+function coreCheckRegistry() {
+  return [
+    {
+      name: "brief-shape",
+      run: join3(BIN_DIR, "check-brief-shape.ts"),
+      scope: "diff",
+      timeoutMs: 15000
+    },
+    {
+      name: "doc-coverage",
+      run: join3(BIN_DIR, "check-doc-coverage.ts"),
+      scope: "diff",
+      timeoutMs: 15000
+    },
+    {
+      name: "coherence",
+      run: join3(BIN_DIR, "check-coherence.ts"),
+      scope: "full",
+      timeoutMs: 30000
+    },
+    {
+      name: "dispatch-readiness",
+      run: join3(BIN_DIR, "check-dispatch-readiness.ts"),
+      scope: "full",
+      timeoutMs: 30000
+    },
+    {
+      name: "closes-n",
+      run: join3(BIN_DIR, "check-closes-n.ts"),
+      scope: "diff",
+      timeoutMs: 15000
+    },
+    {
+      name: "single-plan-pr",
+      run: join3(BIN_DIR, "check-single-plan-pr.ts"),
+      scope: "diff",
+      timeoutMs: 15000
+    },
+    {
+      name: "test-plan",
+      run: join3(BIN_DIR, "check-test-plan.ts"),
+      scope: "diff",
+      timeoutMs: 15000
+    },
+    {
+      name: "no-disk-state",
+      run: join3(BIN_DIR, "check-no-disk-state.ts"),
+      scope: "diff",
+      timeoutMs: 15000
+    },
+    {
+      name: "registry-gates",
+      run: join3(BIN_DIR, "check-registry-gates.ts"),
+      scope: "full",
+      timeoutMs: 30000
+    },
+    {
+      name: "review-gate",
+      run: join3(BIN_DIR, "check-review-gate.ts"),
+      scope: "full",
+      timeoutMs: 30000
+    },
+    {
+      name: "branch-topology",
+      run: join3(BIN_DIR, "check-branch-topology.ts"),
+      scope: "full",
+      timeoutMs: 30000
+    },
+    {
+      name: "dead-branch-push",
+      run: join3(BIN_DIR, "check-dead-branch-push.ts"),
+      scope: "full",
+      timeoutMs: 30000
+    },
+    {
+      name: "first-push-dispatch",
+      run: join3(BIN_DIR, "check-first-push-dispatch.ts"),
+      scope: "full",
+      timeoutMs: 30000
+    },
+    {
+      name: "doc-coverage-push",
+      run: join3(BIN_DIR, "check-doc-coverage-push.ts"),
+      scope: "diff",
+      timeoutMs: 15000
+    },
+    {
+      name: "issue-assignment",
+      run: join3(BIN_DIR, "check-issue-assignment.ts"),
+      scope: "full",
+      timeoutMs: 30000
+    }
+  ];
+}
+
+// src/checks/runner.ts
+import { spawn } from "node:child_process";
+import { cpus } from "node:os";
+function defaultParallelism() {
+  return Math.max(1, cpus().length);
+}
+function isCheckError(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const v = value;
+  return v.schema === CHECK_SCHEMA_VERSION && typeof v.check === "string" && (v.severity === "error" || v.severity === "warning") && typeof v.message === "string" && typeof v.agent_recovery_prompt === "string";
+}
+function shouldSkip(spec, opts) {
+  if (spec.scope !== "diff")
+    return false;
+  if (!opts.diffOnly)
+    return false;
+  if (opts.changedFiles === null)
+    return false;
+  if (!spec.include || spec.include.length === 0)
+    return false;
+  const regexes = spec.include.map(globToRegex);
+  return !opts.changedFiles.some((f) => regexes.some((re) => re.test(f)));
+}
+var KILL_GRACE_MS = 2000;
+async function runOne(spec, timeoutMs) {
+  const start = performance.now();
+  const proc = spawn(spec.run, spec.args ?? [], {
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  let timedOut = false;
+  let killTimer;
+  const timer = setTimeout(() => {
+    timedOut = true;
+    proc.kill("SIGTERM");
+    killTimer = setTimeout(() => proc.kill("SIGKILL"), KILL_GRACE_MS);
+  }, timeoutMs);
+  let stderrText = "";
+  proc.stderr.setEncoding("utf-8");
+  proc.stderr.on("data", (chunk) => {
+    stderrText += chunk;
+  });
+  proc.stdout.resume();
+  let spawnError;
+  const exitCode = await new Promise((resolve) => {
+    proc.on("close", (code) => resolve(code));
+    proc.on("error", (err) => {
+      spawnError = err;
+      resolve(null);
+    });
+  });
+  clearTimeout(timer);
+  clearTimeout(killTimer);
+  const durationMs = performance.now() - start;
+  if (timedOut) {
+    return { name: spec.name, status: "timeout", exitCode: null, errors: [], durationMs };
+  }
+  if (spawnError) {
+    const code = spawnError.code;
+    return {
+      name: spec.name,
+      status: "error",
+      exitCode: null,
+      errors: [
+        {
+          schema: 1,
+          check: spec.name,
+          severity: "error",
+          message: code === "ENOENT" ? `Could not run check "${spec.name}": executable \`${spec.run}\` was not found on PATH.` : `Could not run check "${spec.name}": ${spawnError.message}`,
+          agent_recovery_prompt: code === "ENOENT" ? `Install \`${spec.run}\` or correct the \`run\` field for check "${spec.name}" in vinaya.config.json, then re-run.` : `Inspect the \`run\` and \`args\` fields for check "${spec.name}" in vinaya.config.json, then re-run.`
+        }
+      ],
+      durationMs
+    };
+  }
+  const lines = stderrText.split(`
+`).map((l) => l.trim()).filter(Boolean);
+  const errors = [];
+  let malformed = false;
+  for (const line of lines) {
+    try {
+      const parsed = JSON.parse(line);
+      if (isCheckError(parsed)) {
+        errors.push(parsed);
+      } else {
+        malformed = true;
+      }
+    } catch {
+      malformed = true;
+    }
+  }
+  let status;
+  if (malformed) {
+    status = "error";
+  } else if (exitCode === 0) {
+    status = "pass";
+  } else if (exitCode === 1) {
+    status = "fail";
+  } else {
+    status = "error";
+  }
+  return { name: spec.name, status, exitCode, errors, durationMs };
+}
+async function runChecks(specs, opts) {
+  const results = new Array(specs.length);
+  const toRun = [];
+  for (let i = 0;i < specs.length; i++) {
+    const spec = specs[i];
     if (shouldSkip(spec, opts)) {
       results[i] = { name: spec.name, status: "skipped", exitCode: null, errors: [], durationMs: 0 };
     } else {
@@ -774,9 +1487,9 @@ async function runChecks(specs, opts) {
 }
 
 // src/lib/config.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync as existsSync3, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname as dirname2, join as join2 } from "node:path";
+import { dirname as dirname2, join as join4 } from "node:path";
 import { z } from "zod";
 var CheckEntrySchema = z.object({
   run: z.string(),
@@ -842,14 +1555,14 @@ var VinayaConfigSchema = z.object({
   briefSchema: BriefSchemaSchema.optional(),
   managed: ManagedManifestSchema.optional()
 });
-var GLOBAL_VINAYA_HOME = join2(homedir(), ".vinaya");
-var GLOBAL_CONFIG_PATH = join2(GLOBAL_VINAYA_HOME, "config.json");
+var GLOBAL_VINAYA_HOME = join4(homedir(), ".vinaya");
+var GLOBAL_CONFIG_PATH = join4(GLOBAL_VINAYA_HOME, "config.json");
 var LOCAL_CONFIG_FILENAME = "vinaya.config.json";
 function findLocalConfig() {
   let dir = process.cwd();
   while (true) {
-    const candidate = join2(dir, LOCAL_CONFIG_FILENAME);
-    if (existsSync(candidate))
+    const candidate = join4(dir, LOCAL_CONFIG_FILENAME);
+    if (existsSync3(candidate))
       return candidate;
     const parent = dirname2(dir);
     if (parent === dir)
@@ -861,7 +1574,7 @@ function configPath() {
   const local = findLocalConfig();
   if (local)
     return local;
-  if (existsSync(GLOBAL_CONFIG_PATH))
+  if (existsSync3(GLOBAL_CONFIG_PATH))
     return GLOBAL_CONFIG_PATH;
   return null;
 }
@@ -883,20 +1596,10 @@ function loadConfigChecked() {
   return { ok: true, config: parsed.data };
 }
 
-// src/lib/envelope.ts
-var ENVELOPE_SCHEMA_VERSION = 1;
-function toEnvelope(data) {
-  return { schema: ENVELOPE_SCHEMA_VERSION, data };
-}
-function printJson(data) {
-  process.stdout.write(`${JSON.stringify(toEnvelope(data), null, 2)}
-`);
-}
-
 // src/commands/check.ts
 function git(args) {
   try {
-    return execFileSync2("git", args, { encoding: "utf8" }).trim();
+    return execFileSync4("git", args, { encoding: "utf8" }).trim();
   } catch {
     return "";
   }
@@ -983,16 +1686,217 @@ async function checkCommand(args) {
   process.exit(failed ? 1 : 0);
 }
 
+// src/commands/demo.ts
+import { execFileSync as execFileSync5, spawnSync } from "node:child_process";
+import { existsSync as existsSync4, readFileSync as readFileSync2, rmSync, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { isAbsolute, join as join5 } from "node:path";
+var DEMO_BRANCH_PREFIX = "vinaya/demo-break-";
+var FIXTURE_PATH = ".vinaya-demo-brief.md";
+var STATE_FILENAME = "vinaya-demo-state.json";
+function gitCapture(repoRoot, args) {
+  return execFileSync5("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+}
+function branchExists(repoRoot, name) {
+  try {
+    execFileSync5("git", ["rev-parse", "--verify", "--quiet", `refs/heads/${name}`], {
+      cwd: repoRoot,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function createDemoBranch(repoRoot) {
+  for (let attempt = 0;attempt < 5; attempt++) {
+    const candidate = `${DEMO_BRANCH_PREFIX}${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+    if (!branchExists(repoRoot, candidate)) {
+      gitCapture(repoRoot, ["checkout", "-b", candidate]);
+      return candidate;
+    }
+  }
+  throw new Error("Could not generate a collision-free demo branch name after 5 attempts.");
+}
+function gitDirAbs(repoRoot) {
+  const raw = gitCapture(repoRoot, ["rev-parse", "--git-dir"]);
+  return isAbsolute(raw) ? raw : join5(repoRoot, raw);
+}
+function recoverFromCrash(repoRoot, statePath) {
+  const currentBranch = gitCapture(repoRoot, ["rev-parse", "--abbrev-ref", "HEAD"]);
+  let state = null;
+  if (existsSync4(statePath)) {
+    try {
+      state = JSON.parse(readFileSync2(statePath, "utf-8"));
+    } catch {
+      state = null;
+    }
+  }
+  const onStrayBranch = currentBranch.startsWith(DEMO_BRANCH_PREFIX);
+  if (!state) {
+    if (onStrayBranch) {
+      throw new Error(`On a leftover demo branch \`${currentBranch}\` with no recoverable state file. ` + "Checkout the branch you want manually, then re-run `vinaya demo break`.");
+    }
+    return;
+  }
+  process.stdout.write(`→ Found a leftover demo branch from a previous run — cleaning it up first.
+`);
+  if (onStrayBranch) {
+    gitCapture(repoRoot, ["reset", "--hard"]);
+    gitCapture(repoRoot, ["clean", "-fd"]);
+    if (!branchExists(repoRoot, state.originalBranch)) {
+      throw new Error(`Recorded original branch \`${state.originalBranch}\` no longer exists. ` + "Checkout the branch you want manually, then re-run `vinaya demo break`.");
+    }
+    gitCapture(repoRoot, ["checkout", state.originalBranch]);
+  }
+  if (branchExists(repoRoot, state.demoBranch)) {
+    gitCapture(repoRoot, ["branch", "-D", state.demoBranch]);
+  }
+  rmSync(statePath, { force: true });
+}
+function attemptCommit(repoRoot, demoBranch, prBody, message) {
+  const result = spawnSync("git", ["commit", "-m", message], {
+    cwd: repoRoot,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    env: { ...process.env, PR_BODY: prBody, BRANCH: demoBranch }
+  });
+  return { status: result.status ?? 1, stdout: result.stdout ?? "", stderr: result.stderr ?? "" };
+}
+function briefFixture(opts) {
+  const tierLine = opts.includeTier ? `Tier: 1
+` : "";
+  return `For: vinaya demo
+Project: vinaya-demo-fixture
+${tierLine}
+## Summary
+Fixture brief staged only by \`vinaya demo break\` — discarded with the demo branch.
+
+## Technical surface map
+None — fixture content only; no real files change.
+
+## Documentation-update list
+None — fixture content only.
+
+## Test Plan
+Test Plan: unit-tests-only
+
+## Stop Conditions
+Autonomy: Do not stop to ask clarifying questions — this is a scripted demo; proceed and clean up automatically.
+
+Illustrative Step 0 (never actually run by this demo):
+\`\`\`
+git worktree add .worktrees/demo-fixture -b demo/fixture origin/main
+\`\`\`
+
+Closes #0 (fixture value — no real Issue; discarded with the demo branch)
+`;
+}
+function cleanup(repoRoot, originalBranch, demoBranch, statePath) {
+  gitCapture(repoRoot, ["reset", "--hard"]);
+  gitCapture(repoRoot, ["clean", "-fd"]);
+  gitCapture(repoRoot, ["checkout", originalBranch]);
+  gitCapture(repoRoot, ["branch", "-D", demoBranch]);
+  if (existsSync4(statePath))
+    rmSync(statePath, { force: true });
+}
+async function runDemoBreak(repoRoot, args) {
+  const keep = args.includes("--keep");
+  const hookDir = resolveHookDir(repoRoot);
+  const hookPath = join5(repoRoot, hookDir, "pre-commit");
+  if (!existsSync4(hookPath)) {
+    console.error("Vinaya hooks are not installed in this repo. Run `vinaya init` first.");
+    return 1;
+  }
+  const statePath = join5(gitDirAbs(repoRoot), STATE_FILENAME);
+  recoverFromCrash(repoRoot, statePath);
+  const dirty = gitCapture(repoRoot, ["status", "--porcelain"]);
+  if (dirty.length > 0) {
+    console.error("Working tree has uncommitted changes. Commit or stash them before running `vinaya demo break` — " + "the demo never touches a dirty tree.");
+    return 1;
+  }
+  const originalBranch = gitCapture(repoRoot, ["rev-parse", "--abbrev-ref", "HEAD"]);
+  if (originalBranch === "HEAD") {
+    console.error("Cannot run `vinaya demo break` from a detached HEAD — checkout a branch first.");
+    return 1;
+  }
+  const demoBranch = createDemoBranch(repoRoot);
+  writeFileSync2(statePath, JSON.stringify({ originalBranch, demoBranch }), "utf-8");
+  process.stdout.write(`
+→ Created isolated branch \`${demoBranch}\` off \`${originalBranch}\`.
+
+`);
+  const fixturePath = join5(repoRoot, FIXTURE_PATH);
+  writeFileSync2(fixturePath, briefFixture({ includeTier: false }), "utf-8");
+  gitCapture(repoRoot, ["add", FIXTURE_PATH]);
+  process.stdout.write(`Staged \`${FIXTURE_PATH}\` — a brief missing its required \`Tier:\` field.
+Attempting to commit…
+
+`);
+  const badResult = attemptCommit(repoRoot, demoBranch, briefFixture({ includeTier: false }), "Chore(demo): stage a malformed brief");
+  if (badResult.status === 0) {
+    console.error("Expected the installed hook to refuse this commit, but it passed — the demo cannot show a real refusal here.");
+    cleanup(repoRoot, originalBranch, demoBranch, statePath);
+    return 1;
+  }
+  process.stdout.write(`✗ Commit refused — the real installed hook output:
+
+`);
+  process.stdout.write(badResult.stdout);
+  process.stdout.write(badResult.stderr);
+  process.stdout.write(`
+→ Fixing the brief: adding the missing \`Tier:\` field…
+
+`);
+  writeFileSync2(fixturePath, briefFixture({ includeTier: true }), "utf-8");
+  gitCapture(repoRoot, ["add", FIXTURE_PATH]);
+  const goodResult = attemptCommit(repoRoot, demoBranch, briefFixture({ includeTier: true }), "Chore(demo): fix the brief and commit");
+  if (goodResult.status !== 0) {
+    console.error(`The fixed brief still failed the hook — this demo cannot proceed:
+`);
+    console.error(goodResult.stdout);
+    console.error(goodResult.stderr);
+    cleanup(repoRoot, originalBranch, demoBranch, statePath);
+    return 1;
+  }
+  process.stdout.write(`✓ Commit passed — the fix worked.
+`);
+  if (keep) {
+    if (existsSync4(statePath))
+      unlinkSync(statePath);
+    process.stdout.write(`
+--keep: leaving \`${demoBranch}\` checked out for you to inspect. Clean up with:
+
+`);
+    process.stdout.write(`  git checkout ${originalBranch} && git branch -D ${demoBranch}
+`);
+    return 0;
+  }
+  cleanup(repoRoot, originalBranch, demoBranch, statePath);
+  process.stdout.write(`
+✓ Cleaned up — back on \`${originalBranch}\`, \`${demoBranch}\` deleted.
+`);
+  return 0;
+}
+async function demoBreakCommand(args) {
+  const repo = await detectGitRepo();
+  if (!repo) {
+    console.error("Error: not a git repository. Run `vinaya demo break` from inside your repo.");
+    process.exit(1);
+  }
+  const code = await runDemoBreak(repo.repoRoot, args);
+  process.exit(code);
+}
+
 // src/commands/doctor.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3, statSync } from "node:fs";
-import { dirname as dirname4, join as join5 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { existsSync as existsSync6, readFileSync as readFileSync4, statSync } from "node:fs";
+import { join as join7 } from "node:path";
 
 // src/lib/artifacts.ts
 var CONFIG_PATH = "vinaya.config.json";
 var DOCTRINE_POINTER_PATH = "VINAYA.md";
 var CHECKS_WORKFLOW_PATH = ".github/workflows/vinaya-checks.yml";
 var REVIEW_WORKFLOW_PATH = ".github/workflows/vinaya-review.yml";
+var ARCHIVIST_WORKFLOW_PATH = ".github/workflows/vinaya-archivist.yml";
 var MANAGED_NOTE = "Managed by Vinaya — created by `vinaya init`. `vinaya upgrade` regenerates it; `vinaya eject` removes it.";
 function starterConfig() {
   return {
@@ -1039,7 +1943,7 @@ jobs:
         with:
           node-version: 20
       - name: Run checks
-        run: npx --yes vinaya check --all --diff-only
+        run: npx --yes @attalabs/vinaya check --all --diff-only
 `;
 }
 function reviewWorkflow() {
@@ -1058,44 +1962,123 @@ on:
   issue_comment:
     types: [created]
 
-jobs:
-  vinaya-review:
-    name: vinaya review gate
-    if: >
-      github.event_name == 'pull_request' ||
-      (github.event.issue.pull_request != null && contains(github.event.comment.body, 'VERDICT'))
+jobs:
+  vinaya-review:
+    name: vinaya review gate
+    if: >
+      github.event_name == 'pull_request' ||
+      (github.event.issue.pull_request != null && contains(github.event.comment.body, 'VERDICT'))
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+    steps:
+      # issue_comment payloads carry no PR head SHA/branch — resolve them
+      # before checkout, and check out that exact commit (the event's default
+      # ref is the repo's default branch, not the PR head).
+      - name: Resolve PR head
+        id: pr
+        env:
+          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if [ "\${{ github.event_name }}" = "pull_request" ]; then
+            NUMBER="\${{ github.event.pull_request.number }}"
+          else
+            NUMBER="\${{ github.event.issue.number }}"
+          fi
+          SHA=$(gh pr view "$NUMBER" --repo "\${{ github.repository }}" --json headRefOid -q .headRefOid)
+          echo "sha=$SHA" >> "$GITHUB_OUTPUT"
+      - uses: actions/checkout@v4
+        with:
+          ref: \${{ steps.pr.outputs.sha }}
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Review gate
+        env:
+          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+        run: npx --yes @attalabs/vinaya check --all
+`;
+}
+function archivistWorkflow() {
+  return `# ${MANAGED_NOTE}
+#
+# The ring-2 post-merge/scheduled mechanisms: per-task Archivist provenance
+# + close-out (post-merge), dead-branch-push drift (daily-drift, a
+# notification channel — never fails red), and direct-main-push detection
+# (direct-main-push-detection, a real pass/fail).
+name: Vinaya Archivist
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "0 2 * * *"  # daily at 02:00 UTC
+  workflow_dispatch:
+
+jobs:
+  post-merge:
+    name: Post-Merge Archivist
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Run vinaya archive
+        env:
+          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+        run: npx --yes @attalabs/vinaya archive --merge-sha=\${{ github.sha }}
+
+  daily-drift:
+    name: Daily Drift Check (dead-branch pushes)
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      pull-requests: read
-      issues: read
+      issues: write
+      pull-requests: write
     steps:
-      # issue_comment payloads carry no PR head SHA/branch — resolve them
-      # before checkout, and check out that exact commit (the event's default
-      # ref is the repo's default branch, not the PR head).
-      - name: Resolve PR head
-        id: pr
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Run vinaya audit --only=dead-branches
+        continue-on-error: true # never-red — this job is a notification channel, not a gate
         env:
           GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
-        run: |
-          if [ "\${{ github.event_name }}" = "pull_request" ]; then
-            NUMBER="\${{ github.event.pull_request.number }}"
-          else
-            NUMBER="\${{ github.event.issue.number }}"
-          fi
-          SHA=$(gh pr view "$NUMBER" --repo "\${{ github.repository }}" --json headRefOid -q .headRefOid)
-          echo "sha=$SHA" >> "$GITHUB_OUTPUT"
+        run: npx --yes @attalabs/vinaya audit --only=dead-branches
+
+  direct-main-push-detection:
+    name: Direct-Main-Push Detection
+    if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: read
+    steps:
       - uses: actions/checkout@v4
         with:
-          ref: \${{ steps.pr.outputs.sha }}
           fetch-depth: 0
       - uses: actions/setup-node@v4
         with:
           node-version: 20
-      - name: Review gate
+      - name: Run vinaya audit --only=direct-push
         env:
           GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
-        run: npx --yes vinaya check --all
+        run: npx --yes @attalabs/vinaya audit --only=direct-push --sha=\${{ github.sha }}
 `;
 }
 var HOOK_PREAMBLE = `#!/usr/bin/env sh
@@ -1103,20 +2086,22 @@ var HOOK_PREAMBLE = `#!/usr/bin/env sh
 function preCommitBody() {
   return `# Vinaya commit-time gate. Runs the deterministic checks over your staged
 # diff before the commit lands.
-npx --no-install vinaya check --all --diff-only || exit 1`;
+npx --no-install @attalabs/vinaya check --all --diff-only || exit 1`;
 }
 function prePushBody() {
   return `# Vinaya pre-push gate. Runs branch/dispatch checks before the push leaves.
-npx --no-install vinaya check --all || exit 1`;
+npx --no-install @attalabs/vinaya check --all || exit 1`;
 }
 function doctrinePointer() {
   return `<!-- ${MANAGED_NOTE} -->
 # Vinaya doctrine — read this first
 
 This repo is governed by Vinaya. The full, canonical doctrine (roles,
-contracts, the state machine, the ring gates) ships inside the installed
-\`vinaya\` npm package as versioned reference content and is updated cleanly by
-\`vinaya upgrade\` — there is no in-repo copy to drift.
+contracts, the state machine, the ring gates) currently lives in the
+\`attalabs\` monorepo's \`aeg-root/\` (public GitHub source) — bundling it into
+the installed \`vinaya\` npm package, so it ships and updates cleanly via
+\`vinaya upgrade\` with no in-repo copy to drift, is planned but not yet
+shipped.
 
 An agent working in this repo follows the governed flow by reading two things:
 
@@ -1128,8 +2113,59 @@ An agent working in this repo follows the governed flow by reading two things:
 Live task status is derived from the forge (Issues, labels, comments) via
 \`vinaya check\` — it is never written into a file here.
 
-To view the doctrine text: \`vinaya doctor\` reports what is installed; the
-package's own reference content is the source of truth.
+To view the doctrine text today: read \`aeg-root/\` in the \`attalabs\`
+monorepo; \`vinaya doctor\` reports what is installed in this repo. Once
+in-package bundling ships, the package's own reference content becomes the
+source of truth.
+`;
+}
+function starterDocOwners() {
+  return `# ${MANAGED_NOTE}
+#
+# ${DOC_OWNERS_PATH} — code → doc bindings for the coherence seam.
+#
+# Format: one binding per line, CODEOWNERS-shaped.
+#     <code-glob>  <doc-pointer>
+# Whitespace-separated. Lines starting with \`#\` and blank lines are ignored.
+#
+# Glob syntax (kept deliberately simple — no character classes):
+#   \`**\`  matches any sequence (including \`/\`)
+#   \`*\`   matches any sequence not containing \`/\`
+#   every other character is literal — so dynamic-route segments like
+#   \`[username]\` match literally, no escaping required.
+#
+# Pointer forms:
+#   in-repo path             e.g. \`docs/my-feature.md\`
+#   in-repo path with anchor e.g. \`docs/my-feature.md#section-2\`
+#   URL                      e.g. \`https://example.com/docs/x\`
+#
+# Coverage rule (enforced by C5, the doc-owners check bundled into \`vinaya check\`):
+#   When a code file in the PR matches a glob:
+#     - in-repo pointer  → that path must appear in the PR diff, else FAIL
+#     - URL pointer      → require a \`Doc-ack: <pointer> — <note>\` PR-body line
+#     - dangling pointer → in-repo pointer that does not exist on disk: FAIL
+#   Escape:
+#     A PR-wide \`vinaya/waiver:docs\` label whose labeling timeline event's
+#     actor is a configured principal suppresses every fired binding for that
+#     PR — a forge-authenticated human act, never a parseable string. There is
+#     no PR-body waiver field; label presence alone is never sufficient.
+#
+# Dormancy:
+#   This file absent, OR no glob matches any changed code file → silent no-op.
+#   The gate has no opinion until you teach it one.
+#
+# ── No-doc allow-list ───────────────────────────────────────────────────────
+# Surfaces that legitimately need no bound doc are listed below. Format:
+#   # no-doc: <glob> — <reason>
+# These lines exempt the matching directory from the completeness scoreboard
+# (\`vinaya check\`'s advisory output). They do NOT affect C5 enforcement — if a
+# binding exists for a surface, C5 still fires on changed files regardless of
+# any no-doc line. Use no-doc for scaffold-only, config-only, or stub-only
+# surfaces where adding a doc-owners binding would be meaningless busywork.
+# To un-exempt a surface, remove its no-doc line and add a real binding.
+#
+# This starter ships empty — no bindings, no no-doc entries. Add your own
+# below this line as your repo grows real code → doc coverage needs.
 `;
 }
 function labelOps() {
@@ -1162,6 +2198,7 @@ function buildInitOps(ctx) {
   const hookMode = 493;
   ops.push({ kind: "create-file", path: CHECKS_WORKFLOW_PATH, content: checksWorkflow(), group: "CI workflows" });
   ops.push({ kind: "create-file", path: REVIEW_WORKFLOW_PATH, content: reviewWorkflow(), group: "CI workflows" });
+  ops.push({ kind: "create-file", path: ARCHIVIST_WORKFLOW_PATH, content: archivistWorkflow(), group: "CI workflows" });
   ops.push({
     kind: "managed-block",
     path: `${ctx.hookDir}/pre-commit`,
@@ -1195,6 +2232,12 @@ function buildInitOps(ctx) {
     content: doctrinePointer(),
     group: "Doctrine pointer"
   });
+  ops.push({
+    kind: "create-file",
+    path: DOC_OWNERS_PATH,
+    content: starterDocOwners(),
+    group: "Doc-ownership manifest"
+  });
   ops.push(...labelOps());
   ops.push({ kind: "print", message: BRANCH_PROTECTION_NOTE, group: "Branch protection (printed, never applied)" });
   return ops;
@@ -1212,107 +2255,9 @@ function buildInitProductOps(name) {
   ];
 }
 
-// src/lib/detect.ts
-import { execFile as execFile4 } from "node:child_process";
-import { existsSync as existsSync2 } from "node:fs";
-import { join as join3 } from "node:path";
-import { promisify as promisify4 } from "node:util";
-var execFileAsync4 = promisify4(execFile4);
-async function detectGitRepo() {
-  try {
-    const { stdout: root } = await execFileAsync4("git", ["rev-parse", "--show-toplevel"]);
-    const repoRoot = root.trim();
-    let owner = "";
-    let repo = "";
-    try {
-      const { stdout: url } = await execFileAsync4("git", ["remote", "get-url", "origin"]);
-      const m = url.trim().match(/github\.com[/:]([^/]+)\/([^/]+?)(?:\.git)?$/);
-      if (m) {
-        owner = m[1] ?? "";
-        repo = m[2] ?? "";
-      }
-    } catch {}
-    return { repoRoot, owner, repo };
-  } catch {
-    return null;
-  }
-}
-async function checkGhAuth() {
-  try {
-    await execFileAsync4("gh", ["auth", "status"]);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function ghAuthStatus() {
-  try {
-    const { stderr, stdout } = await execFileAsync4("gh", ["auth", "status"]);
-    return { authenticated: true, detail: (stderr || stdout).trim() };
-  } catch (err) {
-    const stderr = err.stderr;
-    return { authenticated: false, detail: stderr?.trim() || "gh is not authenticated" };
-  }
-}
-async function branchProtectionConfigured(owner, repo) {
-  if (!owner || !repo)
-    return null;
-  try {
-    await execFileAsync4("gh", ["api", `repos/${owner}/${repo}/branches/main/protection`]);
-    return true;
-  } catch (err) {
-    const stderr = err.stderr ?? "";
-    if (/\b404\b/.test(stderr))
-      return false;
-    return null;
-  }
-}
-function resolveHookDir(repoRoot) {
-  return existsSync2(join3(repoRoot, ".husky")) ? ".husky" : ".git/hooks";
-}
-function hookDirFromManifest(manifest, fallback) {
-  const block = manifest.blocks.find((b) => b.path.startsWith(".husky/") || b.path.startsWith(".git/hooks/"));
-  if (block?.path.startsWith(".husky/"))
-    return ".husky";
-  if (block?.path.startsWith(".git/hooks/"))
-    return ".git/hooks";
-  return fallback;
-}
-async function customHooksPath(repoRoot) {
-  try {
-    const { stdout } = await execFileAsync4("git", ["-C", repoRoot, "config", "--get", "core.hooksPath"]);
-    const v = stdout.trim();
-    if (!v)
-      return null;
-    if (v === ".husky" || v === ".husky/_")
-      return null;
-    return v;
-  } catch {
-    return null;
-  }
-}
-function ghLabelGateway(repoRoot) {
-  return {
-    async exists(name) {
-      try {
-        const { stdout } = await execFileAsync4("gh", ["label", "list", "--json", "name"], { cwd: repoRoot });
-        const names = JSON.parse(stdout);
-        return names.some((l) => l.name === name);
-      } catch {
-        return false;
-      }
-    },
-    async create(name, color, description) {
-      await execFileAsync4("gh", ["label", "create", name, "--color", color, "--description", description], {
-        cwd: repoRoot
-      });
-    }
-  };
-}
-
 // src/lib/ops.ts
-import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname3, join as join4, resolve, sep } from "node:path";
+import { chmodSync, existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync3, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname3, join as join6, resolve, sep } from "node:path";
 var MARKER_NS = "vinaya:managed";
 function markerLines(marker, comment) {
   const [open, close] = comment === "hash" ? ["#", ""] : ["<!--", " -->"];
@@ -1328,7 +2273,7 @@ ${op.body}
 ${end}`;
 }
 function abs(repoRoot, relPath) {
-  return join4(repoRoot, relPath);
+  return join6(repoRoot, relPath);
 }
 function containedAbs(repoRoot, relPath) {
   const root = resolve(repoRoot);
@@ -1339,9 +2284,9 @@ function containedAbs(repoRoot, relPath) {
 }
 function fileContains(repoRoot, relPath, needle) {
   const p = abs(repoRoot, relPath);
-  if (!existsSync3(p))
+  if (!existsSync5(p))
     return false;
-  return readFileSync2(p, "utf-8").includes(needle);
+  return readFileSync3(p, "utf-8").includes(needle);
 }
 function planInstall(ops, repoRoot, ownedFiles = new Set) {
   const entries = [];
@@ -1349,7 +2294,7 @@ function planInstall(ops, repoRoot, ownedFiles = new Set) {
   for (const op of ops) {
     switch (op.kind) {
       case "create-file": {
-        const exists = existsSync3(abs(repoRoot, op.path));
+        const exists = existsSync5(abs(repoRoot, op.path));
         let action;
         if (!exists)
           action = "create";
@@ -1367,7 +2312,7 @@ function planInstall(ops, repoRoot, ownedFiles = new Set) {
         let action;
         if (fileContains(repoRoot, op.path, begin))
           action = "skip-present";
-        else if (existsSync3(abs(repoRoot, op.path)))
+        else if (existsSync5(abs(repoRoot, op.path)))
           action = "append";
         else
           action = "create-host";
@@ -1445,19 +2390,19 @@ function renderInstallDiff(plan) {
 }
 function writeFileWithDirs(target, content, mode) {
   mkdirSync2(dirname3(target), { recursive: true });
-  writeFileSync2(target, content, "utf-8");
+  writeFileSync3(target, content, "utf-8");
   if (mode !== undefined)
     chmodSync(target, mode);
 }
 function appendBlock(repoRoot, op) {
   const target = abs(repoRoot, op.path);
-  const existing = readFileSync2(target, "utf-8");
+  const existing = readFileSync3(target, "utf-8");
   const sep2 = existing.endsWith(`
 `) ? `
 ` : `
 
 `;
-  writeFileSync2(target, `${existing}${sep2}${renderBlock(op)}
+  writeFileSync3(target, `${existing}${sep2}${renderBlock(op)}
 `, "utf-8");
   if (op.mode !== undefined)
     chmodSync(target, op.mode);
@@ -1504,9 +2449,14 @@ async function applyInstall(plan, repoRoot, labels, onFilesRecorded) {
   for (const e of plan.entries) {
     if (e.kind !== "create-label")
       continue;
-    if (!await labels.exists(e.op.name)) {
-      await labels.create(e.op.name, e.op.color, e.op.description);
-      createdLabels.push(e.op.name);
+    try {
+      if (!await labels.exists(e.op.name)) {
+        await labels.create(e.op.name, e.op.color, e.op.description);
+        createdLabels.push(e.op.name);
+      }
+    } catch (err) {
+      const reason = err.stderr?.trim() || err.message;
+      console.warn(`Warning: could not create label '${e.op.name}': ${reason}`);
     }
   }
   return { ...base, labels: dedupe(createdLabels) };
@@ -1557,7 +2507,7 @@ function planEject(manifest, repoRoot) {
       escapes.push(b.path);
       continue;
     }
-    if (!existsSync3(p)) {
+    if (!existsSync5(p)) {
       actions.push({
         kind: "strip-block",
         path: b.path,
@@ -1568,7 +2518,7 @@ function planEject(manifest, repoRoot) {
       });
       continue;
     }
-    const content = readFileSync2(p, "utf-8");
+    const content = readFileSync3(p, "utf-8");
     const stripped = stripBlockFromContent(content, b.marker, b.comment);
     const removesHost = stripped !== null && blockStripLeavesEmpty(stripped);
     actions.push({
@@ -1586,7 +2536,7 @@ function planEject(manifest, repoRoot) {
       escapes.push(f);
       continue;
     }
-    actions.push({ kind: "delete-file", path: f, present: existsSync3(p) });
+    actions.push({ kind: "delete-file", path: f, present: existsSync5(p) });
   }
   for (const name of manifest.labels) {
     actions.push({ kind: "report-label", name });
@@ -1620,20 +2570,20 @@ function applyEject(plan, repoRoot) {
       const p = containedAbs(repoRoot, a.path);
       if (p === null)
         continue;
-      const content = readFileSync2(p, "utf-8");
+      const content = readFileSync3(p, "utf-8");
       const stripped = stripBlockFromContent(content, a.marker, a.comment);
       if (stripped === null)
         continue;
       if (blockStripLeavesEmpty(stripped))
-        rmSync(p, { force: true });
+        rmSync2(p, { force: true });
       else
-        writeFileSync2(p, stripped.endsWith(`
+        writeFileSync3(p, stripped.endsWith(`
 `) ? stripped : `${stripped}
 `, "utf-8");
     } else if (a.kind === "delete-file") {
       const p = containedAbs(repoRoot, a.path);
       if (a.present && p !== null)
-        rmSync(p, { force: true });
+        rmSync2(p, { force: true });
     }
   }
   return {
@@ -1642,21 +2592,11 @@ function applyEject(plan, repoRoot) {
 }
 
 // src/commands/doctor.ts
-function packageRoot() {
-  let dir = dirname4(fileURLToPath2(import.meta.url));
-  while (!existsSync4(join5(dir, "package.json"))) {
-    const parent = dirname4(dir);
-    if (parent === dir)
-      break;
-    dir = parent;
-  }
-  return dir;
-}
 function readVersion() {
-  const pkg = JSON.parse(readFileSync3(join5(packageRoot(), "package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync4(join7(packageRoot(import.meta.url), "package.json"), "utf-8"));
   return pkg.version;
 }
-function realDeps() {
+function realDeps3() {
   return {
     detectRepo: detectGitRepo,
     ghAuthStatus,
@@ -1672,12 +2612,12 @@ var info = (check, message) => ({ check, severity: "info", message });
 var warn = (check, message) => ({ check, severity: "warn", message });
 var error = (check, message) => ({ check, severity: "error", message });
 function readConfig(repoRoot) {
-  const p = join5(repoRoot, CONFIG_PATH);
-  if (!existsSync4(p))
+  const p = join7(repoRoot, CONFIG_PATH);
+  if (!existsSync6(p))
     return { kind: "missing" };
   let raw;
   try {
-    raw = JSON.parse(readFileSync3(p, "utf-8"));
+    raw = JSON.parse(readFileSync4(p, "utf-8"));
   } catch (err) {
     return { kind: "invalid", error: `invalid JSON: ${err.message}` };
   }
@@ -1706,14 +2646,14 @@ function diagnoseInstall(repoRoot, ctx, manifest) {
   for (const op of buildInitOps(ctx)) {
     if (op.kind === "create-file") {
       const check = labelForPath(op.path);
-      const abs2 = join5(repoRoot, op.path);
-      const exists = existsSync4(abs2);
+      const abs2 = join7(repoRoot, op.path);
+      const exists = existsSync6(abs2);
       const owned = ownedFiles.has(op.path);
       if (!exists) {
         findings.push(owned ? error(check, `${op.path} is recorded as vinaya-managed but missing on disk — run \`vinaya upgrade\`.`) : error(check, `${op.path} is not installed — run \`vinaya init\`.`));
         continue;
       }
-      const content = readFileSync3(abs2, "utf-8");
+      const content = readFileSync4(abs2, "utf-8");
       if (!owned) {
         findings.push(content === op.content ? warn(check, `${op.path} has vinaya's own content but isn't recorded in the manifest.`) : info(check, `${op.path} exists but is foreign content — not vinaya-managed, left untouched.`));
         continue;
@@ -1730,13 +2670,13 @@ function diagnoseInstall(repoRoot, ctx, manifest) {
       }
     } else if (op.kind === "managed-block") {
       const check = "hooks";
-      const abs2 = join5(repoRoot, op.path);
+      const abs2 = join7(repoRoot, op.path);
       const owned = ownedBlocks.has(blockKey(op.path, op.marker));
-      if (!existsSync4(abs2)) {
+      if (!existsSync6(abs2)) {
         findings.push(owned ? error(check, `${op.path} is missing — likely a fresh clone (raw git hooks aren't tracked by git). Run \`vinaya upgrade\` to restore it.`) : info(check, `${op.path} is not installed.`));
         continue;
       }
-      const content = readFileSync3(abs2, "utf-8");
+      const content = readFileSync4(abs2, "utf-8");
       const { begin, end } = markerLines(op.marker, op.comment);
       const hasMarkers = content.includes(begin) && content.includes(end);
       if (!hasMarkers) {
@@ -1761,8 +2701,8 @@ function diagnoseInstall(repoRoot, ctx, manifest) {
 function diagnoseCustomChecks(repoRoot, config) {
   const findings = [];
   for (const [name, entry2] of Object.entries(config.checks ?? {})) {
-    const scriptAbs = join5(repoRoot, entry2.run);
-    findings.push(existsSync4(scriptAbs) ? ok("checks", `custom check '${name}' → ${entry2.run}`) : error("checks", `custom check '${name}' points at a missing script: ${entry2.run}`));
+    const scriptAbs = join7(repoRoot, entry2.run);
+    findings.push(existsSync6(scriptAbs) ? ok("checks", `custom check '${name}' → ${entry2.run}`) : error("checks", `custom check '${name}' points at a missing script: ${entry2.run}`));
   }
   return findings;
 }
@@ -1846,12 +2786,12 @@ async function runDoctor(args, deps) {
   return healthy ? 0 : 1;
 }
 async function doctorCommand(args) {
-  process.exit(await runDoctor(args, realDeps()));
+  process.exit(await runDoctor(args, realDeps3()));
 }
 
 // src/commands/eject.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "node:fs";
-import { join as join6 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync5 } from "node:fs";
+import { join as join8 } from "node:path";
 
 // src/lib/prompt.ts
 var stdinBuffer = "";
@@ -1918,7 +2858,7 @@ function closeStdin() {
 }
 
 // src/commands/eject.ts
-function realDeps2() {
+function realDeps4() {
   return {
     detectRepo: detectGitRepo,
     confirm: async (q) => {
@@ -1932,12 +2872,12 @@ function parse(args) {
   return { dryRun: args.includes("--dry-run"), yes: args.includes("--yes") };
 }
 function readManifest(repoRoot) {
-  const p = join6(repoRoot, CONFIG_PATH);
-  if (!existsSync5(p))
+  const p = join8(repoRoot, CONFIG_PATH);
+  if (!existsSync7(p))
     return { kind: "none" };
   let raw;
   try {
-    raw = JSON.parse(readFileSync4(p, "utf-8"));
+    raw = JSON.parse(readFileSync5(p, "utf-8"));
   } catch (err) {
     return { kind: "orphan", reason: `vinaya.config.json is not valid JSON: ${err.message}` };
   }
@@ -2015,14 +2955,14 @@ Vinaya ejected.
   return 0;
 }
 async function ejectCommand(args) {
-  const code = await runEject(args, realDeps2());
+  const code = await runEject(args, realDeps4());
   process.exit(code);
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join7 } from "node:path";
-function realDeps3() {
+import { existsSync as existsSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join9 } from "node:path";
+function realDeps5() {
   return {
     detectRepo: detectGitRepo,
     checkGhAuth,
@@ -2041,19 +2981,19 @@ function flags(args) {
 }
 var PRODUCT_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
 function readManifest2(repoRoot) {
-  const p = join7(repoRoot, CONFIG_PATH);
-  if (!existsSync6(p))
+  const p = join9(repoRoot, CONFIG_PATH);
+  if (!existsSync8(p))
     return null;
   try {
-    return VinayaConfigSchema.parse(JSON.parse(readFileSync5(p, "utf-8"))).managed ?? null;
+    return VinayaConfigSchema.parse(JSON.parse(readFileSync6(p, "utf-8"))).managed ?? null;
   } catch {
     return null;
   }
 }
 function writeManifest(repoRoot, manifest) {
-  const configAbs = join7(repoRoot, CONFIG_PATH);
-  const seed = JSON.parse(readFileSync5(configAbs, "utf-8"));
-  writeFileSync3(configAbs, `${JSON.stringify({ ...seed, managed: manifest }, null, 2)}
+  const configAbs = join9(repoRoot, CONFIG_PATH);
+  const seed = JSON.parse(readFileSync6(configAbs, "utf-8"));
+  writeFileSync4(configAbs, `${JSON.stringify({ ...seed, managed: manifest }, null, 2)}
 `, "utf-8");
 }
 async function runInit(args, deps) {
@@ -2181,20 +3121,20 @@ function dedupeBlocks2(bs) {
   });
 }
 async function initCommand(args) {
-  process.exit(await runInit(args, realDeps3()));
+  process.exit(await runInit(args, realDeps5()));
 }
 async function initProductCommand(args) {
-  process.exit(await runInitProduct(args, realDeps3()));
+  process.exit(await runInitProduct(args, realDeps5()));
 }
 
 // src/commands/issue.ts
-import { execFileSync as execFileSync3 } from "node:child_process";
+import { execFileSync as execFileSync6 } from "node:child_process";
 
 // src/lib/forge-write.ts
-import { mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
-import { readFileSync as readFileSync6 } from "node:fs";
+import { mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { readFileSync as readFileSync7 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join8 } from "node:path";
+import { join as join10 } from "node:path";
 class ForgeArgError extends Error {
 }
 function locateBody(args) {
@@ -2204,13 +3144,13 @@ function locateBody(args) {
       const p = args[i + 1];
       if (!p)
         throw new ForgeArgError("`--body-file` was given with no path.");
-      return { body: readFileSync6(p, "utf8"), source: { kind: "file", argIndex: i + 1, inlineForm: false } };
+      return { body: readFileSync7(p, "utf8"), source: { kind: "file", argIndex: i + 1, inlineForm: false } };
     }
     if (a.startsWith("--body-file=")) {
       const p = a.slice("--body-file=".length);
       if (!p)
         throw new ForgeArgError("`--body-file=` was given with no path.");
-      return { body: readFileSync6(p, "utf8"), source: { kind: "file", argIndex: i, inlineForm: true } };
+      return { body: readFileSync7(p, "utf8"), source: { kind: "file", argIndex: i, inlineForm: true } };
     }
     if (a === "--body" || a === "-b") {
       const v = args[i + 1];
@@ -2227,13 +3167,13 @@ function resolveShippableArgs(args, bodyResult) {
   if (bodyResult?.source.kind !== "file") {
     return { finalArgs: args, cleanup: () => {} };
   }
-  const dir = mkdtempSync(join8(tmpdir(), "vinaya-forge-body-"));
-  const tempPath = join8(dir, "body.md");
-  writeFileSync4(tempPath, bodyResult.body, "utf8");
+  const dir = mkdtempSync(join10(tmpdir(), "vinaya-forge-body-"));
+  const tempPath = join10(dir, "body.md");
+  writeFileSync5(tempPath, bodyResult.body, "utf8");
   const finalArgs = [...args];
   const { argIndex, inlineForm } = bodyResult.source;
   finalArgs[argIndex] = inlineForm ? `--body-file=${tempPath}` : tempPath;
-  return { finalArgs, cleanup: () => rmSync2(dir, { recursive: true, force: true }) };
+  return { finalArgs, cleanup: () => rmSync3(dir, { recursive: true, force: true }) };
 }
 function extractTitle(args) {
   for (let i = 0;i < args.length; i++) {
@@ -2401,7 +3341,7 @@ function locateBodyOrRefuse(ghArgs, retryCommand) {
 function fetchForgeLabels(issueRef) {
   let out;
   try {
-    out = execFileSync3("gh", ["issue", "view", issueRef, "--json", "labels"], {
+    out = execFileSync6("gh", ["issue", "view", issueRef, "--json", "labels"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -2427,9 +3367,9 @@ function reportPass(json, command) {
   }
 }
 function runGhWrite(ghCmd, ghArgs, bodyResult, json) {
-  const { finalArgs, cleanup } = resolveShippableArgs(ghArgs, bodyResult);
+  const { finalArgs, cleanup: cleanup2 } = resolveShippableArgs(ghArgs, bodyResult);
   try {
-    const out = execFileSync3("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
+    const out = execFileSync6("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
     const url = out.trim();
     if (json)
       printJson({ validated: true, written: true, url });
@@ -2437,7 +3377,7 @@ function runGhWrite(ghCmd, ghArgs, bodyResult, json) {
       process.stdout.write(`${url}
 `);
   } finally {
-    cleanup();
+    cleanup2();
   }
 }
 function validateTaskIssue(body, title, retryCommand) {
@@ -2500,21 +3440,10 @@ function issueEditCommand(args) {
 }
 
 // src/commands/new-check.ts
-import { chmodSync as chmodSync2, existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname5, join as join9 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
-function packageRoot2() {
-  let dir = dirname5(fileURLToPath3(import.meta.url));
-  while (!existsSync7(join9(dir, "package.json"))) {
-    const parent = dirname5(dir);
-    if (parent === dir)
-      break;
-    dir = parent;
-  }
-  return dir;
-}
-var TEMPLATE_PATH = join9(packageRoot2(), "templates", "custom-check.template.ts");
-var CHECKS_DIR = join9("scripts", "vinaya-checks");
+import { chmodSync as chmodSync2, existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join11 } from "node:path";
+var TEMPLATE_PATH = join11(packageRoot(import.meta.url), "templates", "custom-check.template.ts");
+var CHECKS_DIR = join11("scripts", "vinaya-checks");
 var VALID_NAME = /^[a-z0-9][a-z0-9-]*$/;
 function newCheckCommand(args) {
   const name = args[0];
@@ -2522,19 +3451,19 @@ function newCheckCommand(args) {
     console.error("Usage: vinaya new check <name>  (name: lowercase letters, digits, hyphens)");
     process.exit(2);
   }
-  const scriptsDir = join9(process.cwd(), CHECKS_DIR);
-  if (!existsSync7(scriptsDir))
+  const scriptsDir = join11(process.cwd(), CHECKS_DIR);
+  if (!existsSync9(scriptsDir))
     mkdirSync3(scriptsDir, { recursive: true });
-  const targetPath = join9(scriptsDir, `${name}.ts`);
-  if (existsSync7(targetPath)) {
+  const targetPath = join11(scriptsDir, `${name}.ts`);
+  if (existsSync9(targetPath)) {
     console.error(`Error: ${targetPath} already exists.`);
     process.exit(1);
   }
-  const template = readFileSync7(TEMPLATE_PATH, "utf-8");
+  const template = readFileSync8(TEMPLATE_PATH, "utf-8");
   const contents = template.split("{{CHECK_NAME}}").join(name);
-  writeFileSync5(targetPath, contents, "utf-8");
+  writeFileSync6(targetPath, contents, "utf-8");
   chmodSync2(targetPath, 493);
-  const relPath = join9(CHECKS_DIR, `${name}.ts`);
+  const relPath = join11(CHECKS_DIR, `${name}.ts`);
   const registration = JSON.stringify({ checks: { [name]: { run: `./${relPath}`, scope: "diff" } } }, null, 2);
   process.stdout.write(`Created ${relPath}
 
@@ -2544,12 +3473,12 @@ ${registration}
 }
 
 // src/commands/pr.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
+import { execFileSync as execFileSync7 } from "node:child_process";
 var RETRY_CREATE2 = "vinaya pr create --validate-only …";
 var RETRY_EDIT2 = "vinaya pr edit <n> --validate-only …";
 function git2(args) {
   try {
-    return execFileSync4("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync7("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return "";
   }
@@ -2581,9 +3510,9 @@ function reportPass2(json, command) {
   }
 }
 function runGhWrite2(ghCmd, ghArgs, bodyResult, json) {
-  const { finalArgs, cleanup } = resolveShippableArgs(ghArgs, bodyResult);
+  const { finalArgs, cleanup: cleanup2 } = resolveShippableArgs(ghArgs, bodyResult);
   try {
-    const out = execFileSync4("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
+    const out = execFileSync7("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
     const url = out.trim();
     if (json)
       printJson({ validated: true, written: true, url });
@@ -2591,13 +3520,13 @@ function runGhWrite2(ghCmd, ghArgs, bodyResult, json) {
       process.stdout.write(`${url}
 `);
   } finally {
-    cleanup();
+    cleanup2();
   }
 }
 function fetchPrForgeContext(prRef) {
   let viewOut;
   try {
-    viewOut = execFileSync4("gh", ["pr", "view", prRef, "--json", "headRefName,files"], {
+    viewOut = execFileSync7("gh", ["pr", "view", prRef, "--json", "headRefName,files"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -2694,22 +3623,22 @@ function prEditCommand(args) {
 
 // src/commands/studio.ts
 import { spawn as spawn2 } from "node:child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync8 } from "node:fs";
-import { dirname as dirname6, join as join10 } from "node:path";
+import { existsSync as existsSync10, readFileSync as readFileSync9 } from "node:fs";
+import { dirname as dirname4, join as join12 } from "node:path";
 function resolveStudioTarget(cwd) {
   let dir = cwd;
   for (;; ) {
-    const webDir = join10(dir, "apps", "vinaya", "web");
-    const pkgPath = join10(webDir, "package.json");
-    if (existsSync8(pkgPath)) {
+    const webDir = join12(dir, "apps", "vinaya", "web");
+    const pkgPath = join12(webDir, "package.json");
+    if (existsSync10(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync8(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
         if (pkg.name === "@atta/vinaya-web") {
           return { kind: "workspace", webDir };
         }
       } catch {}
     }
-    const parent = dirname6(dir);
+    const parent = dirname4(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -2736,9 +3665,9 @@ async function runStudio(cwd, args) {
 }
 
 // src/commands/upgrade.ts
-import { existsSync as existsSync9, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join11 } from "node:path";
-function realDeps4() {
+import { existsSync as existsSync11, readFileSync as readFileSync10, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join13 } from "node:path";
+function realDeps6() {
   return {
     detectRepo: detectGitRepo,
     hookDirFor: resolveHookDir,
@@ -2753,12 +3682,12 @@ function flags2(args) {
   return { dryRun: args.includes("--dry-run"), yes: args.includes("--yes") };
 }
 function readManifest3(repoRoot) {
-  const p = join11(repoRoot, CONFIG_PATH);
-  if (!existsSync9(p))
+  const p = join13(repoRoot, CONFIG_PATH);
+  if (!existsSync11(p))
     return { kind: "missing" };
   let raw;
   try {
-    raw = JSON.parse(readFileSync9(p, "utf-8"));
+    raw = JSON.parse(readFileSync10(p, "utf-8"));
   } catch (err) {
     return { kind: "invalid", error: `invalid JSON: ${err.message}` };
   }
@@ -2774,10 +3703,10 @@ function readManifest3(repoRoot) {
   return { kind: "ok", manifest: parsed.data.managed };
 }
 function writeManifestVersion(repoRoot, manifest) {
-  const configAbs = join11(repoRoot, CONFIG_PATH);
-  const seed = JSON.parse(readFileSync9(configAbs, "utf-8"));
+  const configAbs = join13(repoRoot, CONFIG_PATH);
+  const seed = JSON.parse(readFileSync10(configAbs, "utf-8"));
   const updated = { ...manifest, version: MANAGED_MANIFEST_VERSION };
-  writeFileSync6(configAbs, `${JSON.stringify({ ...seed, managed: updated }, null, 2)}
+  writeFileSync7(configAbs, `${JSON.stringify({ ...seed, managed: updated }, null, 2)}
 `, "utf-8");
 }
 function planUpgrade(ops, repoRoot, manifest) {
@@ -2788,8 +3717,8 @@ function planUpgrade(ops, repoRoot, manifest) {
   const ownedBlocks = new Set(manifest.blocks.map((b) => blockKey(b.path, b.marker)));
   for (const op of ops) {
     if (op.kind === "create-file") {
-      const abs2 = join11(repoRoot, op.path);
-      const exists = existsSync9(abs2);
+      const abs2 = join13(repoRoot, op.path);
+      const exists = existsSync11(abs2);
       const owned = ownedFiles.has(op.path);
       let action;
       if (op.path === CONFIG_PATH) {
@@ -2799,7 +3728,7 @@ function planUpgrade(ops, repoRoot, manifest) {
       } else if (!exists) {
         action = "recreate";
         hasChanges = true;
-      } else if (readFileSync9(abs2, "utf-8") !== op.content) {
+      } else if (readFileSync10(abs2, "utf-8") !== op.content) {
         action = "regenerate";
         hasChanges = true;
       } else {
@@ -2807,16 +3736,16 @@ function planUpgrade(ops, repoRoot, manifest) {
       }
       entries.push({ kind: "create-file", op, action });
     } else if (op.kind === "managed-block") {
-      const abs2 = join11(repoRoot, op.path);
+      const abs2 = join13(repoRoot, op.path);
       const owned = ownedBlocks.has(blockKey(op.path, op.marker));
       let action;
       if (!owned) {
         action = "not-installed";
-      } else if (!existsSync9(abs2)) {
+      } else if (!existsSync11(abs2)) {
         action = "recreate-host";
         hasChanges = true;
       } else {
-        const content = readFileSync9(abs2, "utf-8");
+        const content = readFileSync10(abs2, "utf-8");
         const { begin, end } = markerLines(op.marker, op.comment);
         if (!(content.includes(begin) && content.includes(end))) {
           action = "recreate-append";
@@ -2892,11 +3821,11 @@ function renderUpgradeDiff(plan) {
 `);
 }
 function regenerateBlock(repoRoot, op) {
-  const abs2 = join11(repoRoot, op.path);
-  const content = readFileSync9(abs2, "utf-8");
+  const abs2 = join13(repoRoot, op.path);
+  const content = readFileSync10(abs2, "utf-8");
   const stripped = stripBlockFromContent(content, op.marker, op.comment);
   if (stripped !== null) {
-    writeFileSync6(abs2, stripped.endsWith(`
+    writeFileSync7(abs2, stripped.endsWith(`
 `) ? stripped : `${stripped}
 `, "utf-8");
   }
@@ -2906,7 +3835,7 @@ function applyUpgrade(plan, repoRoot) {
   for (const e of plan.entries) {
     if (e.kind === "create-file") {
       if (e.action === "regenerate" || e.action === "recreate") {
-        writeFileWithDirs(join11(repoRoot, e.op.path), e.op.content, e.op.mode);
+        writeFileWithDirs(join13(repoRoot, e.op.path), e.op.content, e.op.mode);
       }
     } else {
       if (e.action === "recreate-host")
@@ -2976,7 +3905,120 @@ Vinaya upgraded.
   return 0;
 }
 async function upgradeCommand(args) {
-  process.exit(await runUpgrade(args, realDeps4()));
+  process.exit(await runUpgrade(args, realDeps6()));
+}
+
+// src/commands/waiver.ts
+import { execFileSync as execFileSync8 } from "node:child_process";
+function labelFor(kind) {
+  return kind === "docs" ? WAIVER_LABEL : WAIVER_LABEL_REVIEW;
+}
+function gh(args) {
+  return execFileSync8("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: process.env }).trim();
+}
+function detectPrNumber() {
+  try {
+    const out = gh(["pr", "view", "--json", "number", "-q", ".number"]);
+    return /^\d+$/.test(out) ? out : null;
+  } catch {
+    return null;
+  }
+}
+var VALUE_FLAGS = ["--reason"];
+var BOOLEAN_FLAGS = ["--print-only"];
+function positionalArgs(args) {
+  const result = [];
+  for (let i = 0;i < args.length; i++) {
+    const a = args[i];
+    if (VALUE_FLAGS.some((f) => a.startsWith(`${f}=`)))
+      continue;
+    if (VALUE_FLAGS.includes(a)) {
+      i += 1;
+      continue;
+    }
+    if (BOOLEAN_FLAGS.includes(a))
+      continue;
+    result.push(a);
+  }
+  return result;
+}
+async function resolveKind(args) {
+  const positional = positionalArgs(args).find((a) => a === "docs" || a === "review");
+  if (positional === "docs" || positional === "review")
+    return positional;
+  const answer = (await prompt("Which waiver — `docs` or `review`? ")).trim().toLowerCase();
+  return answer === "docs" || answer === "review" ? answer : null;
+}
+async function resolvePrNumber(args) {
+  const positional = positionalArgs(args).find((a) => /^\d+$/.test(a));
+  if (positional)
+    return positional;
+  const detected = detectPrNumber();
+  if (detected)
+    return detected;
+  const answer = (await prompt("PR number (could not auto-detect one for the current branch): ")).trim();
+  return /^\d+$/.test(answer) ? answer : null;
+}
+function flagValue(args, flag) {
+  const eq = args.find((a) => a.startsWith(`${flag}=`));
+  if (eq)
+    return eq.slice(flag.length + 1);
+  const idx = args.indexOf(flag);
+  if (idx !== -1 && args[idx + 1] !== undefined)
+    return args[idx + 1];
+  return null;
+}
+async function resolveReason(args) {
+  const flagged = flagValue(args, "--reason");
+  if (flagged && flagged.trim().length > 0)
+    return flagged.trim();
+  const answer = await prompt("Reason for this waiver (one line — posted as a PR comment): ");
+  return answer.trim();
+}
+async function waiverCommand(args) {
+  const printOnly = args.includes("--print-only");
+  const kind = await resolveKind(args);
+  if (!kind) {
+    console.error("Usage: vinaya waiver <docs|review> [<pr-number>] [--reason <text>] [--print-only]");
+    closeStdin();
+    process.exit(2);
+    return;
+  }
+  const prNumber = await resolvePrNumber(args);
+  if (!prNumber) {
+    console.error("A PR number is required — none was given and none could be auto-detected.");
+    closeStdin();
+    process.exit(2);
+    return;
+  }
+  const reason = await resolveReason(args);
+  closeStdin();
+  if (!reason) {
+    console.error("A reason is required — the waiver label alone carries no rationale for the reviewer.");
+    process.exit(2);
+    return;
+  }
+  const label2 = labelFor(kind);
+  const editArgs = ["pr", "edit", prNumber, "--add-label", label2];
+  const commentArgs = ["pr", "comment", prNumber, "--body", `Waiver applied: \`${label2}\`
+Reason: ${reason}`];
+  if (printOnly) {
+    process.stdout.write(`--print-only: nothing below was executed. Run these yourself, as a human, to apply the waiver:
+
+`);
+    process.stdout.write(`  gh ${editArgs.join(" ")}
+`);
+    process.stdout.write(`  gh ${commentArgs.join(" ")}
+`);
+    return;
+  }
+  process.stdout.write(`Applying \`${label2}\` to PR #${prNumber} under your authenticated \`gh\` identity — vinaya never fabricates an actor.
+`);
+  execFileSync8("gh", editArgs, { stdio: "inherit", env: process.env });
+  execFileSync8("gh", commentArgs, { stdio: "inherit", env: process.env });
+  process.stdout.write(`
+✓ Label applied and reason posted as a PR comment.
+`);
 }
 
 // ../sources/src/commands.ts
@@ -3101,6 +4143,30 @@ var COMMANDS = [
     ],
     status: "shipped"
   },
+  {
+    name: "archive",
+    description: "Run the post-merge Archivist directly: provenance + Issue close-out for a merged task PR",
+    flags: [{ flag: "--merge-sha", description: "The merge commit to resolve (defaults to the current HEAD)" }],
+    details: [
+      "Resolves the merge commit's associated PR via `gh`, and — if it's a task PR without a provenance comment yet — posts the provenance block and closes the linked Issue. Idempotent: re-running against an already-archived PR is a no-op.",
+      "The same logic the generated `vinaya-archivist.yml` workflow's `post-merge` job runs on every push to `main` — callable directly for a one-off run or local verification."
+    ],
+    status: "shipped"
+  },
+  {
+    name: "audit",
+    description: "Run the ring-2 dead-branch-push and direct-main-push detection checks directly",
+    flags: [
+      { flag: "--only", description: "Scope to one check: 'dead-branches' or 'direct-push'" },
+      { flag: "--sha", description: "The commit to check for direct-main-push (defaults to the current HEAD)" },
+      { flag: "--json", description: "Enveloped JSON output" }
+    ],
+    details: [
+      "Dead-branch-push is never-red — a notification channel that flags (label + PR comment) any `task/*` branch whose tip commit lands after its own PR already resolved. Direct-main-push is a real pass/fail — it opens an incident Issue and exits 1 if a commit on `main` has no associated merged PR.",
+      "The same logic the generated `vinaya-archivist.yml` workflow's `daily-drift` and `direct-main-push-detection` jobs run on schedule / on every push to `main` — callable directly for a one-off run or local verification."
+    ],
+    status: "shipped"
+  },
   {
     name: "eject",
     description: "Remove every Vinaya-installed artifact, restoring the repo to stock",
@@ -3113,12 +4179,25 @@ var COMMANDS = [
   {
     name: "demo break",
     description: "Run a guided refusal-then-fix demo on an isolated, discardable branch",
-    status: "planned"
+    flags: [{ flag: "--keep", description: "Skip cleanup and leave the demo branch checked out to inspect" }],
+    details: [
+      "Creates a collision-safe `vinaya/demo-break-<id>` branch off the current one, stages a deliberately incomplete draft brief, and attempts a real `git commit` — the repo's actually-installed pre-commit hook refuses it with its real output, not a scripted string. Applies the minimal fix, commits again, then switches back and deletes the demo branch.",
+      "Safe to run twice: refuses on a dirty working tree, refuses from a detached HEAD, and recovers automatically from a prior crashed run before starting a fresh one — never leaves the original branch touched or a stray demo branch behind."
+    ],
+    status: "shipped"
   },
   {
     name: "waiver",
-    description: "Apply the principal-verified 'vinaya/waiver:docs' label after prompting for a reason",
-    status: "planned"
+    description: "Apply the actor-verified 'vinaya/waiver:docs' or 'vinaya/waiver:review' label after prompting for a reason",
+    flags: [
+      { flag: "--reason", description: "The waiver rationale, posted as a PR comment (prompted for if omitted)" },
+      { flag: "--print-only", description: "Print the exact `gh` commands instead of running them" }
+    ],
+    details: [
+      "Applies the label via `gh pr edit --add-label`, under the invoking human's own authenticated `gh` identity — this command never fabricates an actor. A waiver is never an agent-emittable string: not a PR body field, not a commit trailer, not a comment — the label plus its own labeling-timeline actor is the only mechanism ring 1 honors.",
+      "`--print-only` prints the exact `gh pr edit`/`gh pr comment` commands and runs nothing — for a human who wants to run them itself, or a CI/non-interactive context where an agent session should never be the one applying its own waiver."
+    ],
+    status: "shipped"
   },
   {
     name: "studio",
@@ -3155,9 +4234,9 @@ function printHelp() {
 }
 
 // src/index.ts
-var PACKAGE_ROOT = join12(dirname7(fileURLToPath4(import.meta.url)), "..");
+var PACKAGE_ROOT = join14(dirname5(fileURLToPath2(import.meta.url)), "..");
 function readVersion2() {
-  const pkg = JSON.parse(readFileSync10(join12(PACKAGE_ROOT, "package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync11(join14(PACKAGE_ROOT, "package.json"), "utf-8"));
   return pkg.version;
 }
 var [, , command, ...args] = process.argv;
@@ -3207,6 +4286,14 @@ try {
       await checkCommand(args);
       break;
     }
+    case "archive": {
+      await archiveCommand(args);
+      break;
+    }
+    case "audit": {
+      await auditCommand(args);
+      break;
+    }
     case "new": {
       const [subcommand, ...rest] = args;
       if (subcommand === "check") {
@@ -3241,6 +4328,20 @@ try {
       }
       break;
     }
+    case "demo": {
+      const [subcommand, ...rest] = args;
+      if (subcommand === "break") {
+        await demoBreakCommand(rest);
+      } else {
+        console.error(`Unknown 'demo' subcommand: ${subcommand ?? "(none)"} (expected 'break')`);
+        process.exit(2);
+      }
+      break;
+    }
+    case "waiver": {
+      await waiverCommand(args);
+      break;
+    }
     default:
       console.error(`Unknown command: ${command}`);
       printHelp();