@attalabs/vinaya 0.1.0 → 0.1.2

package/dist/checks/bin/check-dispatch-readiness.js

@@ -0,0 +1,2923 @@
+#!/usr/bin/env node
+
+// src/checks/bin/check-dispatch-readiness.ts
+import { execFile as execFile4, execFileSync as execFileSync2 } from "node:child_process";
+import { promisify as promisify4 } from "node:util";
+// ../../../packages/aeg-core/src/anchored-region.ts
+function maskCode(body) {
+  const fill = (line) => " ".repeat(line.length);
+  return maskIndentedCode(maskFencedCode(body, fill), fill).replace(/(`+)[^\n]*?\1/g, (m) => " ".repeat(m.length));
+}
+function stripCode(body, options = {}) {
+  const normalised = body.replace(/\r\n?/g, `
+`);
+  const blank = () => "";
+  const blocksStripped = maskIndentedCode(maskFencedCode(normalised, blank), blank);
+  if (options.inlineSpans === "keep")
+    return blocksStripped;
+  return blocksStripped.replace(/(`+)[^\n]*?\1/g, "");
+}
+var FENCE_OPEN = /^ {0,3}(`{3,}|~{3,})([^\r\n]*)\r?$/;
+var FENCE_CLOSE = /^ {0,3}(`+|~+)[ \t]*\r?$/;
+function maskFencedCode(body, fill) {
+  let fenceChar = null;
+  let fenceLen = 0;
+  return body.split(`
+`).map((line) => {
+    if (fenceChar === null) {
+      const open = line.match(FENCE_OPEN);
+      if (!open)
+        return line;
+      const marker = open[1];
+      if (marker[0] === "`" && open[2].includes("`"))
+        return line;
+      fenceChar = marker[0];
+      fenceLen = marker.length;
+      return fill(line);
+    }
+    const close = line.match(FENCE_CLOSE);
+    if (close && close[1][0] === fenceChar && close[1].length >= fenceLen) {
+      fenceChar = null;
+      fenceLen = 0;
+    }
+    return fill(line);
+  }).join(`
+`);
+}
+var LIST_MARKER = /^ {0,3}(?:[-*+]|\d{1,9}[.)])(?:\s|$)/;
+function indentWidth(line) {
+  let width = 0;
+  for (const ch of line) {
+    if (ch === " ")
+      width += 1;
+    else if (ch === "\t")
+      width += 4;
+    else
+      break;
+  }
+  return width;
+}
+function maskIndentedCode(body, fill) {
+  const lines = body.split(`
+`);
+  let inList = false;
+  let inCode = false;
+  let prevBlank = true;
+  const out = lines.map((line) => {
+    if (line.trim() === "") {
+      prevBlank = true;
+      return line;
+    }
+    const indent = indentWidth(line);
+    if (indent >= 4 && (inCode || prevBlank && !inList)) {
+      inCode = true;
+      prevBlank = false;
+      return fill(line);
+    }
+    inCode = false;
+    if (indent < 4 && LIST_MARKER.test(line))
+      inList = true;
+    else if (indent === 0)
+      inList = false;
+    prevBlank = false;
+    return line;
+  });
+  return out.join(`
+`);
+}
+function anchoredRegion(body, field) {
+  const masked = maskCode(body);
+  const start = new RegExp(`<!--\\s*AEG:${field}:START\\s*-->`).exec(masked);
+  if (!start)
+    return null;
+  const afterStart = start.index + start[0].length;
+  const end = new RegExp(`<!--\\s*AEG:${field}:END\\s*-->`).exec(masked.slice(afterStart));
+  if (!end)
+    return null;
+  return body.slice(afterStart, afterStart + end.index);
+}
+// ../../../packages/aeg-forge-state/src/parse-rationale-deps.ts
+var SECTION_HEADER = /\*\*Dependency rationale\*\*/i;
+var NEXT_HEADER = /\*\*[A-Z][^*]*\*\*/;
+var FIELD_LABEL = /^(Depends-on|Conflicts-with)\s*:\s*(.*)$/i;
+var ID_TOKEN = /^(?:[\w.-]+\s+)?#?\d+[a-z]?$/i;
+var SLUG_QUALIFIED_ID = /^([\w.-]+)\s+(#?\d+[a-z]?)$/i;
+function isEmptyMarker(s) {
+  const t = s.trim();
+  return t === "" || t === "—" || t === "-" || t === "–";
+}
+function pushUnique(arr, ids) {
+  for (const id of ids) {
+    if (!arr.includes(id))
+      arr.push(id);
+  }
+}
+function splitIds(raw) {
+  if (isEmptyMarker(raw))
+    return [];
+  return raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0 && !isEmptyMarker(s) && ID_TOKEN.test(s));
+}
+function resolveIds(raw, lastSlug) {
+  const ids = splitIds(raw);
+  const resolved = [];
+  for (const id of ids) {
+    const qualified = id.match(SLUG_QUALIFIED_ID);
+    if (qualified) {
+      lastSlug.current = qualified[1] ?? null;
+      resolved.push(id);
+    } else if (lastSlug.current) {
+      resolved.push(`${lastSlug.current} ${id}`);
+      lastSlug.current = null;
+    } else {
+      resolved.push(id);
+    }
+  }
+  return resolved;
+}
+function extractSection(body) {
+  const start = body.match(SECTION_HEADER);
+  if (!start || start.index === undefined)
+    return "";
+  const rest = body.slice(start.index + start[0].length);
+  const next = rest.match(NEXT_HEADER);
+  const end = next && next.index !== undefined ? next.index : rest.length;
+  return rest.slice(0, end);
+}
+function parseRationaleDeps(body) {
+  const section = extractSection(body);
+  const dependsOn = [];
+  const conflictsWith = [];
+  let current = null;
+  const assignedFields = new Set;
+  const lastSlugByField = {
+    dependsOn: { current: null },
+    conflictsWith: { current: null }
+  };
+  const spanPattern = /`([^`]*)`/g;
+  let match = spanPattern.exec(section);
+  while (match !== null) {
+    const content = (match[1] ?? "").trim();
+    const labelMatch = content.match(FIELD_LABEL);
+    if (labelMatch) {
+      const field = labelMatch[1]?.toLowerCase() === "conflicts-with" ? "conflictsWith" : "dependsOn";
+      if (!assignedFields.has(field)) {
+        assignedFields.add(field);
+        current = field;
+        const ids = resolveIds(labelMatch[2] ?? "", lastSlugByField[field]);
+        pushUnique(field === "dependsOn" ? dependsOn : conflictsWith, ids);
+      }
+    } else if (current) {
+      const ids = resolveIds(content, lastSlugByField[current]);
+      pushUnique(current === "dependsOn" ? dependsOn : conflictsWith, ids);
+    }
+    match = spanPattern.exec(section);
+  }
+  return { dependsOn, conflictsWith };
+}
+// ../../../packages/aeg-forge-state/src/gh.ts
+import { execFile, execFileSync } from "node:child_process";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
+var systemEnv = {
+  ...process.env,
+  PATH: [process.env.PATH, "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].filter(Boolean).join(":")
+};
+function run(args) {
+  return execFileSync("gh", args, { encoding: "utf8", env: systemEnv });
+}
+async function runAsync(args) {
+  const { stdout } = await execFileAsync("gh", args, {
+    encoding: "utf8",
+    env: systemEnv,
+    maxBuffer: 16 * 1024 * 1024
+  });
+  return stdout;
+}
+function ghApiGet(path) {
+  return JSON.parse(run(["api", path]));
+}
+function issueListByLabelArgs(owner, repo, label) {
+  return [
+    "issue",
+    "list",
+    "--repo",
+    `${owner}/${repo}`,
+    "--label",
+    label,
+    "--state",
+    "all",
+    "--json",
+    "number,title,body,state,labels,milestone",
+    "--limit",
+    "200"
+  ];
+}
+async function ghIssueListByLabelAsync(owner, repo, label) {
+  return JSON.parse(await runAsync(issueListByLabelArgs(owner, repo, label)));
+}
+function dedupeByNumber(issues) {
+  const byNumber = new Map;
+  for (const issue of issues)
+    if (!byNumber.has(issue.number))
+      byNumber.set(issue.number, issue);
+  return [...byNumber.values()];
+}
+async function ghIssueListByAnyLabelAsync(owner, repo, labels) {
+  const perLabel = await Promise.all(labels.map((l) => ghIssueListByLabelAsync(owner, repo, l)));
+  return dedupeByNumber(perLabel.flat());
+}
+
+// ../../../packages/aeg-forge-state/src/fetch-milestone.ts
+function findMilestoneForSlug(owner, repo, slug) {
+  const milestones = ghApiGet(`repos/${owner}/${repo}/milestones?state=all&per_page=100`);
+  const match = milestones.find((m) => m.title === slug);
+  if (!match)
+    return null;
+  return {
+    goal: match.description ?? "",
+    lifecycle: match.state === "closed" ? "complete" : "active"
+  };
+}
+
+// ../../../packages/aeg-forge-state/src/labels.ts
+var LABELS = [
+  {
+    key: "blocked",
+    id: "vinaya/blocked",
+    category: "state",
+    form: "literal",
+    carries: "Execution is halted pending an external unblock; wins over every other derived status."
+  },
+  {
+    key: "tier-0",
+    id: "vinaya/tier:0",
+    category: "tier",
+    form: "literal",
+    carries: "Lowest governance weight — typecheck, lint, tests, and a conforming PR body."
+  },
+  {
+    key: "tier-1",
+    id: "vinaya/tier:1",
+    category: "tier",
+    form: "literal",
+    carries: "Tier 0 plus spec/skill coverage and a passing verify-docs run."
+  },
+  {
+    key: "tier-3",
+    id: "vinaya/tier:3",
+    category: "tier",
+    form: "literal",
+    carries: "Tier 1 plus the reasoning for the change, stated in the pull request that makes it."
+  },
+  {
+    key: "tranche",
+    id: "vinaya/tranche:",
+    category: "tranche",
+    form: "prefix",
+    carries: "The tranche slug this task Issue belongs to — the forge's grouping key, matched by prefix."
+  },
+  {
+    key: "needs-execution-input",
+    id: "vinaya/needs:execution-input",
+    category: "needs",
+    form: "literal",
+    carries: "Waiting on a missing execution detail — a flag, a dependency, a value the brief did not carry."
+  },
+  {
+    key: "needs-strategy-input",
+    id: "vinaya/needs:strategy-input",
+    category: "needs",
+    form: "literal",
+    carries: "Waiting on a strategy call — the brief assumes an approach the codebase has moved away from."
+  },
+  {
+    key: "needs-principal-input",
+    id: "vinaya/needs:principal-input",
+    category: "needs",
+    form: "literal",
+    carries: "Waiting on the Principal — a product-level call no agent may make."
+  },
+  {
+    key: "needs-brief-correction",
+    id: "vinaya/needs:brief-correction",
+    category: "needs",
+    form: "literal",
+    carries: "Waiting on the Brief Author — the brief contradicts the surface it describes."
+  },
+  {
+    key: "waiver-docs",
+    id: "vinaya/waiver:docs",
+    category: "waiver",
+    form: "literal",
+    carries: "Doc-coverage gate excused for this PR — honored only when a principal applied it."
+  },
+  {
+    key: "waiver-review",
+    id: "vinaya/waiver:review",
+    category: "waiver",
+    form: "literal",
+    carries: "Review gate excused for this PR — honored only when a principal applied it."
+  },
+  {
+    key: "override-docs",
+    id: "vinaya/override:docs",
+    category: "waiver",
+    form: "literal",
+    carries: "The whole verify-docs gate suppressed for this PR — a Principal-only blunt override, wider than a waiver."
+  },
+  {
+    key: "incoherent",
+    id: "vinaya/incoherent",
+    category: "flag",
+    form: "literal",
+    carries: "Closed COMPLETED with no merged-PR link — done-but-unprovable, surfaced for a human."
+  },
+  {
+    key: "direct-main-push",
+    id: "vinaya/direct-main-push",
+    category: "flag",
+    form: "literal",
+    carries: "A commit reached main with no associated merged PR — ring-2 detection, never a mutation."
+  },
+  {
+    key: "dead-branch-push",
+    id: "vinaya/dead-branch-push",
+    category: "flag",
+    form: "literal",
+    carries: "Commits landed on a branch after its PR had already resolved — daily-drift detection."
+  },
+  {
+    key: "state-object",
+    id: "vinaya/state-object",
+    category: "kind",
+    form: "literal",
+    carries: "A permanent forge-native storage object, never actionable work — excluded from every backlog."
+  }
+];
+var BY_KEY = new Map(LABELS.map((l) => [l.key, l]));
+function entry(key) {
+  const found = BY_KEY.get(key);
+  if (!found)
+    throw new Error(`labels.ts: no LABELS entry for key '${key}'`);
+  return found;
+}
+function label(key) {
+  return entry(key).id;
+}
+function trancheLabel(slug) {
+  return `${label("tranche")}${slug}`;
+}
+function matchesLabel(key, name) {
+  const l = entry(key);
+  if (l.form === "prefix")
+    return name.startsWith(l.id);
+  return name === l.id;
+}
+function hasLabel(key, names) {
+  return names.some((n) => matchesLabel(key, n));
+}
+function trancheSlugOf(name) {
+  const prefix = entry("tranche").id;
+  return name.startsWith(prefix) ? name.slice(prefix.length) : null;
+}
+function findTrancheSlug(names) {
+  for (const n of names) {
+    const slug = trancheSlugOf(n);
+    if (slug !== null)
+      return slug;
+  }
+  return null;
+}
+
+// ../../../packages/aeg-forge-state/src/list-tasks.ts
+var TITLE_PATTERN = /^\[([^\]]+)]\s*(\S+)\s*—\s*(.+)$/;
+var PROJECT_SLUG = /^[a-z0-9][a-z0-9-]*$/i;
+var PROJECT_FIELD = /^\s*(?:\*\*)?Project(?:\(s\))?(?:\*\*)?\s*:\s*(?:\*\*)?\s*(.+)$/im;
+function projectsFromBody(body) {
+  const m = body.match(PROJECT_FIELD);
+  if (!m)
+    return [];
+  return (m[1] ?? "").split(",").map((s) => s.trim()).filter((s) => PROJECT_SLUG.test(s));
+}
+function taskFromIssue(issue) {
+  const m = issue.title.match(TITLE_PATTERN);
+  if (!m)
+    return null;
+  const id = (m[2] ?? "").trim();
+  const title = (m[3] ?? "").trim();
+  if (!id || !title)
+    return null;
+  const body = issue.body ?? "";
+  const { dependsOn, conflictsWith } = parseRationaleDeps(body);
+  return {
+    id,
+    title,
+    issue: issue.number,
+    projects: projectsFromBody(body),
+    dependsOn,
+    conflictsWith,
+    rationaleMarkdown: body
+  };
+}
+function compareTaskIds(a, b) {
+  const numA = a.match(/^(\d+)(.*)$/);
+  const numB = b.match(/^(\d+)(.*)$/);
+  if (numA && numB) {
+    const diff = Number(numA[1]) - Number(numB[1]);
+    if (diff !== 0)
+      return diff;
+    return (numA[2] ?? "").localeCompare(numB[2] ?? "");
+  }
+  return a.localeCompare(b);
+}
+function tasksFromIssues(issues) {
+  const tasks = [];
+  for (const issue of issues) {
+    const task = taskFromIssue(issue);
+    if (task)
+      tasks.push(task);
+  }
+  return tasks.sort((a, b) => compareTaskIds(a.id, b.id));
+}
+async function listTasksForSlugAsync(owner, repo, slug) {
+  return tasksFromIssues(await ghIssueListByAnyLabelAsync(owner, repo, [trancheLabel(slug)]));
+}
+function resolveTaskIssueRef(title, labels) {
+  const m = title.match(TITLE_PATTERN);
+  if (!m)
+    return null;
+  const taskId = (m[2] ?? "").trim();
+  if (!taskId)
+    return null;
+  const trancheSlug = findTrancheSlug(labels);
+  if (!trancheSlug)
+    return null;
+  return { trancheSlug, taskId };
+}
+
+// ../../../packages/aeg-forge-state/src/derive-from-forge.ts
+async function deriveTrancheFromForge(owner, repo, slug, known) {
+  const milestone = known ?? findMilestoneForSlug(owner, repo, slug);
+  const tasks = await listTasksForSlugAsync(owner, repo, slug);
+  return {
+    name: slug,
+    lifecycle: milestone?.lifecycle ?? "active",
+    goal: milestone?.goal ?? "",
+    tasks,
+    backlog: []
+  };
+}
+// ../../../node_modules/universal-user-agent/index.js
+function getUserAgent() {
+  if (typeof navigator === "object" && "userAgent" in navigator) {
+    return navigator.userAgent;
+  }
+  if (typeof process === "object" && process.version !== undefined) {
+    return `Node.js/${process.version.substr(1)} (${process.platform}; ${process.arch})`;
+  }
+  return "<environment undetectable>";
+}
+
+// ../../../node_modules/@octokit/endpoint/dist-bundle/index.js
+var VERSION = "0.0.0-development";
+var userAgent = `octokit-endpoint.js/${VERSION} ${getUserAgent()}`;
+var DEFAULTS = {
+  method: "GET",
+  baseUrl: "https://api.github.com",
+  headers: {
+    accept: "application/vnd.github.v3+json",
+    "user-agent": userAgent
+  },
+  mediaType: {
+    format: ""
+  }
+};
+function lowercaseKeys(object) {
+  if (!object) {
+    return {};
+  }
+  return Object.keys(object).reduce((newObj, key) => {
+    newObj[key.toLowerCase()] = object[key];
+    return newObj;
+  }, {});
+}
+function isPlainObject(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  if (Object.prototype.toString.call(value) !== "[object Object]")
+    return false;
+  const proto = Object.getPrototypeOf(value);
+  if (proto === null)
+    return true;
+  const Ctor = Object.prototype.hasOwnProperty.call(proto, "constructor") && proto.constructor;
+  return typeof Ctor === "function" && Ctor instanceof Ctor && Function.prototype.call(Ctor) === Function.prototype.call(value);
+}
+function mergeDeep(defaults, options) {
+  const result = Object.assign({}, defaults);
+  Object.keys(options).forEach((key) => {
+    if (isPlainObject(options[key])) {
+      if (!(key in defaults))
+        Object.assign(result, { [key]: options[key] });
+      else
+        result[key] = mergeDeep(defaults[key], options[key]);
+    } else {
+      Object.assign(result, { [key]: options[key] });
+    }
+  });
+  return result;
+}
+function removeUndefinedProperties(obj) {
+  for (const key in obj) {
+    if (obj[key] === undefined) {
+      delete obj[key];
+    }
+  }
+  return obj;
+}
+function merge(defaults, route, options) {
+  if (typeof route === "string") {
+    let [method, url] = route.split(" ");
+    options = Object.assign(url ? { method, url } : { url: method }, options);
+  } else {
+    options = Object.assign({}, route);
+  }
+  options.headers = lowercaseKeys(options.headers);
+  removeUndefinedProperties(options);
+  removeUndefinedProperties(options.headers);
+  const mergedOptions = mergeDeep(defaults || {}, options);
+  if (options.url === "/graphql") {
+    if (defaults && defaults.mediaType.previews?.length) {
+      mergedOptions.mediaType.previews = defaults.mediaType.previews.filter((preview) => !mergedOptions.mediaType.previews.includes(preview)).concat(mergedOptions.mediaType.previews);
+    }
+    mergedOptions.mediaType.previews = (mergedOptions.mediaType.previews || []).map((preview) => preview.replace(/-preview/, ""));
+  }
+  return mergedOptions;
+}
+function addQueryParameters(url, parameters) {
+  const separator = /\?/.test(url) ? "&" : "?";
+  const names = Object.keys(parameters);
+  if (names.length === 0) {
+    return url;
+  }
+  return url + separator + names.map((name) => {
+    if (name === "q") {
+      return "q=" + parameters.q.split("+").map(encodeURIComponent).join("+");
+    }
+    return `${name}=${encodeURIComponent(parameters[name])}`;
+  }).join("&");
+}
+var urlVariableRegex = /\{[^{}}]+\}/g;
+function removeNonChars(variableName) {
+  return variableName.replace(/(?:^\W+)|(?:(?<!\W)\W+$)/g, "").split(/,/);
+}
+function extractUrlVariableNames(url) {
+  const matches = url.match(urlVariableRegex);
+  if (!matches) {
+    return [];
+  }
+  return matches.map(removeNonChars).reduce((a, b) => a.concat(b), []);
+}
+function omit(object, keysToOmit) {
+  const result = { __proto__: null };
+  for (const key of Object.keys(object)) {
+    if (keysToOmit.indexOf(key) === -1) {
+      result[key] = object[key];
+    }
+  }
+  return result;
+}
+function encodeReserved(str) {
+  return str.split(/(%[0-9A-Fa-f]{2})/g).map(function(part) {
+    if (!/%[0-9A-Fa-f]/.test(part)) {
+      part = encodeURI(part).replace(/%5B/g, "[").replace(/%5D/g, "]");
+    }
+    return part;
+  }).join("");
+}
+function encodeUnreserved(str) {
+  return encodeURIComponent(str).replace(/[!'()*]/g, function(c) {
+    return "%" + c.charCodeAt(0).toString(16).toUpperCase();
+  });
+}
+function encodeValue(operator, value, key) {
+  value = operator === "+" || operator === "#" ? encodeReserved(value) : encodeUnreserved(value);
+  if (key) {
+    return encodeUnreserved(key) + "=" + value;
+  } else {
+    return value;
+  }
+}
+function isDefined(value) {
+  return value !== undefined && value !== null;
+}
+function isKeyOperator(operator) {
+  return operator === ";" || operator === "&" || operator === "?";
+}
+function getValues(context, operator, key, modifier) {
+  var value = context[key], result = [];
+  if (isDefined(value) && value !== "") {
+    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+      value = value.toString();
+      if (modifier && modifier !== "*") {
+        value = value.substring(0, parseInt(modifier, 10));
+      }
+      result.push(encodeValue(operator, value, isKeyOperator(operator) ? key : ""));
+    } else {
+      if (modifier === "*") {
+        if (Array.isArray(value)) {
+          value.filter(isDefined).forEach(function(value2) {
+            result.push(encodeValue(operator, value2, isKeyOperator(operator) ? key : ""));
+          });
+        } else {
+          Object.keys(value).forEach(function(k) {
+            if (isDefined(value[k])) {
+              result.push(encodeValue(operator, value[k], k));
+            }
+          });
+        }
+      } else {
+        const tmp = [];
+        if (Array.isArray(value)) {
+          value.filter(isDefined).forEach(function(value2) {
+            tmp.push(encodeValue(operator, value2));
+          });
+        } else {
+          Object.keys(value).forEach(function(k) {
+            if (isDefined(value[k])) {
+              tmp.push(encodeUnreserved(k));
+              tmp.push(encodeValue(operator, value[k].toString()));
+            }
+          });
+        }
+        if (isKeyOperator(operator)) {
+          result.push(encodeUnreserved(key) + "=" + tmp.join(","));
+        } else if (tmp.length !== 0) {
+          result.push(tmp.join(","));
+        }
+      }
+    }
+  } else {
+    if (operator === ";") {
+      if (isDefined(value)) {
+        result.push(encodeUnreserved(key));
+      }
+    } else if (value === "" && (operator === "&" || operator === "?")) {
+      result.push(encodeUnreserved(key) + "=");
+    } else if (value === "") {
+      result.push("");
+    }
+  }
+  return result;
+}
+function parseUrl(template) {
+  return {
+    expand: expand.bind(null, template)
+  };
+}
+function expand(template, context) {
+  var operators = ["+", "#", ".", "/", ";", "?", "&"];
+  template = template.replace(/\{([^\{\}]+)\}|([^\{\}]+)/g, function(_, expression, literal) {
+    if (expression) {
+      let operator = "";
+      const values = [];
+      if (operators.indexOf(expression.charAt(0)) !== -1) {
+        operator = expression.charAt(0);
+        expression = expression.substr(1);
+      }
+      expression.split(/,/g).forEach(function(variable) {
+        var tmp = /([^:\*]*)(?::(\d+)|(\*))?/.exec(variable);
+        values.push(getValues(context, operator, tmp[1], tmp[2] || tmp[3]));
+      });
+      if (operator && operator !== "+") {
+        var separator = ",";
+        if (operator === "?") {
+          separator = "&";
+        } else if (operator !== "#") {
+          separator = operator;
+        }
+        return (values.length !== 0 ? operator : "") + values.join(separator);
+      } else {
+        return values.join(",");
+      }
+    } else {
+      return encodeReserved(literal);
+    }
+  });
+  if (template === "/") {
+    return template;
+  } else {
+    return template.replace(/\/$/, "");
+  }
+}
+function parse(options) {
+  let method = options.method.toUpperCase();
+  let url = (options.url || "/").replace(/:([a-z]\w+)/g, "{$1}");
+  let headers = Object.assign({}, options.headers);
+  let body;
+  let parameters = omit(options, [
+    "method",
+    "baseUrl",
+    "url",
+    "headers",
+    "request",
+    "mediaType"
+  ]);
+  const urlVariableNames = extractUrlVariableNames(url);
+  url = parseUrl(url).expand(parameters);
+  if (!/^http/.test(url)) {
+    url = options.baseUrl + url;
+  }
+  const omittedParameters = Object.keys(options).filter((option) => urlVariableNames.includes(option)).concat("baseUrl");
+  const remainingParameters = omit(parameters, omittedParameters);
+  const isBinaryRequest = /application\/octet-stream/i.test(headers.accept);
+  if (!isBinaryRequest) {
+    if (options.mediaType.format) {
+      headers.accept = headers.accept.split(/,/).map((format) => format.replace(/application\/vnd(\.\w+)(\.v3)?(\.\w+)?(\+json)?$/, `application/vnd$1$2.${options.mediaType.format}`)).join(",");
+    }
+    if (url.endsWith("/graphql")) {
+      if (options.mediaType.previews?.length) {
+        const previewsFromAcceptHeader = headers.accept.match(/(?<![\w-])[\w-]+(?=-preview)/g) || [];
+        headers.accept = previewsFromAcceptHeader.concat(options.mediaType.previews).map((preview) => {
+          const format = options.mediaType.format ? `.${options.mediaType.format}` : "+json";
+          return `application/vnd.github.${preview}-preview${format}`;
+        }).join(",");
+      }
+    }
+  }
+  if (["GET", "HEAD"].includes(method)) {
+    url = addQueryParameters(url, remainingParameters);
+  } else {
+    if ("data" in remainingParameters) {
+      body = remainingParameters.data;
+    } else {
+      if (Object.keys(remainingParameters).length) {
+        body = remainingParameters;
+      }
+    }
+  }
+  if (!headers["content-type"] && typeof body !== "undefined") {
+    headers["content-type"] = "application/json; charset=utf-8";
+  }
+  if (["PATCH", "PUT"].includes(method) && typeof body === "undefined") {
+    body = "";
+  }
+  return Object.assign({ method, url, headers }, typeof body !== "undefined" ? { body } : null, options.request ? { request: options.request } : null);
+}
+function endpointWithDefaults(defaults, route, options) {
+  return parse(merge(defaults, route, options));
+}
+function withDefaults(oldDefaults, newDefaults) {
+  const DEFAULTS2 = merge(oldDefaults, newDefaults);
+  const endpoint2 = endpointWithDefaults.bind(null, DEFAULTS2);
+  return Object.assign(endpoint2, {
+    DEFAULTS: DEFAULTS2,
+    defaults: withDefaults.bind(null, DEFAULTS2),
+    merge: merge.bind(null, DEFAULTS2),
+    parse
+  });
+}
+var endpoint = withDefaults(null, DEFAULTS);
+
+// ../../../node_modules/fast-content-type-parse/index.js
+var NullObject = function NullObject2() {};
+NullObject.prototype = Object.create(null);
+var paramRE = /; *([!#$%&'*+.^\w`|~-]+)=("(?:[\v\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\v\u0020-\u00ff])*"|[!#$%&'*+.^\w`|~-]+) */gu;
+var quotedPairRE = /\\([\v\u0020-\u00ff])/gu;
+var mediaTypeRE = /^[!#$%&'*+.^\w|~-]+\/[!#$%&'*+.^\w|~-]+$/u;
+var defaultContentType = { type: "", parameters: new NullObject };
+Object.freeze(defaultContentType.parameters);
+Object.freeze(defaultContentType);
+function safeParse(header) {
+  if (typeof header !== "string") {
+    return defaultContentType;
+  }
+  let index = header.indexOf(";");
+  const type = index !== -1 ? header.slice(0, index).trim() : header.trim();
+  if (mediaTypeRE.test(type) === false) {
+    return defaultContentType;
+  }
+  const result = {
+    type: type.toLowerCase(),
+    parameters: new NullObject
+  };
+  if (index === -1) {
+    return result;
+  }
+  let key;
+  let match;
+  let value;
+  paramRE.lastIndex = index;
+  while (match = paramRE.exec(header)) {
+    if (match.index !== index) {
+      return defaultContentType;
+    }
+    index += match[0].length;
+    key = match[1].toLowerCase();
+    value = match[2];
+    if (value[0] === '"') {
+      value = value.slice(1, value.length - 1);
+      quotedPairRE.test(value) && (value = value.replace(quotedPairRE, "$1"));
+    }
+    result.parameters[key] = value;
+  }
+  if (index !== header.length) {
+    return defaultContentType;
+  }
+  return result;
+}
+var $safeParse = safeParse;
+
+// ../../../node_modules/@octokit/request-error/dist-src/index.js
+class RequestError extends Error {
+  name;
+  status;
+  request;
+  response;
+  constructor(message, statusCode, options) {
+    super(message);
+    this.name = "HttpError";
+    this.status = Number.parseInt(statusCode);
+    if (Number.isNaN(this.status)) {
+      this.status = 0;
+    }
+    if ("response" in options) {
+      this.response = options.response;
+    }
+    const requestCopy = Object.assign({}, options.request);
+    if (options.request.headers.authorization) {
+      requestCopy.headers = Object.assign({}, options.request.headers, {
+        authorization: options.request.headers.authorization.replace(/(?<! ) .*$/, " [REDACTED]")
+      });
+    }
+    requestCopy.url = requestCopy.url.replace(/\bclient_secret=\w+/g, "client_secret=[REDACTED]").replace(/\baccess_token=\w+/g, "access_token=[REDACTED]");
+    this.request = requestCopy;
+  }
+}
+
+// ../../../node_modules/@octokit/request/dist-bundle/index.js
+var VERSION2 = "9.2.4";
+var defaults_default = {
+  headers: {
+    "user-agent": `octokit-request.js/${VERSION2} ${getUserAgent()}`
+  }
+};
+function isPlainObject2(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  if (Object.prototype.toString.call(value) !== "[object Object]")
+    return false;
+  const proto = Object.getPrototypeOf(value);
+  if (proto === null)
+    return true;
+  const Ctor = Object.prototype.hasOwnProperty.call(proto, "constructor") && proto.constructor;
+  return typeof Ctor === "function" && Ctor instanceof Ctor && Function.prototype.call(Ctor) === Function.prototype.call(value);
+}
+async function fetchWrapper(requestOptions) {
+  const fetch = requestOptions.request?.fetch || globalThis.fetch;
+  if (!fetch) {
+    throw new Error("fetch is not set. Please pass a fetch implementation as new Octokit({ request: { fetch }}). Learn more at https://github.com/octokit/octokit.js/#fetch-missing");
+  }
+  const log = requestOptions.request?.log || console;
+  const parseSuccessResponseBody = requestOptions.request?.parseSuccessResponseBody !== false;
+  const body = isPlainObject2(requestOptions.body) || Array.isArray(requestOptions.body) ? JSON.stringify(requestOptions.body) : requestOptions.body;
+  const requestHeaders = Object.fromEntries(Object.entries(requestOptions.headers).map(([name, value]) => [
+    name,
+    String(value)
+  ]));
+  let fetchResponse;
+  try {
+    fetchResponse = await fetch(requestOptions.url, {
+      method: requestOptions.method,
+      body,
+      redirect: requestOptions.request?.redirect,
+      headers: requestHeaders,
+      signal: requestOptions.request?.signal,
+      ...requestOptions.body && { duplex: "half" }
+    });
+  } catch (error) {
+    let message = "Unknown Error";
+    if (error instanceof Error) {
+      if (error.name === "AbortError") {
+        error.status = 500;
+        throw error;
+      }
+      message = error.message;
+      if (error.name === "TypeError" && "cause" in error) {
+        if (error.cause instanceof Error) {
+          message = error.cause.message;
+        } else if (typeof error.cause === "string") {
+          message = error.cause;
+        }
+      }
+    }
+    const requestError = new RequestError(message, 500, {
+      request: requestOptions
+    });
+    requestError.cause = error;
+    throw requestError;
+  }
+  const status = fetchResponse.status;
+  const url = fetchResponse.url;
+  const responseHeaders = {};
+  for (const [key, value] of fetchResponse.headers) {
+    responseHeaders[key] = value;
+  }
+  const octokitResponse = {
+    url,
+    status,
+    headers: responseHeaders,
+    data: ""
+  };
+  if ("deprecation" in responseHeaders) {
+    const matches = responseHeaders.link && responseHeaders.link.match(/<([^<>]+)>; rel="deprecation"/);
+    const deprecationLink = matches && matches.pop();
+    log.warn(`[@octokit/request] "${requestOptions.method} ${requestOptions.url}" is deprecated. It is scheduled to be removed on ${responseHeaders.sunset}${deprecationLink ? `. See ${deprecationLink}` : ""}`);
+  }
+  if (status === 204 || status === 205) {
+    return octokitResponse;
+  }
+  if (requestOptions.method === "HEAD") {
+    if (status < 400) {
+      return octokitResponse;
+    }
+    throw new RequestError(fetchResponse.statusText, status, {
+      response: octokitResponse,
+      request: requestOptions
+    });
+  }
+  if (status === 304) {
+    octokitResponse.data = await getResponseData(fetchResponse);
+    throw new RequestError("Not modified", status, {
+      response: octokitResponse,
+      request: requestOptions
+    });
+  }
+  if (status >= 400) {
+    octokitResponse.data = await getResponseData(fetchResponse);
+    throw new RequestError(toErrorMessage(octokitResponse.data), status, {
+      response: octokitResponse,
+      request: requestOptions
+    });
+  }
+  octokitResponse.data = parseSuccessResponseBody ? await getResponseData(fetchResponse) : fetchResponse.body;
+  return octokitResponse;
+}
+async function getResponseData(response) {
+  const contentType = response.headers.get("content-type");
+  if (!contentType) {
+    return response.text().catch(() => "");
+  }
+  const mimetype = $safeParse(contentType);
+  if (isJSONResponse(mimetype)) {
+    let text = "";
+    try {
+      text = await response.text();
+      return JSON.parse(text);
+    } catch (err) {
+      return text;
+    }
+  } else if (mimetype.type.startsWith("text/") || mimetype.parameters.charset?.toLowerCase() === "utf-8") {
+    return response.text().catch(() => "");
+  } else {
+    return response.arrayBuffer().catch(() => new ArrayBuffer(0));
+  }
+}
+function isJSONResponse(mimetype) {
+  return mimetype.type === "application/json" || mimetype.type === "application/scim+json";
+}
+function toErrorMessage(data) {
+  if (typeof data === "string") {
+    return data;
+  }
+  if (data instanceof ArrayBuffer) {
+    return "Unknown error";
+  }
+  if ("message" in data) {
+    const suffix = "documentation_url" in data ? ` - ${data.documentation_url}` : "";
+    return Array.isArray(data.errors) ? `${data.message}: ${data.errors.map((v) => JSON.stringify(v)).join(", ")}${suffix}` : `${data.message}${suffix}`;
+  }
+  return `Unknown error: ${JSON.stringify(data)}`;
+}
+function withDefaults2(oldEndpoint, newDefaults) {
+  const endpoint2 = oldEndpoint.defaults(newDefaults);
+  const newApi = function(route, parameters) {
+    const endpointOptions = endpoint2.merge(route, parameters);
+    if (!endpointOptions.request || !endpointOptions.request.hook) {
+      return fetchWrapper(endpoint2.parse(endpointOptions));
+    }
+    const request2 = (route2, parameters2) => {
+      return fetchWrapper(endpoint2.parse(endpoint2.merge(route2, parameters2)));
+    };
+    Object.assign(request2, {
+      endpoint: endpoint2,
+      defaults: withDefaults2.bind(null, endpoint2)
+    });
+    return endpointOptions.request.hook(request2, endpointOptions);
+  };
+  return Object.assign(newApi, {
+    endpoint: endpoint2,
+    defaults: withDefaults2.bind(null, endpoint2)
+  });
+}
+var request = withDefaults2(endpoint, defaults_default);
+
+// ../../../node_modules/@octokit/graphql/dist-bundle/index.js
+var VERSION3 = "0.0.0-development";
+function _buildMessageForResponseErrors(data) {
+  return `Request failed due to following response errors:
+` + data.errors.map((e) => ` - ${e.message}`).join(`
+`);
+}
+var GraphqlResponseError = class extends Error {
+  constructor(request2, headers, response) {
+    super(_buildMessageForResponseErrors(response));
+    this.request = request2;
+    this.headers = headers;
+    this.response = response;
+    this.errors = response.errors;
+    this.data = response.data;
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, this.constructor);
+    }
+  }
+  name = "GraphqlResponseError";
+  errors;
+  data;
+};
+var NON_VARIABLE_OPTIONS = [
+  "method",
+  "baseUrl",
+  "url",
+  "headers",
+  "request",
+  "query",
+  "mediaType",
+  "operationName"
+];
+var FORBIDDEN_VARIABLE_OPTIONS = ["query", "method", "url"];
+var GHES_V3_SUFFIX_REGEX = /\/api\/v3\/?$/;
+function graphql(request2, query, options) {
+  if (options) {
+    if (typeof query === "string" && "query" in options) {
+      return Promise.reject(new Error(`[@octokit/graphql] "query" cannot be used as variable name`));
+    }
+    for (const key in options) {
+      if (!FORBIDDEN_VARIABLE_OPTIONS.includes(key))
+        continue;
+      return Promise.reject(new Error(`[@octokit/graphql] "${key}" cannot be used as variable name`));
+    }
+  }
+  const parsedOptions = typeof query === "string" ? Object.assign({ query }, options) : query;
+  const requestOptions = Object.keys(parsedOptions).reduce((result, key) => {
+    if (NON_VARIABLE_OPTIONS.includes(key)) {
+      result[key] = parsedOptions[key];
+      return result;
+    }
+    if (!result.variables) {
+      result.variables = {};
+    }
+    result.variables[key] = parsedOptions[key];
+    return result;
+  }, {});
+  const baseUrl = parsedOptions.baseUrl || request2.endpoint.DEFAULTS.baseUrl;
+  if (GHES_V3_SUFFIX_REGEX.test(baseUrl)) {
+    requestOptions.url = baseUrl.replace(GHES_V3_SUFFIX_REGEX, "/api/graphql");
+  }
+  return request2(requestOptions).then((response) => {
+    if (response.data.errors) {
+      const headers = {};
+      for (const key of Object.keys(response.headers)) {
+        headers[key] = response.headers[key];
+      }
+      throw new GraphqlResponseError(requestOptions, headers, response.data);
+    }
+    return response.data.data;
+  });
+}
+function withDefaults3(request2, newDefaults) {
+  const newRequest = request2.defaults(newDefaults);
+  const newApi = (query, options) => {
+    return graphql(newRequest, query, options);
+  };
+  return Object.assign(newApi, {
+    defaults: withDefaults3.bind(null, newRequest),
+    endpoint: newRequest.endpoint
+  });
+}
+var graphql2 = withDefaults3(request, {
+  headers: {
+    "user-agent": `octokit-graphql.js/${VERSION3} ${getUserAgent()}`
+  },
+  method: "POST",
+  url: "/graphql"
+});
+// ../../../packages/aeg-forge-state/src/github-token.ts
+import { execFile as execFile2 } from "node:child_process";
+import { promisify as promisify2 } from "node:util";
+var execFileAsync2 = promisify2(execFile2);
+var systemEnv2 = {
+  ...process.env,
+  PATH: [process.env.PATH, "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].filter(Boolean).join(":")
+};
+async function resolveGithubToken(explicit) {
+  if (explicit && explicit.length > 0)
+    return explicit;
+  if (process.env.GITHUB_TOKEN)
+    return process.env.GITHUB_TOKEN;
+  if (process.env.GH_TOKEN)
+    return process.env.GH_TOKEN;
+  try {
+    const { stdout } = await execFileAsync2("gh", ["auth", "token"], { env: systemEnv2, timeout: 5000 });
+    const token = stdout.trim();
+    return token.length > 0 ? token : null;
+  } catch {
+    return null;
+  }
+}
+
+// ../../../packages/aeg-forge-state/src/map-forge-facts.ts
+function mapForgeFacts(raw) {
+  if (!raw.issue)
+    return null;
+  return {
+    issueState: raw.issue.state === "OPEN" ? "open" : "closed",
+    assigned: raw.issue.assigneesCount > 0,
+    blockedLabel: hasLabel("blocked", raw.issue.labels),
+    branchExists: raw.refExists,
+    prState: mapPrState(raw.pullRequest?.state),
+    reviewDecision: mapReviewDecision(raw.pullRequest?.reviewDecision),
+    stateReason: mapStateReason(raw.issue.stateReason),
+    closedAt: raw.issue.closedAt ?? null,
+    mergedAt: raw.pullRequest?.mergedAt ?? null
+  };
+}
+function mapStateReason(reason) {
+  if (reason === "COMPLETED")
+    return "completed";
+  if (reason === "NOT_PLANNED")
+    return "not_planned";
+  return null;
+}
+function mapPrState(state) {
+  if (state === "OPEN")
+    return "open";
+  if (state === "MERGED")
+    return "merged";
+  return "none";
+}
+function mapReviewDecision(decision) {
+  if (decision === "APPROVED")
+    return "approved";
+  if (decision === "CHANGES_REQUESTED")
+    return "changes_requested";
+  return "none";
+}
+
+// ../../../packages/aeg-forge-state/src/fetch-forge-facts.ts
+function buildBranchName(tranche, taskId) {
+  return `task/${tranche}/${taskId}`;
+}
+async function fetchForgeFacts(input) {
+  const token = await resolveGithubToken(input.token);
+  if (!token) {
+    return {
+      facts: new Map,
+      prRefs: new Map,
+      unavailable: true,
+      reason: "No GitHub token available (set GITHUB_TOKEN/GH_TOKEN or `gh auth login`)."
+    };
+  }
+  const queriedTasks = input.tasks.filter((t) => t.issue !== null);
+  if (queriedTasks.length === 0) {
+    return { facts: new Map, prRefs: new Map, unavailable: false };
+  }
+  const client = graphql2.defaults({ headers: { authorization: `bearer ${token}` } });
+  const query = buildBatchQuery(input.tranche, queriedTasks);
+  let response;
+  try {
+    response = await client(query, { owner: input.owner, repo: input.repo });
+  } catch (err) {
+    return {
+      facts: new Map,
+      prRefs: new Map,
+      unavailable: true,
+      reason: `GitHub query failed: ${describeError(err)}`
+    };
+  }
+  const facts = new Map;
+  const prRefs = new Map;
+  if (!response.repository) {
+    return {
+      facts,
+      prRefs,
+      unavailable: true,
+      reason: `Repository ${input.owner}/${input.repo} not visible to this token.`
+    };
+  }
+  for (const task of queriedTasks) {
+    const alias = aliasFor(task.id);
+    const raw = extractRawFromResponse(response.repository, alias);
+    const mapped = mapForgeFacts(raw);
+    if (mapped)
+      facts.set(task.id, mapped);
+    const pr = raw.pullRequest;
+    if (pr && typeof pr.number === "number" && typeof pr.url === "string") {
+      prRefs.set(task.id, { number: pr.number, url: pr.url, state: pr.state });
+    }
+  }
+  return { facts, prRefs, unavailable: false };
+}
+function buildBatchQuery(tranche, tasks) {
+  const perTask = tasks.map((task) => {
+    const a = aliasFor(task.id);
+    const branch = buildBranchName(tranche, task.id);
+    return `
+    ${a}_issue: issue(number: ${task.issue}) {
+      state
+      stateReason
+      closedAt
+      assignees(first: 1) { totalCount }
+      labels(first: 50) { nodes { name } }
+      timelineItems(last: 1, itemTypes: [CLOSED_EVENT]) {
+        nodes {
+          ... on ClosedEvent {
+            closer {
+              ... on PullRequest {
+                number
+                url
+                state
+                reviewDecision
+                mergedAt
+              }
+            }
+          }
+        }
+      }
+    }
+    ${a}_ref: ref(qualifiedName: ${JSON.stringify(`refs/heads/${branch}`)}) {
+      name
+    }
+    ${a}_prs: pullRequests(
+      first: 1,
+      headRefName: ${JSON.stringify(branch)},
+      orderBy: { field: CREATED_AT, direction: DESC }
+    ) {
+      nodes { number url state reviewDecision mergedAt }
+    }`;
+  }).join("");
+  return `query ForgeFacts($owner: String!, $repo: String!) {
+  repository(owner: $owner, name: $repo) {${perTask}
+  }
+}`;
+}
+function aliasFor(taskId) {
+  const sanitized = taskId.replace(/[^a-zA-Z0-9_]/g, "_");
+  return `t_${sanitized}`;
+}
+function extractRawFromResponse(repository, alias) {
+  const issue = repository[`${alias}_issue`];
+  const ref = repository[`${alias}_ref`];
+  const prs = repository[`${alias}_prs`];
+  const rawCloser = issue?.timelineItems?.nodes?.[0]?.closer ?? null;
+  const closingPr = rawCloser && typeof rawCloser.number === "number" && typeof rawCloser.url === "string" ? rawCloser : null;
+  const branchPr = prs && prs.nodes.length > 0 && prs.nodes[0] ? prs.nodes[0] : null;
+  return {
+    issue: issue ? {
+      state: issue.state,
+      stateReason: issue.stateReason,
+      closedAt: issue.closedAt ?? null,
+      assigneesCount: issue.assignees.totalCount,
+      labels: issue.labels.nodes.map((n) => n.name)
+    } : null,
+    refExists: Boolean(ref && ref.name.length > 0),
+    pullRequest: closingPr ?? branchPr
+  };
+}
+function describeError(err) {
+  if (err instanceof Error)
+    return err.message;
+  if (typeof err === "string")
+    return err;
+  return "unknown error";
+}
+// ../../../packages/aeg-forge-state/src/fetch-open-issues.ts
+async function fetchOpenIssuesByLabel(slugs, owner, repo, token) {
+  const result = new Map;
+  if (slugs.length === 0)
+    return result;
+  const client = graphql2.defaults({ headers: { authorization: `bearer ${token}` } });
+  const toAlias = (slug) => `tranche_${slug.replace(/-/g, "_")}`;
+  const perSlug = slugs.map((slug) => `
+    ${toAlias(slug)}: issues(states: [OPEN], labels: [${JSON.stringify(trancheLabel(slug))}], first: 100) {
+      nodes { number body labels(first: 20) { nodes { name } } }
+    }`).join("");
+  const query = `query LabeledIssues($owner: String!, $repo: String!) {
+  repository(owner: $owner, name: $repo) {${perSlug}
+  }
+}`;
+  let response;
+  try {
+    response = await client(query, { owner, repo });
+  } catch {
+    return result;
+  }
+  if (!response.repository)
+    return result;
+  for (const slug of slugs) {
+    const conn = response.repository[toAlias(slug)];
+    const issues = (conn?.nodes ?? []).map((n) => ({
+      number: n.number,
+      body: n.body ?? "",
+      labels: n.labels?.nodes?.map((l) => l.name) ?? []
+    }));
+    result.set(slug, issues);
+  }
+  return result;
+}
+// ../../../packages/aeg-forge-state/src/fetch-task-issue-refs.ts
+async function fetchTaskIssueRefs(owner, repo, issueNumbers, token) {
+  const result = new Map;
+  if (issueNumbers.length === 0)
+    return result;
+  const resolvedToken = await resolveGithubToken(token);
+  if (!resolvedToken)
+    return result;
+  const client = graphql2.defaults({ headers: { authorization: `bearer ${resolvedToken}` } });
+  let response;
+  try {
+    response = await client(buildQuery(issueNumbers), { owner, repo });
+  } catch {
+    return result;
+  }
+  if (!response.repository)
+    return result;
+  for (const n of issueNumbers) {
+    const node = response.repository[aliasFor2(n)];
+    if (!node)
+      continue;
+    const labels = node.labels.nodes.map((l) => l.name);
+    result.set(n, resolveTaskIssueRef(node.title, labels));
+  }
+  return result;
+}
+function aliasFor2(n) {
+  return `i_${n}`;
+}
+function buildQuery(issueNumbers) {
+  const perIssue = issueNumbers.map((n) => `
+    ${aliasFor2(n)}: issue(number: ${n}) {
+      title
+      labels(first: 50) { nodes { name } }
+    }`).join("");
+  return `query TaskIssueRefs($owner: String!, $repo: String!) {
+  repository(owner: $owner, name: $repo) {${perIssue}
+  }
+}`;
+}
+// ../../../packages/aeg-forge-state/src/resolve-repo.ts
+import { execFile as execFile3 } from "node:child_process";
+import { promisify as promisify3 } from "node:util";
+var execFileAsync3 = promisify3(execFile3);
+var systemEnv3 = {
+  ...process.env,
+  PATH: [process.env.PATH, "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].filter(Boolean).join(":")
+};
+// ../../../packages/aeg-core/src/state-machine-model.ts
+var FORGE_FACT_INPUTS = [
+  {
+    fact: "issueState",
+    readsFrom: "Issue.state (OPEN | CLOSED)",
+    meaning: "Whether the task Issue is still open — the anchor for the honest terminal statuses."
+  },
+  {
+    fact: "assigned",
+    readsFrom: "Issue.assignees (count > 0)",
+    meaning: "An assignee exists. No longer affects derivation: assigned and unassigned are both todo."
+  },
+  {
+    fact: "branchExists",
+    readsFrom: "Ref refs/heads/task/<tranche>/<id>",
+    meaning: "A task branch has been published — the todo → in-flight transition, written by git push, not by hand."
+  },
+  {
+    fact: "prState",
+    readsFrom: "PullRequest.state (OPEN | CLOSED | MERGED)",
+    meaning: "Whether work is proposed or landed. CLOSED-without-merge collapses to none — AEG models open/merged/none."
+  },
+  {
+    fact: "reviewDecision",
+    readsFrom: "PullRequest.reviewDecision",
+    meaning: "Only 'changes_requested' flips status; approved-but-unmerged stays in-review."
+  },
+  {
+    fact: "blockedLabel",
+    readsFrom: `Issue.labels contains '${label("blocked")}'`,
+    meaning: "Execution halted pending an external unblock. Wins over every other rule."
+  },
+  {
+    fact: "stateReason",
+    readsFrom: "Issue.stateReason (COMPLETED | NOT_PLANNED | REOPENED | null)",
+    meaning: "Separates a legitimate drop from an incoherent close on a closed, never-merged Issue."
+  },
+  {
+    fact: "closedAt",
+    readsFrom: "Issue.closedAt",
+    meaning: "Timestamp for the coherence oracle grandfather cutoff. No derivation rule reads it."
+  },
+  {
+    fact: "mergedAt",
+    readsFrom: "PullRequest.mergedAt",
+    meaning: "Timestamp for the coherence oracle grandfather cutoff. No derivation rule reads it."
+  }
+];
+var DERIVED_STATUSES = [
+  "backlog",
+  "todo",
+  "in-flight",
+  "in-review",
+  "changes-requested",
+  "merged",
+  "blocked",
+  "dropped",
+  "incoherent"
+];
+var DERIVABLE_STATUSES = DERIVED_STATUSES.filter((s) => s !== "backlog");
+// ../../../packages/aeg-core/src/file-classify.ts
+function isCodeFile(p) {
+  if (p.endsWith(".md"))
+    return false;
+  return /\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs|sql|css)$/.test(p);
+}
+// ../../../packages/aeg-core/src/waiver-label.ts
+var WAIVER_LABEL = label("waiver-docs");
+var WAIVER_LABEL_REVIEW = label("waiver-review");
+var PRINCIPAL_ALLOWLIST = ["daniboomerang"];
+function isWaiverLabelActorVerified(opts) {
+  if (!opts.labels.includes(opts.label))
+    return false;
+  if (opts.labelActor === null)
+    return false;
+  return opts.principalAllowlist.includes(opts.labelActor);
+}
+
+// ../../../packages/aeg-core/src/doc-owners.ts
+var DOC_OWNERS_PATH = ".vinaya/doc-owners";
+function parseDocOwners(content) {
+  const bindings = [];
+  const errors = [];
+  const lines = content.split(`
+`);
+  for (let i = 0;i < lines.length; i++) {
+    const raw = lines[i] ?? "";
+    const stripped = raw.replace(/#.*$/, "").trim();
+    if (!stripped)
+      continue;
+    const parts = stripped.split(/\s+/);
+    if (parts.length < 2) {
+      errors.push(`C5 doc-owners-parse: ${DOC_OWNERS_PATH}:${i + 1} — malformed binding (expected "<glob>  <pointer>", got "${raw.trim()}").`);
+      continue;
+    }
+    const [glob, ...pointerParts] = parts;
+    bindings.push({ glob: glob ?? "", pointer: pointerParts.join(" "), lineNum: i + 1 });
+  }
+  return { bindings, errors };
+}
+function globToRegex(pat) {
+  let re = "^";
+  let i = 0;
+  while (i < pat.length) {
+    const c = pat[i];
+    if (c === "*") {
+      if (pat[i + 1] === "*") {
+        re += ".*";
+        i += 2;
+      } else {
+        re += "[^/]*";
+        i += 1;
+      }
+    } else if (/[.+^$|(){}[\]\\?]/.test(c)) {
+      re += `\\${c}`;
+      i += 1;
+    } else {
+      re += c;
+      i += 1;
+    }
+  }
+  re += "$";
+  return new RegExp(re);
+}
+function isUrlPointer(p) {
+  return /^https?:\/\//.test(p);
+}
+function pointerToPath(p) {
+  const idx = p.indexOf("#");
+  return idx === -1 ? p : p.slice(0, idx);
+}
+var SEPARATOR = /(?:[ \t]*[—–][ \t]*|[ \t]+-[ \t]+)/.source;
+function readDocAcks(body) {
+  const acks = [];
+  const re = new RegExp(`^[ \\t]*Doc-ack[ \\t]*:[ \\t]*(.+?)${SEPARATOR}(.+?)[ \\t]*$`, "gim");
+  for (const m of body.matchAll(re)) {
+    acks.push({ surface: (m[1] ?? "").trim(), note: (m[2] ?? "").trim() });
+  }
+  return acks;
+}
+function evaluateC5(changed, docOwnersContent, prBody, fileExists, waiverActive) {
+  const out = { errors: [], notes: [] };
+  if (docOwnersContent === null)
+    return out;
+  const { bindings, errors: parseErrors } = parseDocOwners(docOwnersContent);
+  for (const e of parseErrors)
+    out.errors.push(e);
+  if (bindings.length === 0)
+    return out;
+  const codeFiles = changed.filter(isCodeFile);
+  const fired = [];
+  for (const b of bindings) {
+    const re = globToRegex(b.glob);
+    if (codeFiles.some((f) => re.test(f)))
+      fired.push(b);
+  }
+  if (fired.length === 0)
+    return out;
+  const acks = readDocAcks(prBody);
+  for (const b of fired) {
+    if (waiverActive) {
+      out.notes.push(`C5 doc-waiver active for ${b.pointer} (binding ${DOC_OWNERS_PATH}:${b.lineNum})`);
+      continue;
+    }
+    if (isUrlPointer(b.pointer)) {
+      const acked = acks.some((a) => a.surface === b.pointer);
+      if (!acked) {
+        out.errors.push(`C5 doc-coverage: code change matched ${DOC_OWNERS_PATH}:${b.lineNum} (glob \`${b.glob}\` → ${b.pointer}). External pointer requires \`Doc-ack: ${b.pointer} — <note>\` in the PR body, or an actor-verified \`${WAIVER_LABEL}\` label to skip.`);
+      }
+      continue;
+    }
+    const pointerPath = pointerToPath(b.pointer);
+    if (!fileExists(pointerPath)) {
+      out.errors.push(`C5 doc-owners-dangling: ${DOC_OWNERS_PATH}:${b.lineNum} points to ${b.pointer}, which does not exist on disk. Fix the binding or add the doc.`);
+      continue;
+    }
+    if (!changed.includes(pointerPath)) {
+      out.errors.push(`C5 doc-coverage: code change matched ${DOC_OWNERS_PATH}:${b.lineNum} (glob \`${b.glob}\` → ${b.pointer}), but ${pointerPath} is not in the PR diff. Update it, or have a principal apply the \`${WAIVER_LABEL}\` label.`);
+    }
+  }
+  return out;
+}
+// ../../../packages/aeg-core/src/pr-tier.ts
+function readTierFromPrBody(prBody) {
+  const searchIn = anchoredRegion(prBody, "TIER") ?? prBody;
+  const m = searchIn.match(/(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i);
+  if (!m)
+    return null;
+  const t = Number(m[4]);
+  return t === 0 || t === 1 || t === 3 ? t : null;
+}
+var OVERRIDE_BODY_TOKEN = `[${label("override-docs")}]`;
+function overrideActive(opts) {
+  if (opts.overrideDocsEnv === "1")
+    return true;
+  const labels = (opts.prLabels || "").split(",").map((s) => s.trim());
+  if (hasLabel("override-docs", labels))
+    return true;
+  if ((opts.prBody || "").includes(OVERRIDE_BODY_TOKEN))
+    return true;
+  return false;
+}
+// ../../../packages/aeg-core/src/premise-check.ts
+var ASSERTION_KINDS = new Set(["contains", "absent", "sha256"]);
+
+// ../../../packages/aeg-core/src/brief-validation.ts
+function headerRegion(prBody) {
+  const m = prBody.match(/^##\s/m);
+  return m?.index !== undefined ? prBody.slice(0, m.index) : prBody;
+}
+function headerField(prBody, labelPattern, anchor) {
+  const anchored = anchor !== undefined ? anchoredRegion(prBody, anchor) : null;
+  const region = anchored ?? headerRegion(prBody);
+  const re = new RegExp(`^(?:\\*\\*)?\\s*${labelPattern}\\s*(?:\\*\\*)?\\s*:\\s*(?:\\*\\*)?\\s*([^\\n·]+)`, "im");
+  const m = region.match(re);
+  if (!m)
+    return null;
+  const value = m[1].trim();
+  return value.length > 0 ? value : null;
+}
+function normalize(text) {
+  return text.replace(/[*_]/g, "").replace(/\s+/g, " ");
+}
+function headingCheck(prBody, keywordPattern, sectionName) {
+  const re = new RegExp(`^#{1,4}\\s*(?:\\*\\*)?(?:\\d+[a-z]?\\.\\s*)?[^\\n]*${keywordPattern}`, "im");
+  if (re.test(prBody))
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [`brief-validation ${sectionName}: no "${sectionName}" section found in the PR body.`]
+  };
+}
+function checkTierField(prBody, readTier) {
+  if (readTier(prBody) !== null)
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      "brief-validation tier: no `Tier:` field found in the PR body (expected `Tier: 0|1|3` or `**Tier:** 0|1|3`)."
+    ]
+  };
+}
+var TEST_PLAN_UNIT_TESTS_ONLY_RE = /(?:\*\*)?Test Plan(?:\*\*)?\s*:\s*(?:\*\*)?\s*unit-tests-only/i;
+function checkTestPlan(prBody) {
+  if (TEST_PLAN_UNIT_TESTS_ONLY_RE.test(prBody))
+    return { status: "pass", errors: [] };
+  if (/\*\*\[(?:agent|principal)\]\*\*/.test(prBody))
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      "brief-validation Test Plan: no Test Plan section found — expected `Test Plan: unit-tests-only`, or at least one `**[agent]**`/`**[principal]**`-tagged checklist item."
+    ]
+  };
+}
+function checkTestPlanExclusivity(prBody) {
+  if (!TEST_PLAN_UNIT_TESTS_ONLY_RE.test(prBody))
+    return { status: "pass", errors: [] };
+  if (/^-\s*\[[ xX]\]\s*\*{2}\[(?:agent|principal)\]\*{2}/im.test(prBody)) {
+    return {
+      status: "fail",
+      errors: [
+        "brief-validation Test Plan shape: `Test Plan: unit-tests-only` and a `- [ ]`/`- [x]` tagged checkbox item are mutually exclusive (brief-authoring §9) — declare one form, not both."
+      ]
+    };
+  }
+  return { status: "pass", errors: [] };
+}
+function checkPrincipalPlaceholder(prBody) {
+  const lineRe = /^-\s*\[[ xX]\]\s*\*{2}\[principal\]\*{2}(.*)$/gim;
+  for (const m of prBody.matchAll(lineRe)) {
+    const content = m[1] ?? "";
+    if (/^\s*None\b/i.test(content)) {
+      return {
+        status: "fail",
+        errors: [
+          'brief-validation Test Plan shape: a `**[principal]**` checkbox item is a "None" placeholder — if there is no principal-runnable surface, omit the item entirely; an untickable placeholder box blocks the merge gate forever.'
+        ]
+      };
+    }
+  }
+  return { status: "pass", errors: [] };
+}
+function checkSurfaceMap(prBody) {
+  return headingCheck(prBody, "(?:technical\\s+)?surface map", "Technical surface map");
+}
+function checkDocUpdateList(prBody) {
+  return headingCheck(prBody, "(?:documentation|doc)[- ]update(?:\\s+list)?", "Documentation-update list");
+}
+function checkWorktreeStep0(prBody) {
+  if (/git worktree add/.test(prBody))
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: ["brief-validation worktree Step 0: no `git worktree add` command found in the PR body."]
+  };
+}
+function checkStopConditions(prBody) {
+  return headingCheck(prBody, "stop conditions", "Stop conditions");
+}
+function checkAutonomyClause(prBody) {
+  const normalized = normalize(prBody).toLowerCase();
+  if (/do not stop to ask clarifying questions/.test(normalized))
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      'brief-validation autonomy clause: the standing autonomy clause ("Do not stop to ask clarifying questions...") was not found in the PR body.'
+    ]
+  };
+}
+function checkProjectField(prBody) {
+  if (headerField(prBody, "Project(?:\\(s\\))?", "PROJECT") !== null)
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      "brief-validation Project: no `Project:` field found in the PR body header block (before the first `##` heading). Required per the brief-developer contract — expected `Project: <name>[, <name>]` or `**Project:** …`."
+    ]
+  };
+}
+function checkForField(prBody) {
+  if (headerField(prBody, "For") !== null)
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      "brief-validation For: no `For:` field found in the PR body header block (before the first `##` heading). Required per the brief-authoring skill — expected `For: <model + environment>` or `**For:** …`."
+    ]
+  };
+}
+function checkClosesN(prBody) {
+  const closesPattern = /(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s{0,8}:?\s{0,8}#\d+/i;
+  if (closesPattern.test(stripCode(prBody))) {
+    return { status: "pass", errors: [] };
+  }
+  if (closesPattern.test(prBody)) {
+    return {
+      status: "fail",
+      errors: [
+        "brief-validation Closes #N: `Closes #N` found only inside a code span — GitHub won't auto-close it. Put a bare `Closes #N` on its own line inside the `AEG:CLOSES` anchor."
+      ]
+    };
+  }
+  return {
+    status: "fail",
+    errors: ["brief-validation Closes #N: no `Closes #<N>` (or Fixes/Resolves) reference found in the PR body."]
+  };
+}
+function checkBriefSections(prBody, readTier, options = {}) {
+  const { requireClosesN = true } = options;
+  const results = [
+    checkTierField(prBody, readTier),
+    checkTestPlan(prBody),
+    checkTestPlanExclusivity(prBody),
+    checkPrincipalPlaceholder(prBody),
+    checkSurfaceMap(prBody),
+    checkDocUpdateList(prBody),
+    checkWorktreeStep0(prBody),
+    checkStopConditions(prBody),
+    checkAutonomyClause(prBody),
+    checkProjectField(prBody),
+    checkForField(prBody),
+    ...requireClosesN ? [checkClosesN(prBody)] : []
+  ];
+  return { errors: results.flatMap((r) => r.errors) };
+}
+// ../../../packages/aeg-core/src/issue-validation.ts
+function hasRationaleField(body, labelPattern) {
+  const re = new RegExp(`(?:\\*\\*|^#{1,4}\\s+)\\s*(?:${labelPattern})`, "im");
+  return re.test(body);
+}
+var RATIONALE_FIELDS = [
+  { name: "Boundary", pattern: "Boundary" },
+  { name: "Sizing", pattern: "Sizing" },
+  { name: "Project(s) + blast radius", pattern: "Project\\(s\\)|Project(?:s)?\\s*\\+|blast radius" },
+  { name: "Dependency rationale", pattern: "Dependency rationale|Depends[- ]on" },
+  { name: "Traps to avoid", pattern: "Traps" },
+  { name: "Suggested agent-class", pattern: "(?:Suggested\\s+)?agent-class" },
+  { name: "Stop-and-escalate", pattern: "Stop-and-escalate" },
+  { name: "Docs to keep coherent", pattern: "Docs to keep coherent|§7" }
+];
+var DEPENDENCY_RATIONALE_FIELD_NAME = "Dependency rationale";
+function checkIssueRationale(body) {
+  const errors = [];
+  for (const f of RATIONALE_FIELDS) {
+    if (!hasRationaleField(body, f.pattern)) {
+      errors.push(`issue-validation ${f.name}: rationale field not found in the Issue body — every task Issue carries the full Planner's rationale (aeg-root/contracts/planner-brief.md).`);
+      continue;
+    }
+    if (f.name === DEPENDENCY_RATIONALE_FIELD_NAME && !SECTION_HEADER.test(body)) {
+      errors.push(`issue-validation ${f.name}: rationale field found, but not in the form amend-deps requires — ` + "write `**Dependency rationale** — …`, not `**Dependency rationale:** …`. " + "`amendRationaleDeps` (the only sanctioned way to edit Depends-on/Conflicts-with) locates this " + "section by the exact anchor `**Dependency rationale**`; a colon inside the bold breaks that match " + "and the Issue becomes unamendable.");
+    }
+  }
+  return { status: errors.length > 0 ? "fail" : "pass", errors };
+}
+function isTaskIssueLabelSet(labels) {
+  return hasLabel("tranche", labels);
+}
+
+// ../../../packages/aeg-core/src/coherence-checks.ts
+var COHERENCE_ENFORCED_FROM = "2026-07-01";
+function isGrandfathered(isoDate) {
+  if (!isoDate)
+    return false;
+  return isoDate.slice(0, 10) < COHERENCE_ENFORCED_FROM;
+}
+var R1_GRANDFATHERED_ISSUES = new Set([279, 280, 281, 282]);
+function checkA1(entries) {
+  const failures = [];
+  for (const e of entries) {
+    if (!e.facts)
+      continue;
+    if (e.facts.stateReason === "not_planned")
+      continue;
+    if (e.facts.issueState === "closed" && e.facts.prState !== "merged") {
+      failures.push({
+        issue: e.task.issue,
+        tranche: e.trancheSlug,
+        task: e.task.id,
+        reason: `Issue closed but closing PR is not merged (prState: ${e.facts.prState})`,
+        grandfathered: isGrandfathered(e.facts.closedAt)
+      });
+    }
+  }
+  const activeFails = failures.filter((f) => !f.grandfathered);
+  const status = activeFails.length > 0 ? "fail" : failures.length > 0 ? "info" : "pass";
+  return {
+    check: "A1",
+    status,
+    failures,
+    note: status === "info" ? `${failures.length} grandfathered (pre-${COHERENCE_ENFORCED_FROM})` : undefined
+  };
+}
+function checkA3(entries) {
+  const failures = [];
+  for (const e of entries) {
+    if (!e.facts)
+      continue;
+    if (e.facts.prState === "merged" && e.facts.issueState !== "closed") {
+      failures.push({
+        issue: e.task.issue,
+        tranche: e.trancheSlug,
+        task: e.task.id,
+        reason: "Closing PR is merged but Issue is still open (GitHub auto-close misfire)",
+        grandfathered: isGrandfathered(e.facts.mergedAt)
+      });
+    }
+  }
+  const activeFails = failures.filter((f) => !f.grandfathered);
+  const status = activeFails.length > 0 ? "fail" : failures.length > 0 ? "info" : "pass";
+  return {
+    check: "A3",
+    status,
+    failures,
+    note: status === "info" ? `${failures.length} grandfathered (pre-${COHERENCE_ENFORCED_FROM})` : undefined
+  };
+}
+function checkT1(entries) {
+  const failures = [];
+  for (const e of entries) {
+    if (e.task.issue === null)
+      continue;
+    if (e.facts === undefined) {
+      failures.push({
+        issue: e.task.issue,
+        tranche: e.trancheSlug,
+        task: e.task.id,
+        reason: `Issue #${e.task.issue} in topology does not resolve to a real GitHub Issue`
+      });
+    }
+  }
+  return { check: "T1", status: failures.length > 0 ? "fail" : "pass", failures };
+}
+function checkT2(openIssuesBySlug, topologyIssuesBySlug, ciTrancheSlug) {
+  const failures = [];
+  for (const [slug, openNums] of openIssuesBySlug) {
+    if (ciTrancheSlug && slug !== ciTrancheSlug)
+      continue;
+    const topologySet = topologyIssuesBySlug.get(slug) ?? new Set;
+    for (const num of openNums) {
+      if (!topologySet.has(num)) {
+        failures.push({
+          issue: num,
+          tranche: slug,
+          reason: `Issue #${num} is open and labeled ${trancheLabel(slug)} but does not appear in the topology file`
+        });
+      }
+    }
+  }
+  return { check: "T2", status: failures.length > 0 ? "fail" : "pass", failures };
+}
+function scopeT2ToPlanPr(result, isPlanPr) {
+  if (isPlanPr || result.status !== "fail")
+    return result;
+  return {
+    ...result,
+    status: "info",
+    note: result.note ?? "T2 findings are non-blocking outside plan PRs (point-of-power principle) — see aeg-root/enforcement.md."
+  };
+}
+function checkT3(entries, ciTrancheSlug, enrichedEntries, forgeUnavailableSlugs) {
+  const preEnforcement = new Set;
+  if (enrichedEntries) {
+    for (const e of enrichedEntries) {
+      if (isGrandfathered(e.facts?.closedAt) || isGrandfathered(e.facts?.mergedAt)) {
+        preEnforcement.add(e.trancheSlug);
+      }
+    }
+  }
+  const failures = [];
+  for (const e of entries) {
+    if (!e.archived && e.task.issue === null) {
+      if (ciTrancheSlug && e.trancheSlug !== ciTrancheSlug)
+        continue;
+      if (forgeUnavailableSlugs?.has(e.trancheSlug)) {
+        failures.push({
+          issue: null,
+          tranche: e.trancheSlug,
+          task: e.task.id,
+          reason: `Task ${e.task.id} in active tranche has no Issue ref (#TBD or empty), but forge data for tranche "${e.trancheSlug}" was unavailable — cannot evaluate grandfather status, not silently failed`,
+          grandfathered: true
+        });
+        continue;
+      }
+      failures.push({
+        issue: null,
+        tranche: e.trancheSlug,
+        task: e.task.id,
+        reason: `Task ${e.task.id} in active tranche has no Issue ref (#TBD or empty) — the model requires all active tasks to have Issue numbers`,
+        grandfathered: preEnforcement.has(e.trancheSlug)
+      });
+    }
+  }
+  const activeFails = failures.filter((f) => !f.grandfathered);
+  const status = activeFails.length > 0 ? "fail" : failures.length > 0 ? "info" : "pass";
+  return {
+    check: "T3",
+    status,
+    failures,
+    note: status === "info" ? `${failures.length} grandfathered (pre-${COHERENCE_ENFORCED_FROM})` : undefined
+  };
+}
+function checkD1(entries, issueToEntry, taskToEntry) {
+  const failures = [];
+  for (const e of entries) {
+    if (!e.facts)
+      continue;
+    if (e.facts.prState !== "open")
+      continue;
+    for (const dep of e.task.dependsOn) {
+      const depEntry = resolveDepEntry(dep, e.trancheSlug, issueToEntry, taskToEntry);
+      if (!depEntry)
+        continue;
+      const depFacts = depEntry.facts;
+      const depClosed = depFacts?.issueState === "closed";
+      if (!depClosed) {
+        failures.push({
+          issue: e.task.issue,
+          tranche: e.trancheSlug,
+          task: e.task.id,
+          reason: `Task has open PR but depends-on ${dep} (issue #${depEntry.task.issue ?? "?"}) is not closed`
+        });
+      }
+    }
+  }
+  return { check: "D1", status: failures.length > 0 ? "fail" : "pass", failures };
+}
+function resolveDepEntry(dep, trancheSlug, issueToEntry, taskToEntry) {
+  const issueMatch = dep.match(/^#(\d+)$/);
+  if (issueMatch?.[1])
+    return issueToEntry.get(Number(issueMatch[1]));
+  return taskToEntry.get(`${trancheSlug}/${dep}`) ?? taskToEntry.get(dep);
+}
+function checkR1(issuesBySlug, grandfatheredIssues) {
+  const failures = [];
+  for (const [slug, issues] of issuesBySlug) {
+    for (const issue of issues) {
+      if (!isTaskIssueLabelSet(issue.labels))
+        continue;
+      const { status: status2, errors } = checkIssueRationale(issue.body);
+      if (status2 !== "fail")
+        continue;
+      failures.push({
+        issue: issue.number,
+        tranche: slug,
+        reason: `Issue #${issue.number} fails the rationale gate: ${errors.join(" | ")}`,
+        grandfathered: grandfatheredIssues.has(issue.number)
+      });
+    }
+  }
+  const activeFails = failures.filter((f) => !f.grandfathered);
+  const status = activeFails.length > 0 ? "fail" : failures.length > 0 ? "info" : "pass";
+  return {
+    check: "R1",
+    status,
+    failures,
+    note: status === "info" ? `${failures.length} grandfathered task Issue(s) predate the rationale grammar` : undefined
+  };
+}
+function checkL1(files, entriesBySlug) {
+  const failures = [];
+  for (const f of files) {
+    if (f.archived)
+      continue;
+    const entries = entriesBySlug.get(f.slug) ?? [];
+    const withFacts = entries.filter((e) => e.facts !== undefined);
+    if (withFacts.length === 0)
+      continue;
+    const allClosed = withFacts.every((e) => e.facts?.issueState === "closed");
+    if (allClosed) {
+      failures.push({
+        tranche: f.slug,
+        reason: "Active tranche has no open task-Issues — consider archiving to completed/"
+      });
+    }
+  }
+  return {
+    check: "L1",
+    status: "info",
+    failures,
+    note: failures.length > 0 ? `${failures.length} active tranche(s) with no open task-Issues — consider archiving (advisory)` : undefined
+  };
+}
+function checkL3(files) {
+  const active = files.filter((f) => !f.archived);
+  return {
+    check: "L3",
+    status: "info",
+    failures: [],
+    note: `${active.length} active tranche(s): ${active.map((f) => f.slug).join(", ") || "(none)"}`
+  };
+}
+function extractClosesReferences(prBody) {
+  const closesPattern = /(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s{0,8}:?\s{0,8}#(\d+)/gi;
+  const stripped = stripCode(prBody);
+  const searchIn = anchoredRegion(stripped, "CLOSES") ?? stripped;
+  const referenced = new Set;
+  for (const hit of searchIn.matchAll(closesPattern)) {
+    referenced.add(Number(hit[1]));
+  }
+  return referenced;
+}
+function checkClosesN2(branch, prBody, trancheFiles, taskIssueRefs) {
+  const referenced = extractClosesReferences(prBody);
+  if (taskIssueRefs) {
+    for (const n of referenced) {
+      const ref = taskIssueRefs.get(n);
+      if (!ref)
+        continue;
+      const expectedBranch = `task/${ref.trancheSlug}/${ref.taskId}`;
+      if (branch !== expectedBranch) {
+        return {
+          ok: false,
+          message: `closes-n-reverse: branch "${branch}" closes #${n} (task ${ref.taskId} of tranche "${ref.trancheSlug}") but is not named "${expectedBranch}" — rename the branch and re-push, or if this work is intentionally outside AEG's dispatch flow, remove the Closes reference.`
+        };
+      }
+    }
+  }
+  const m = branch.match(/^task\/([^/]+)\/([^/]+)$/);
+  if (!m)
+    return { ok: true };
+  const trancheSlug = m[1];
+  const taskId = m[2];
+  const trancheFile = trancheFiles.find((f) => f.slug === trancheSlug);
+  if (!trancheFile) {
+    return {
+      ok: false,
+      message: `closes-n: branch "${branch}" references tranche "${trancheSlug}" but no topology file found at aeg-root/tranches/${trancheSlug}.md. Ensure the tranche file exists before opening the PR.`
+    };
+  }
+  const task = trancheFile.tranche.tasks.find((t) => t.id === taskId);
+  if (!task) {
+    return {
+      ok: false,
+      message: `closes-n: branch "${branch}" references task "${taskId}" not found in ${trancheSlug} topology. Verify the task ID matches the tranche file.`
+    };
+  }
+  if (task.issue === null) {
+    return {
+      ok: false,
+      message: `closes-n: task "${taskId}" in "${trancheSlug}" has no Issue number (#TBD). The Planner must cut the Issue before this PR can be validated.`
+    };
+  }
+  const expectedIssue = task.issue;
+  if (!referenced.has(expectedIssue)) {
+    return {
+      ok: false,
+      expectedIssue,
+      message: `closes-n: PR body does not contain \`Closes #${expectedIssue}\` (required for task "${taskId}" in tranche "${trancheSlug}"). Add it to the PR body Summary section.`
+    };
+  }
+  return { ok: true, expectedIssue };
+}
+// ../../../packages/aeg-core/src/verdict-extraction.ts
+function extractVerdict(comments, valuePattern, missingLabel) {
+  const clearHits = comments.filter((c) => valuePattern.test(c));
+  if (clearHits.length > 0) {
+    const latest = clearHits[clearHits.length - 1];
+    const m = latest.match(valuePattern);
+    return { value: m[1].toUpperCase().replace(/[_-]/g, " "), danglingNote: null };
+  }
+  return {
+    value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
+    danglingNote: `no ${missingLabel} verdict comment found on this PR`
+  };
+}
+function extractCodeReviewVerdict(comments) {
+  return extractVerdict(comments, /^[ \t]*(?:\*{1,3}|_{1,3})?VERDICT:\s*(APPROVE|REQUEST[ _-]?CHANGES|LGTM)(?![A-Za-z0-9])/im, "code-reviewer");
+}
+function extractSecurityReviewVerdict(comments) {
+  return extractVerdict(comments, /^[ \t]*(?:\*{1,3}|_{1,3})?VERDICT:\s*(PASS|FAIL)(?![A-Za-z0-9])/im, "security-review");
+}
+// ../../../packages/aeg-core/src/review-gate.ts
+function isReviewGateExemptBranch(branch) {
+  return branch.startsWith("plan/");
+}
+function checkReviewGate(input) {
+  const waived = isWaiverLabelActorVerified({
+    label: WAIVER_LABEL_REVIEW,
+    labels: input.labels,
+    labelActor: input.waiverLabelActor,
+    principalAllowlist: PRINCIPAL_ALLOWLIST
+  });
+  if (waived) {
+    return {
+      verdict: "pass",
+      reason: `\`${WAIVER_LABEL_REVIEW}\` label is actor-verified — review requirement waived for this PR.`,
+      waived: true
+    };
+  }
+  const codeReview = extractCodeReviewVerdict(input.comments);
+  const security = extractSecurityReviewVerdict(input.comments);
+  const codeReviewClean = codeReview.value === "APPROVE";
+  const securityClean = security.value === "PASS";
+  if (codeReviewClean && securityClean) {
+    return {
+      verdict: "pass",
+      reason: "code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS.",
+      waived: false
+    };
+  }
+  const problems = [];
+  if (!codeReviewClean)
+    problems.push(`code-reviewer verdict is not a clean APPROVE (found: ${codeReview.value})`);
+  if (!securityClean)
+    problems.push(`security-review verdict is not a clean PASS (found: ${security.value})`);
+  return {
+    verdict: "fail",
+    reason: `${problems.join("; ")}. A principal can apply an actor-verified \`${WAIVER_LABEL_REVIEW}\` label to skip this requirement, or post the missing/clean verdict comment(s).`,
+    waived: false
+  };
+}
+// ../../../packages/aeg-core/src/markdown-table.ts
+function splitRow(line) {
+  const trimmed = line.trim().replace(/^\|/, "").replace(/\|$/, "");
+  return trimmed.split("|").map((cell) => cell.trim());
+}
+var TABLE_ROW_PATTERN = /^\s*\|.*\|\s*$/;
+var SEPARATOR_ROW_PATTERN = /^\s*\|?\s*:?-+:?\s*(\|\s*:?-+:?\s*)*\|?\s*$/;
+function findTable(lines, fromLine, stopAtHeading = true) {
+  let i = fromLine - 1;
+  while (i < lines.length) {
+    const line = lines[i] ?? "";
+    if (stopAtHeading && i > fromLine - 1 && /^##\s/.test(line))
+      return null;
+    if (TABLE_ROW_PATTERN.test(line)) {
+      const headerLine = line;
+      const sepLine = lines[i + 1] ?? "";
+      if (!SEPARATOR_ROW_PATTERN.test(sepLine)) {
+        i++;
+        continue;
+      }
+      const headers = splitRow(headerLine);
+      const rows = [];
+      let j = i + 2;
+      while (j < lines.length && TABLE_ROW_PATTERN.test(lines[j] ?? "")) {
+        rows.push({ cells: splitRow(lines[j] ?? ""), line: j + 1 });
+        j++;
+      }
+      return { headers, rows };
+    }
+    i++;
+  }
+  return null;
+}
+function findHeadingLine(lines, pattern) {
+  for (let i = 0;i < lines.length; i++) {
+    if (pattern.test(lines[i] ?? ""))
+      return i + 1;
+  }
+  return null;
+}
+// ../../../packages/aeg-core/src/diagram-model.ts
+import matter from "gray-matter";
+
+// ../../../packages/aeg-core/src/registry-parse.ts
+var RING_HEADINGS = [
+  { ring: "ring0", pattern: /^##\s+Ring 0\b/ },
+  { ring: "ring1", pattern: /^##\s+Ring 1\b/ },
+  { ring: "ring2", pattern: /^##\s+Ring 2\b/ }
+];
+function stripBackticks(cell) {
+  const trimmed = cell.trim();
+  if (trimmed.length >= 2 && trimmed.startsWith("`") && trimmed.endsWith("`")) {
+    return trimmed.slice(1, -1);
+  }
+  return trimmed;
+}
+function stripBold(cell) {
+  return cell.trim().replace(/\*\*/g, "");
+}
+function parseEnforcementRegistry(content) {
+  const lines = content.split(`
+`);
+  const result = [];
+  for (const { ring, pattern } of RING_HEADINGS) {
+    const headingLine = findHeadingLine(lines, pattern);
+    if (headingLine === null)
+      continue;
+    const table = findTable(lines, headingLine + 1);
+    if (!table)
+      continue;
+    const descriptionIndex = table.headers.findIndex((h) => h.trim().toLowerCase() === "description");
+    const implementationIndex = table.headers.findIndex((h) => h.trim().toLowerCase() === "implementation");
+    for (const row of table.rows) {
+      const cells = row.cells;
+      if (cells.length < 3)
+        continue;
+      const action = stripBold(cells[0] ?? "");
+      const summary = stripBackticks(cells[1] ?? "");
+      const category = stripBackticks(cells[2] ?? "");
+      const implementation = stripBackticks((implementationIndex === -1 ? cells[cells.length - 1] : cells[implementationIndex]) ?? "");
+      const description = descriptionIndex === -1 ? undefined : stripBackticks(cells[descriptionIndex] ?? "") || undefined;
+      const spec = cells.length > 4 ? stripBackticks(cells[cells.length - 2] ?? "") : undefined;
+      result.push({ ring, action, summary, category, description, spec, implementation, line: row.line });
+    }
+  }
+  return result;
+}
+// ../../../packages/aeg-core/src/registry-checks.ts
+function checkG1(rows, existsFn) {
+  const findings = [];
+  for (const row of rows) {
+    if (row.implementation === "")
+      continue;
+    if (!existsFn(row.implementation)) {
+      findings.push({
+        row: row.action,
+        path: row.implementation,
+        reason: `${row.ring} row "${row.action}" names implementation "${row.implementation}", which does not exist on disk`
+      });
+    }
+  }
+  return { check: "G1", status: findings.length > 0 ? "info" : "pass", findings };
+}
+function checkG2(rows, candidateFiles) {
+  const implementations = new Set(rows.map((r) => r.implementation).filter((p) => p !== ""));
+  const findings = [];
+  for (const path of candidateFiles) {
+    if (!implementations.has(path)) {
+      findings.push({
+        path,
+        reason: `"${path}" is not named as the implementation of any row in enforcement.md's ring tables`
+      });
+    }
+  }
+  return { check: "G2", status: findings.length > 0 ? "info" : "pass", findings };
+}
+function checkG3(ring0Rows, crossingFiles) {
+  const ring0Implementations = new Set(ring0Rows.map((r) => r.implementation));
+  const findings = [];
+  for (const path of crossingFiles) {
+    if (!ring0Implementations.has(path)) {
+      findings.push({
+        path,
+        reason: `"${path}" makes a GitHub-crossing call but is not named by any Ring-0 row's implementation — a seventh, unlisted way into GitHub`
+      });
+    }
+  }
+  return { check: "G3", status: findings.length > 0 ? "fail" : "pass", findings };
+}
+function checkG4(content, resolveFn) {
+  const cited = new Set;
+  for (const hit of content.matchAll(/#(\d{3,})\b/g)) {
+    cited.add(Number(hit[1]));
+  }
+  const findings = [];
+  for (const n of cited) {
+    if (!resolveFn(n)) {
+      findings.push({
+        reason: `#${n} is cited in enforcement.md but does not resolve to a real Issue or PR in the forge`
+      });
+    }
+  }
+  return { check: "G4", status: findings.length > 0 ? "fail" : "pass", findings };
+}
+function checkG5(roles, contracts) {
+  const roleIds = new Set(roles.map((r) => r.role_id));
+  const findings = [];
+  for (const contract of contracts) {
+    if (!roleIds.has(contract.producer)) {
+      findings.push({
+        path: contract.file,
+        reason: `contract "${contract.file}" names producer "${contract.producer}", which is not a real role_id`
+      });
+    }
+    if (!roleIds.has(contract.consumer)) {
+      findings.push({
+        path: contract.file,
+        reason: `contract "${contract.file}" names consumer "${contract.consumer}", which is not a real role_id`
+      });
+    }
+  }
+  for (const role of roles) {
+    if (role.performs.length === 0) {
+      findings.push({ path: role.file, reason: `role "${role.role_id}" has an empty performs array` });
+    }
+    if (role.refuses_when.trim() === "") {
+      findings.push({ path: role.file, reason: `role "${role.role_id}" has an empty refuses_when` });
+    }
+  }
+  return { check: "G5", status: findings.length > 0 ? "fail" : "pass", findings };
+}
+// ../../../packages/aeg-core/src/dead-branch-push-guard.ts
+function checkDeadBranchPush(input) {
+  const { branch, prState, prNumber } = input;
+  if (prState === "MERGED") {
+    return {
+      verdict: "refuse",
+      reason: `Branch \`${branch}\` already has a MERGED PR (#${prNumber}) — this branch's work is done. Push a new task branch instead of pushing onto an already-resolved one.`
+    };
+  }
+  if (prState === "CLOSED") {
+    return {
+      verdict: "refuse",
+      reason: `Branch \`${branch}\` has a CLOSED PR (#${prNumber}) that was never merged — pushing here would resurrect abandoned/rejected work. Open a new task branch instead.`
+    };
+  }
+  if (prState === "OPEN") {
+    return {
+      verdict: "allow",
+      reason: `Branch \`${branch}\` has an OPEN PR (#${prNumber}) — pushing more commits to it is normal.`
+    };
+  }
+  if (prState === "NONE") {
+    return {
+      verdict: "allow",
+      reason: `Branch \`${branch}\` has no PR yet — a brand-new task branch legitimately has none.`
+    };
+  }
+  return {
+    verdict: "allow",
+    reason: `Could not determine \`${branch}\`'s PR state (forge unreachable) — failing open rather than blocking the push on a transient issue.`
+  };
+}
+// ../../../packages/aeg-core/src/reader-resolvable-prose.ts
+var SHIPS_PREFIX = "aeg-root/";
+var SHIPS_ARCHIVE_PREFIX = "aeg-root/tranches/completed/";
+function isSpecFile2(path) {
+  return path.startsWith("apps/") && path.includes("/specs/") && path.endsWith(".md");
+}
+function isClaudeMdFile(path) {
+  return path === "CLAUDE.md" || path.endsWith("/CLAUDE.md");
+}
+function classifyProseFile(path, readerFacingPrefix, readerFacingSuffix) {
+  if (path.startsWith(SHIPS_PREFIX)) {
+    return path.startsWith(SHIPS_ARCHIVE_PREFIX) ? "internal" : "ships";
+  }
+  if (path.startsWith(readerFacingPrefix) && path.endsWith(readerFacingSuffix)) {
+    return "reader-facing";
+  }
+  if (isSpecFile2(path) || isClaudeMdFile(path))
+    return "internal";
+  return null;
+}
+var SWEPT_CLASSES = new Set(["ships", "reader-facing"]);
+function stripNonProse(path, content) {
+  if (path.endsWith(".md")) {
+    return content.replace(/```.*?```/gs, (m) => m.replace(/[^\n]/g, "")).replace(/`[^`\n]*`/g, (m) => m.replace(/[^\n]/g, ""));
+  }
+  if (path.endsWith(".tsx") || path.endsWith(".ts")) {
+    return content.replace(/\/\*.*?\*\//gs, (m) => m.replace(/[^\n]/g, "")).replace(/(^|[^:])\/\/[^\n]*/g, (m) => m.replace(/[^\n]/g, ""));
+  }
+  return content;
+}
+function lineAt(content, index) {
+  let line = 1;
+  for (let i = 0;i < index; i++) {
+    if (content.charCodeAt(i) === 10)
+      line++;
+  }
+  return line;
+}
+var FORGE_NUMBER_PATTERN = /#[0-9]{2,4}/g;
+var TRANCHE_SLUG_VN_PATTERN = /[a-z][a-z-]+-v[0-9]/g;
+function legacySlugPattern(legacySlugs) {
+  if (legacySlugs.length === 0)
+    return null;
+  const alternation = legacySlugs.map((s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
+  return new RegExp(`(^|[^a-zA-Z0-9\\n-])(${alternation})([^a-zA-Z0-9\\n-]|$)`, "g");
+}
+function checkUnresolvableReferences(files, readerFacingPrefix, readerFacingSuffix, legacySlugs = []) {
+  const findings = [];
+  const legacyPattern = legacySlugPattern(legacySlugs);
+  const patterns = [
+    { pattern: FORGE_NUMBER_PATTERN, what: "a forge number" },
+    { pattern: TRANCHE_SLUG_VN_PATTERN, what: "an internal tranche slug" },
+    ...legacyPattern ? [{ pattern: legacyPattern, what: "an internal tranche slug", group: 2 }] : []
+  ];
+  for (const file of files) {
+    const cls = classifyProseFile(file.path, readerFacingPrefix, readerFacingSuffix);
+    if (!cls || !SWEPT_CLASSES.has(cls))
+      continue;
+    const scrubbed = stripNonProse(file.path, file.content);
+    for (const { pattern, what, group } of patterns) {
+      pattern.lastIndex = 0;
+      let match = pattern.exec(scrubbed);
+      while (match !== null) {
+        const cited = group !== undefined ? match[group] ?? match[0] : match[0];
+        findings.push({
+          file: file.path,
+          line: lineAt(scrubbed, match.index),
+          message: `references ${what} ("${cited}") a reader outside this repo's tracker cannot resolve`
+        });
+        match = pattern.exec(scrubbed);
+      }
+    }
+  }
+  return findings;
+}
+function escapeTerm(term) {
+  return term.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function containsWholeWord(text, term) {
+  const escaped = escapeTerm(term);
+  const re = new RegExp(`(^|[^a-zA-Z])${escaped}([^a-zA-Z]|$)`, "i");
+  return re.test(text);
+}
+function findWholeWordLine(content, term) {
+  const lines = content.split(`
+`);
+  let lineNo = 0;
+  for (const line of lines) {
+    lineNo++;
+    if (containsWholeWord(line, term))
+      return lineNo;
+  }
+  return null;
+}
+function definesOrLinksGlossary(content, term) {
+  const escaped = escapeTerm(term);
+  const definesInline = new RegExp(`(^|[^a-zA-Z])${escaped}([^a-zA-Z]|$)[^\\n]{0,3}—`, "i").test(content);
+  if (definesInline)
+    return true;
+  return /docs\/glossary|glossary\.md/i.test(content);
+}
+function checkUndefinedVocabulary(files, glossaryTerms, readerFacingPrefix, readerFacingSuffix) {
+  const findings = [];
+  for (const file of files) {
+    const cls = classifyProseFile(file.path, readerFacingPrefix, readerFacingSuffix);
+    if (!cls || !SWEPT_CLASSES.has(cls))
+      continue;
+    const scrubbed = stripNonProse(file.path, file.content);
+    for (const term of glossaryTerms) {
+      const line = findWholeWordLine(scrubbed, term);
+      if (line === null)
+        continue;
+      if (definesOrLinksGlossary(scrubbed, term))
+        continue;
+      findings.push({
+        file: file.path,
+        line,
+        message: `uses coined term "${term}" without defining it inline or linking the glossary`
+      });
+    }
+  }
+  return findings;
+}
+function checkReaderResolvableProse(files, glossaryTerms, readerFacingPrefix, readerFacingSuffix, legacySlugs = []) {
+  return [
+    ...checkUnresolvableReferences(files, readerFacingPrefix, readerFacingSuffix, legacySlugs),
+    ...checkUndefinedVocabulary(files, glossaryTerms, readerFacingPrefix, readerFacingSuffix)
+  ];
+}
+function parseGlossaryTerms(glossaryContent) {
+  const terms = [];
+  const re = /^\*\*(.+?)\*\* —/gm;
+  let match = re.exec(glossaryContent);
+  while (match !== null) {
+    if (match[1] !== undefined)
+      terms.push(match[1]);
+    match = re.exec(glossaryContent);
+  }
+  return terms;
+}
+// ../../../packages/aeg-core/src/dispatch-gate.ts
+function checkDispatchReadiness(input) {
+  const { trancheSlug, task } = input;
+  const taskLabel = `task ${task.id} (tranche ${trancheSlug})`;
+  const blockers = [];
+  if (task.issue === null) {
+    blockers.push(`dispatch-gate issue-existence: ${taskLabel} has no Issue (#TBD or blank) in the topology — not dispatchable until the Planner cuts the Issue.`);
+  } else if (input.issue === null) {
+    blockers.push(`dispatch-gate issue-existence: ${taskLabel} names Issue #${task.issue}, but it does not resolve to a real GitHub Issue (phantom reference).`);
+  }
+  if (input.issue !== null && !input.issueRationalePass) {
+    blockers.push(`dispatch-gate rationale: Issue #${input.issue.number} for ${taskLabel} fails the rationale gate (checkIssueRationale) — the Planner must complete the eight-field rationale before this task is dispatchable.`);
+  }
+  for (const dep of input.dependsOn) {
+    if (!dep.merged) {
+      const issueStr = dep.issue !== null ? ` (#${dep.issue})` : "";
+      blockers.push(`dispatch-gate depends-on: ${taskLabel} depends on ${dep.id}${issueStr}, whose PR is not merged yet — not dispatchable, it serializes behind it.`);
+    }
+  }
+  for (const c of input.conflictsWith) {
+    if (c.openOrInFlight) {
+      const issueStr = c.issue !== null ? ` (#${c.issue})` : "";
+      blockers.push(`dispatch-gate conflicts-with: ${taskLabel} conflicts with ${c.id}${issueStr}, whose PR is open or in-flight — not dispatchable until it merges.`);
+    }
+  }
+  for (const proj of input.priorTrancheArchival) {
+    if (proj.priorTrancheSlug !== null && !proj.archived) {
+      blockers.push(`dispatch-gate prior-tranche-archival: project \`${proj.project}\`'s previous tranche \`${proj.priorTrancheSlug}\` is not archived — the Tranche Archivist must run before new work on this product.`);
+    }
+  }
+  return { ready: blockers.length === 0, blockers };
+}
+// ../../../packages/aeg-core/src/single-plan-pr.ts
+function trancheSlugFromTopologyPath(path) {
+  const m = path.match(/^aeg-root\/tranches\/([^/]+)\.md$/);
+  if (!m)
+    return null;
+  const slug = m[1];
+  if (slug === "README" || slug.endsWith(".tokens"))
+    return null;
+  return slug;
+}
+function checkSinglePlanPr(branchFiles, otherOpenPrs) {
+  const touchedSlugs = new Set(branchFiles.map(trancheSlugFromTopologyPath).filter((s) => s !== null));
+  if (touchedSlugs.size === 0)
+    return { ok: true };
+  for (const pr of otherOpenPrs) {
+    const otherSlugs = new Set(pr.files.map(trancheSlugFromTopologyPath).filter((s) => s !== null));
+    for (const slug of touchedSlugs) {
+      if (otherSlugs.has(slug)) {
+        return {
+          ok: false,
+          message: `single-plan-pr: another open PR (#${pr.number}) already touches tranche "${slug}"'s topology file. Only one open plan PR per tranche is allowed at a time — wait for #${pr.number} to merge or close, or coordinate with its author.`
+        };
+      }
+    }
+  }
+  return { ok: true };
+}
+function touchesAnyTopology(files) {
+  return files.some((f) => trancheSlugFromTopologyPath(f) !== null);
+}
+// ../../../packages/aeg-core/src/no-disk-state.ts
+var TOP_LEVEL_TOPOLOGY_FILE = /^aeg-root\/tranches\/[^/]+\.md$/;
+var ANY_DEPTH_TRANCHES_MD = /^aeg-root\/tranches\/.*\.md$/;
+var TOKENS_FILE = /\.tokens\.md$/;
+function isNewDiskStateFile(path, status) {
+  if (TOP_LEVEL_TOPOLOGY_FILE.test(path))
+    return true;
+  if (status !== "added")
+    return false;
+  return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
+}
+// ../../../packages/aeg-core/src/branch-topology-gate.ts
+function taskBranchTopologyFields(branch) {
+  if (!/^task\/.*\/.*$/.test(branch))
+    return null;
+  const parts = branch.split("/");
+  return { tranche: parts[1] ?? "", taskId: parts[2] ?? "" };
+}
+function checkBranchTopology(input) {
+  const { branch, tranche, taskId, topoPath, topology } = input;
+  if (topology === null) {
+    return {
+      verdict: "refuse",
+      reason: `✖ pre-push: branch \`${branch}\` names tranche \`${tranche}\`, but ${topoPath} does not exist.
+` + "  A task branch must belong to a real tranche."
+    };
+  }
+  const hasRow = topology?.tasks.some((t) => t.id === taskId) ?? false;
+  if (!hasRow) {
+    return {
+      verdict: "refuse",
+      reason: `✖ pre-push: branch \`${branch}\` — no row with \`#\` = \`${taskId}\` in ${topoPath}.
+` + `  The branch suffix must literal-match the topology's # column.
+` + "  If the plan PR adding this row hasn't merged yet, merge it first."
+    };
+  }
+  return {
+    verdict: "allow",
+    reason: `Branch \`${branch}\` matches topology row \`${taskId}\` in ${topoPath}.`
+  };
+}
+// ../../../packages/aeg-core/src/first-push-dispatch-gate.ts
+function parseTaskBranch(branch) {
+  const m = /^task\/([^/]+)\/([^/]+)$/.exec(branch);
+  return m ? { tranche: m[1], taskId: m[2] } : null;
+}
+function checkFirstPushDispatchGate(input) {
+  const { branch, prExists, readiness } = input;
+  if (parseTaskBranch(branch) === null) {
+    return {
+      verdict: "allow",
+      reason: `Branch \`${branch}\` is not a task/<tranche>/<n> branch — the first-push dispatch gate only applies to task branches.`
+    };
+  }
+  if (prExists) {
+    return {
+      verdict: "allow",
+      reason: `Branch \`${branch}\` already has an open PR — dispatch readiness was already validated on its first push; later pushes are not re-blocked by a sibling task's state change.`
+    };
+  }
+  if (readiness === "UNKNOWN") {
+    return {
+      verdict: "allow",
+      reason: `verify-dispatch could not reach the forge for \`${branch}\` (repo/token unresolvable) — failing OPEN rather than blocking the push on a transient issue.`
+    };
+  }
+  if (readiness === "NOT_READY") {
+    return {
+      verdict: "refuse",
+      reason: `verify-dispatch reports NOT READY for \`${branch}\` — see the failing predicate printed above.`
+    };
+  }
+  return {
+    verdict: "allow",
+    reason: `verify-dispatch reports READY TO DISPATCH for \`${branch}\`.`
+  };
+}
+// ../../../packages/aeg-core/src/issue-assignment.ts
+function decideIssueAssignment(input) {
+  const { branch, remoteRefExists, issue, assignees, login } = input;
+  if (parseTaskBranch(branch) === null) {
+    return {
+      action: "skip",
+      reason: `Branch \`${branch}\` is not a task/<tranche>/<n> branch — Issue self-assignment only applies to task branches.`
+    };
+  }
+  if (remoteRefExists) {
+    return {
+      action: "skip",
+      reason: `Branch \`${branch}\` already exists on the remote — not its first push, nothing to assign.`
+    };
+  }
+  if (issue === null) {
+    return {
+      action: "skip",
+      reason: `No Issue resolved for \`${branch}\` from its topology row — skipping self-assignment (the gate owns refusing an unplanned branch).`
+    };
+  }
+  if (assignees === null) {
+    return {
+      action: "skip",
+      reason: `Could not read Issue #${issue}'s current assignees — skipping rather than risking a double-assign (fail-open, never a guess).`
+    };
+  }
+  if (assignees.length > 0) {
+    return {
+      action: "skip",
+      reason: `Issue #${issue} is already assigned (${assignees.join(", ")}) — no-op.`
+    };
+  }
+  if (login === null) {
+    return {
+      action: "skip",
+      reason: "Could not resolve the authenticated `gh` login — never assigning anyone other than the actual pusher, so skipping."
+    };
+  }
+  return {
+    action: "assign",
+    issue,
+    login,
+    reason: `First push of \`${branch}\` — assigning Issue #${issue} to @${login} (the authenticated pusher).`
+  };
+}
+// ../../../packages/aeg-core/src/test-plan-section.ts
+var HEADING_FORM_RE = /^#{1,4}[ \t]*(?:\d+[a-z]?\.[ \t]*)?\*{0,2}Test Plan\*{0,2}[ \t]*$/im;
+var INLINE_FORM_RE = /^[ \t]*\*{0,2}Test Plan:?\*{0,2}/im;
+var NEXT_SECTION_RE = /\n(?:#{1,3}[ \t]|\*\*[A-Z][^*\n]*:\*\*)/;
+function locateTestPlanSection(body) {
+  const region = anchoredRegion(body, "TEST-PLAN");
+  if (region !== null)
+    return { found: true, section: region };
+  const headingMatch = HEADING_FORM_RE.exec(body);
+  const match = headingMatch ?? INLINE_FORM_RE.exec(body);
+  if (!match || match.index === undefined)
+    return { found: false };
+  const sectionBody = body.slice(match.index);
+  const firstLineEnd = sectionBody.indexOf(`
+`);
+  const searchFrom = firstLineEnd === -1 ? sectionBody.length : firstLineEnd + 1;
+  const nextMatch = sectionBody.slice(searchFrom).match(NEXT_SECTION_RE);
+  const sectionEnd = nextMatch ? searchFrom + (nextMatch.index ?? 0) : sectionBody.length;
+  return { found: true, section: sectionBody.slice(0, sectionEnd) };
+}
+// ../../../packages/aeg-core/src/test-plan-gate.ts
+var TASK_BRANCH_PATTERN = /^task\/[^/]+\/[^/]+$/;
+function evaluateTestPlanGate(body, branch) {
+  if (!body) {
+    return {
+      verdict: "pass",
+      messages: [
+        "PR_BODY env var is empty; nothing to check.",
+        "PASS (no body — likely a local invocation; CI sets PR_BODY automatically)."
+      ]
+    };
+  }
+  const located = locateTestPlanSection(body);
+  if (!located.found) {
+    if (TASK_BRANCH_PATTERN.test(branch)) {
+      return {
+        verdict: "fail",
+        messages: [
+          `FAIL — no Test Plan section found in the PR body for task branch \`${branch}\`.`,
+          "Searched for a `## Test Plan` / `## N. Test Plan` heading and an inline `**Test Plan:**`/`Test Plan:` marker — neither was found.",
+          "Per, a task PR without a Test Plan is malformed, not exempt — add one (or `Test Plan: unit-tests-only` for a pure-logic brief with no runtime surface)."
+        ]
+      };
+    }
+    return {
+      verdict: "pass",
+      messages: [
+        "No Test Plan section in PR body.",
+        "PASS (advisory) — see aeg-root/roles/developer.md (Verification) and aeg-root/skills/brief-authoring/SKILL.md §9.",
+        "Non-task branch (or BRANCH unset) — a brief that touches a runtime surface and has no Test Plan is malformed on a task branch; Brief Validation catches that case pre-dispatch."
+      ]
+    };
+  }
+  const section = located.section;
+  if (/unit-tests-only/i.test(section)) {
+    return {
+      verdict: "pass",
+      messages: ["Test Plan: unit-tests-only — pure-logic brief, CI unit-tests are the proof.", "PASS."]
+    };
+  }
+  const checkboxLines = section.split(`
+`).map((line) => line.trimStart()).filter((line) => /^[-*]\s+\[[ xX]\]/.test(line));
+  if (checkboxLines.length === 0) {
+    return {
+      verdict: "pass",
+      messages: [
+        "Test Plan section found but has no checkbox items.",
+        "PASS (advisory) — the section may be empty or expressed in prose; verification is the Principal's call."
+      ]
+    };
+  }
+  const unchecked = checkboxLines.filter((line) => /^[-*]\s+\[\s\]/.test(line));
+  const checked = checkboxLines.filter((line) => /^[-*]\s+\[[xX]\]/.test(line));
+  const messages = [`Test Plan items: ${checked.length} ticked, ${unchecked.length} unticked.`];
+  if (unchecked.length > 0) {
+    messages.push("", "FAIL — the following Test Plan items are unticked:");
+    for (const line of unchecked)
+      messages.push(`  ${line}`);
+    messages.push("", "Per aeg-root/roles/developer.md (Verification), a PR is not mergeable while any Test Plan box is unticked.", "- [agent] items: the Developer-agent posts the actual command output as evidence and ticks the box.", "- [principal] items: the Principal runs the item in a real signed-in browser and ticks the box.", "Note: editing the PR body does not retrigger most workflows. If your PR body changes do not surface here, push an empty commit to re-run.");
+    return { verdict: "fail", messages };
+  }
+  messages.push("All Test Plan items ticked — runtime verification complete.", "PASS.");
+  return { verdict: "pass", messages };
+}
+// ../sources/src/forge-adapter.ts
+function createForgeSource(config) {
+  return {
+    async getTranche(slug) {
+      return deriveTrancheFromForge(config.owner, config.repo, slug);
+    }
+  };
+}
+// ../sources/src/select-source.ts
+import { z } from "zod";
+var StateSourceConfigSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("forge"), owner: z.string(), repo: z.string() }),
+  z.object({ kind: z.literal("file"), root: z.string().optional() })
+]);
+// src/checks/contract.ts
+var CHECK_SCHEMA_VERSION = 1;
+function emitCheckError(error) {
+  process.stderr.write(`${JSON.stringify(error)}
+`);
+}
+
+// src/checks/bin/check-dispatch-readiness.ts
+var CHECK_NAME = "dispatch-readiness";
+var execFileAsync4 = promisify4(execFile4);
+function git(args) {
+  try {
+    return execFileSync2("git", args, { encoding: "utf8" }).trim();
+  } catch {
+    return "";
+  }
+}
+function resolveRepo2() {
+  const fromEnv = process.env.AEG_REPO;
+  if (fromEnv) {
+    const m = fromEnv.match(/^([^/]+)\/(.+)$/);
+    if (m?.[1] && m[2])
+      return { owner: m[1], repo: m[2] };
+  }
+  const url = git(["remote", "get-url", "origin"]);
+  const ssh = url.match(/^git@github\.com:([^/]+)\/(.+?)(?:\.git)?$/);
+  if (ssh?.[1] && ssh[2])
+    return { owner: ssh[1], repo: ssh[2] };
+  const https = url.match(/^https?:\/\/(?:[^@]+@)?github\.com\/([^/]+)\/(.+?)(?:\.git)?\/?$/);
+  if (https?.[1] && https[2])
+    return { owner: https[1], repo: https[2] };
+  return null;
+}
+async function resolveToken() {
+  if (process.env.GITHUB_TOKEN)
+    return process.env.GITHUB_TOKEN;
+  if (process.env.GH_TOKEN)
+    return process.env.GH_TOKEN;
+  try {
+    const { stdout } = await execFileAsync4("gh", ["auth", "token"]);
+    const token = stdout.trim();
+    return token.length > 0 ? token : null;
+  } catch {
+    return null;
+  }
+}
+function currentBranch() {
+  return process.env.BRANCH || git(["rev-parse", "--abbrev-ref", "HEAD"]);
+}
+function fail(message, prompt) {
+  emitCheckError({
+    schema: CHECK_SCHEMA_VERSION,
+    check: CHECK_NAME,
+    severity: "error",
+    message,
+    agent_recovery_prompt: prompt
+  });
+  process.exit(1);
+}
+function resolveEdge(id, taskById, factsByTaskId) {
+  const target = taskById.get(id);
+  if (target) {
+    const facts = target.issue !== null ? factsByTaskId.get(target.id) : undefined;
+    return { issue: target.issue, merged: facts?.prState === "merged", open: facts?.prState === "open" };
+  }
+  const direct = id.match(/^#(\d+)$/);
+  return { issue: direct ? Number(direct[1]) : null, merged: false, open: false };
+}
+async function main() {
+  const branch = currentBranch();
+  const m = branch.match(/^task\/([^/]+)\/(.+)$/);
+  if (!m) {
+    process.exit(0);
+  }
+  const trancheSlug = m[1];
+  const taskId = m[2];
+  const repo = resolveRepo2();
+  if (!repo) {
+    fail("dispatch-gate severity:infra — could not resolve owner/repo.", "Set AEG_REPO=owner/repo, or confirm `git remote get-url origin` resolves to a GitHub URL, then re-run `vinaya check dispatch-readiness`.");
+  }
+  const source = createForgeSource({ owner: repo.owner, repo: repo.repo });
+  let tranche;
+  try {
+    tranche = await source.getTranche(trancheSlug);
+  } catch (err) {
+    fail(`dispatch-gate severity:infra — could not derive tranche "${trancheSlug}" from the forge: ${err.message}`, "Confirm `gh auth status` passes and the tranche has a Milestone + labeled Issues on the forge, then re-run this check.");
+  }
+  const task = tranche.tasks.find((t) => t.id === taskId);
+  if (!task) {
+    fail(`dispatch-gate row-existence: task "${taskId}" is not present in tranche "${trancheSlug}"'s forge-derived task list.`, "Confirm the branch name matches a real, forge-registered task id, or wait for the Planner to open the task Issue before re-running.");
+  }
+  const taskRefs = tranche.tasks.map((t) => ({ id: t.id, issue: t.issue }));
+  const snapshot = await fetchForgeFacts({
+    owner: repo.owner,
+    repo: repo.repo,
+    tranche: trancheSlug,
+    tasks: taskRefs
+  });
+  const token = await resolveToken() ?? "";
+  const openIssuesBySlug = await fetchOpenIssuesByLabel([trancheSlug], repo.owner, repo.repo, token);
+  const openIssues = openIssuesBySlug.get(trancheSlug) ?? [];
+  const issueFacts = task.issue !== null ? snapshot.facts.get(task.id) : undefined;
+  const issue = task.issue !== null && issueFacts ? { number: task.issue, state: issueFacts.issueState === "closed" ? "closed" : "open" } : null;
+  const openIssueMatch = task.issue !== null ? openIssues.find((i) => i.number === task.issue) : undefined;
+  const issueRationalePass = openIssueMatch ? checkIssueRationale(openIssueMatch.body).status !== "fail" : true;
+  const taskById = new Map(tranche.tasks.map((t) => [t.id, t]));
+  const factsByTaskId = snapshot.facts;
+  const dependsOn = task.dependsOn.map((dep) => {
+    const r = resolveEdge(dep, taskById, factsByTaskId);
+    return { id: dep, issue: r.issue, merged: r.merged };
+  });
+  const conflictsWith = task.conflictsWith.map((c) => {
+    const r = resolveEdge(c, taskById, factsByTaskId);
+    return { id: c, issue: r.issue, openOrInFlight: r.open };
+  });
+  const priorTrancheArchival = [];
+  const input = {
+    trancheSlug,
+    task,
+    issue,
+    issueRationalePass,
+    dependsOn,
+    conflictsWith,
+    priorTask: null,
+    priorTrancheArchival
+  };
+  const result = checkDispatchReadiness(input);
+  if (!result.ready) {
+    for (const blocker of result.blockers) {
+      emitCheckError({
+        schema: CHECK_SCHEMA_VERSION,
+        check: CHECK_NAME,
+        severity: "error",
+        message: blocker,
+        agent_recovery_prompt: recoveryPromptFor(blocker)
+      });
+    }
+    process.exit(1);
+  }
+  process.exit(0);
+}
+function recoveryPromptFor(blocker) {
+  if (blocker.startsWith("dispatch-gate issue-existence:")) {
+    return "This task has no resolvable Issue yet. Wait for the Planner to cut the Issue (or fix the phantom reference in the topology), then re-run `vinaya check dispatch-readiness`.";
+  }
+  if (blocker.startsWith("dispatch-gate rationale:")) {
+    return "The task's Issue fails the rationale gate. Ask the Planner to complete the eight-field rationale on the Issue body, then re-run `vinaya check dispatch-readiness`.";
+  }
+  if (blocker.startsWith("dispatch-gate depends-on:")) {
+    return "A declared dependency is not merged yet. Do not start this task — wait for the named dependency PR to merge, then re-run `vinaya check dispatch-readiness`.";
+  }
+  if (blocker.startsWith("dispatch-gate conflicts-with:")) {
+    return "A declared conflicting task has an open or in-flight PR. Wait for it to merge before continuing, then re-run `vinaya check dispatch-readiness`.";
+  }
+  if (blocker.startsWith("dispatch-gate prior-tranche-archival:")) {
+    return "This project's previous tranche is not archived. Ask the Tranche Archivist to run first, then re-run `vinaya check dispatch-readiness`.";
+  }
+  return "Resolve the named dispatch blocker before continuing work on this task, then re-run `vinaya check dispatch-readiness`.";
+}
+main();