@attalabs/vinaya 0.12.0 → 0.16.0

package/dist/checks/bin/check-brief-shape.js

@@ -2365,15 +2365,25 @@ function checkClosesN2(branch, prBody, trancheFiles, taskIssueRefs) {
   return { ok: true, expectedIssue };
 }
 // ../../packages/aeg-core/src/verdict-extraction.ts
+var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
+function extractHeadSha(comment) {
+  const m = comment.match(HEAD_SHA_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
 function extractVerdict(comments, valuePattern, missingLabel) {
   const clearHits = comments.filter((c) => valuePattern.test(c));
   if (clearHits.length > 0) {
     const latest = clearHits[clearHits.length - 1];
     const m = latest.match(valuePattern);
-    return { value: m[1].toUpperCase().replace(/[_-]/g, " "), danglingNote: null };
+    return {
+      value: m[1].toUpperCase().replace(/[_-]/g, " "),
+      headSha: extractHeadSha(latest),
+      danglingNote: null
+    };
   }
   return {
     value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
+    headSha: null,
     danglingNote: `no ${missingLabel} verdict comment found on this PR`
   };
 }
@@ -2387,6 +2397,11 @@ function extractSecurityReviewVerdict(comments) {
 function isReviewGateExemptBranch(branch) {
   return branch.startsWith("plan/");
 }
+function isBoundToHead(extraction, headSha) {
+  if (!extraction.headSha)
+    return false;
+  return headSha.toLowerCase().startsWith(extraction.headSha.toLowerCase());
+}
 function checkReviewGate(input) {
   const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const waived = isWaiverLabelActorVerified({
@@ -2409,18 +2424,26 @@ function checkReviewGate(input) {
   const security = extractSecurityReviewVerdict(verifiedBodies);
   const codeReviewClean = codeReview.value === "APPROVE";
   const securityClean = security.value === "PASS";
-  if (codeReviewClean && securityClean) {
+  const codeReviewBound = isBoundToHead(codeReview, input.headSha);
+  const securityBound = isBoundToHead(security, input.headSha);
+  if (codeReviewClean && codeReviewBound && securityClean && securityBound) {
     return {
       verdict: "pass",
-      reason: "code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS.",
+      reason: `code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS, both covering head ${input.headSha}.`,
       waived: false
     };
   }
   const problems = [];
-  if (!codeReviewClean)
+  if (!codeReviewClean) {
     problems.push(`code-reviewer verdict is not a clean APPROVE (found: ${codeReview.value})`);
-  if (!securityClean)
+  } else if (!codeReviewBound) {
+    problems.push(`the newest code-review verdict covers ${codeReview.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
+  if (!securityClean) {
     problems.push(`security-review verdict is not a clean PASS (found: ${security.value})`);
+  } else if (!securityBound) {
+    problems.push(`the newest security-review verdict covers ${security.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
   const ignoredNote = ignoredCount > 0 ? ` ${ignoredCount} verdict-shaped comment(s) from authors outside the principal allowlist were ignored.` : "";
   return {
     verdict: "fail",

package/dist/checks/bin/check-closes-n.js

@@ -2368,15 +2368,25 @@ function checkClosesN2(branch, prBody, trancheFiles, taskIssueRefs) {
   return { ok: true, expectedIssue };
 }
 // ../../packages/aeg-core/src/verdict-extraction.ts
+var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
+function extractHeadSha(comment) {
+  const m = comment.match(HEAD_SHA_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
 function extractVerdict(comments, valuePattern, missingLabel) {
   const clearHits = comments.filter((c) => valuePattern.test(c));
   if (clearHits.length > 0) {
     const latest = clearHits[clearHits.length - 1];
     const m = latest.match(valuePattern);
-    return { value: m[1].toUpperCase().replace(/[_-]/g, " "), danglingNote: null };
+    return {
+      value: m[1].toUpperCase().replace(/[_-]/g, " "),
+      headSha: extractHeadSha(latest),
+      danglingNote: null
+    };
   }
   return {
     value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
+    headSha: null,
     danglingNote: `no ${missingLabel} verdict comment found on this PR`
   };
 }
@@ -2390,6 +2400,11 @@ function extractSecurityReviewVerdict(comments) {
 function isReviewGateExemptBranch(branch) {
   return branch.startsWith("plan/");
 }
+function isBoundToHead(extraction, headSha) {
+  if (!extraction.headSha)
+    return false;
+  return headSha.toLowerCase().startsWith(extraction.headSha.toLowerCase());
+}
 function checkReviewGate(input) {
   const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const waived = isWaiverLabelActorVerified({
@@ -2412,18 +2427,26 @@ function checkReviewGate(input) {
   const security = extractSecurityReviewVerdict(verifiedBodies);
   const codeReviewClean = codeReview.value === "APPROVE";
   const securityClean = security.value === "PASS";
-  if (codeReviewClean && securityClean) {
+  const codeReviewBound = isBoundToHead(codeReview, input.headSha);
+  const securityBound = isBoundToHead(security, input.headSha);
+  if (codeReviewClean && codeReviewBound && securityClean && securityBound) {
     return {
       verdict: "pass",
-      reason: "code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS.",
+      reason: `code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS, both covering head ${input.headSha}.`,
       waived: false
     };
   }
   const problems = [];
-  if (!codeReviewClean)
+  if (!codeReviewClean) {
     problems.push(`code-reviewer verdict is not a clean APPROVE (found: ${codeReview.value})`);
-  if (!securityClean)
+  } else if (!codeReviewBound) {
+    problems.push(`the newest code-review verdict covers ${codeReview.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
+  if (!securityClean) {
     problems.push(`security-review verdict is not a clean PASS (found: ${security.value})`);
+  } else if (!securityBound) {
+    problems.push(`the newest security-review verdict covers ${security.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
   const ignoredNote = ignoredCount > 0 ? ` ${ignoredCount} verdict-shaped comment(s) from authors outside the principal allowlist were ignored.` : "";
   return {
     verdict: "fail",

package/dist/checks/bin/check-coherence.js

@@ -2371,15 +2371,25 @@ function checkClosesN2(branch, prBody, trancheFiles, taskIssueRefs) {
   return { ok: true, expectedIssue };
 }
 // ../../packages/aeg-core/src/verdict-extraction.ts
+var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
+function extractHeadSha(comment) {
+  const m = comment.match(HEAD_SHA_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
 function extractVerdict(comments, valuePattern, missingLabel) {
   const clearHits = comments.filter((c) => valuePattern.test(c));
   if (clearHits.length > 0) {
     const latest = clearHits[clearHits.length - 1];
     const m = latest.match(valuePattern);
-    return { value: m[1].toUpperCase().replace(/[_-]/g, " "), danglingNote: null };
+    return {
+      value: m[1].toUpperCase().replace(/[_-]/g, " "),
+      headSha: extractHeadSha(latest),
+      danglingNote: null
+    };
   }
   return {
     value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
+    headSha: null,
     danglingNote: `no ${missingLabel} verdict comment found on this PR`
   };
 }
@@ -2393,6 +2403,11 @@ function extractSecurityReviewVerdict(comments) {
 function isReviewGateExemptBranch(branch) {
   return branch.startsWith("plan/");
 }
+function isBoundToHead(extraction, headSha) {
+  if (!extraction.headSha)
+    return false;
+  return headSha.toLowerCase().startsWith(extraction.headSha.toLowerCase());
+}
 function checkReviewGate(input) {
   const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const waived = isWaiverLabelActorVerified({
@@ -2415,18 +2430,26 @@ function checkReviewGate(input) {
   const security = extractSecurityReviewVerdict(verifiedBodies);
   const codeReviewClean = codeReview.value === "APPROVE";
   const securityClean = security.value === "PASS";
-  if (codeReviewClean && securityClean) {
+  const codeReviewBound = isBoundToHead(codeReview, input.headSha);
+  const securityBound = isBoundToHead(security, input.headSha);
+  if (codeReviewClean && codeReviewBound && securityClean && securityBound) {
     return {
       verdict: "pass",
-      reason: "code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS.",
+      reason: `code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS, both covering head ${input.headSha}.`,
       waived: false
     };
   }
   const problems = [];
-  if (!codeReviewClean)
+  if (!codeReviewClean) {
     problems.push(`code-reviewer verdict is not a clean APPROVE (found: ${codeReview.value})`);
-  if (!securityClean)
+  } else if (!codeReviewBound) {
+    problems.push(`the newest code-review verdict covers ${codeReview.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
+  if (!securityClean) {
     problems.push(`security-review verdict is not a clean PASS (found: ${security.value})`);
+  } else if (!securityBound) {
+    problems.push(`the newest security-review verdict covers ${security.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
   const ignoredNote = ignoredCount > 0 ? ` ${ignoredCount} verdict-shaped comment(s) from authors outside the principal allowlist were ignored.` : "";
   return {
     verdict: "fail",
@@ -3150,7 +3173,8 @@ var VinayaConfigSchema = z2.object({
   briefSchema: BriefSchemaSchema.optional(),
   managed: ManagedManifestSchema.optional(),
   principals: z2.array(z2.string()).min(1).optional(),
-  ci: z2.object({ setup: z2.string().min(1) }).optional()
+  ci: z2.object({ setup: z2.string().min(1) }).optional(),
+  blastRadius: z2.object({ extraDomains: z2.array(z2.string()).optional() }).optional()
 });
 var GLOBAL_VINAYA_HOME = join(homedir(), ".vinaya");
 var GLOBAL_CONFIG_PATH = join(GLOBAL_VINAYA_HOME, "config.json");

package/dist/checks/bin/check-dead-branch-push.js

@@ -2368,15 +2368,25 @@ function checkClosesN2(branch, prBody, trancheFiles, taskIssueRefs) {
   return { ok: true, expectedIssue };
 }
 // ../../packages/aeg-core/src/verdict-extraction.ts
+var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
+function extractHeadSha(comment) {
+  const m = comment.match(HEAD_SHA_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
 function extractVerdict(comments, valuePattern, missingLabel) {
   const clearHits = comments.filter((c) => valuePattern.test(c));
   if (clearHits.length > 0) {
     const latest = clearHits[clearHits.length - 1];
     const m = latest.match(valuePattern);
-    return { value: m[1].toUpperCase().replace(/[_-]/g, " "), danglingNote: null };
+    return {
+      value: m[1].toUpperCase().replace(/[_-]/g, " "),
+      headSha: extractHeadSha(latest),
+      danglingNote: null
+    };
   }
   return {
     value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
+    headSha: null,
     danglingNote: `no ${missingLabel} verdict comment found on this PR`
   };
 }
@@ -2390,6 +2400,11 @@ function extractSecurityReviewVerdict(comments) {
 function isReviewGateExemptBranch(branch) {
   return branch.startsWith("plan/");
 }
+function isBoundToHead(extraction, headSha) {
+  if (!extraction.headSha)
+    return false;
+  return headSha.toLowerCase().startsWith(extraction.headSha.toLowerCase());
+}
 function checkReviewGate(input) {
   const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const waived = isWaiverLabelActorVerified({
@@ -2412,18 +2427,26 @@ function checkReviewGate(input) {
   const security = extractSecurityReviewVerdict(verifiedBodies);
   const codeReviewClean = codeReview.value === "APPROVE";
   const securityClean = security.value === "PASS";
-  if (codeReviewClean && securityClean) {
+  const codeReviewBound = isBoundToHead(codeReview, input.headSha);
+  const securityBound = isBoundToHead(security, input.headSha);
+  if (codeReviewClean && codeReviewBound && securityClean && securityBound) {
     return {
       verdict: "pass",
-      reason: "code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS.",
+      reason: `code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS, both covering head ${input.headSha}.`,
       waived: false
     };
   }
   const problems = [];
-  if (!codeReviewClean)
+  if (!codeReviewClean) {
     problems.push(`code-reviewer verdict is not a clean APPROVE (found: ${codeReview.value})`);
-  if (!securityClean)
+  } else if (!codeReviewBound) {
+    problems.push(`the newest code-review verdict covers ${codeReview.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
+  if (!securityClean) {
     problems.push(`security-review verdict is not a clean PASS (found: ${security.value})`);
+  } else if (!securityBound) {
+    problems.push(`the newest security-review verdict covers ${security.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
   const ignoredNote = ignoredCount > 0 ? ` ${ignoredCount} verdict-shaped comment(s) from authors outside the principal allowlist were ignored.` : "";
   return {
     verdict: "fail",

package/dist/checks/bin/check-dispatch-readiness.js

@@ -2369,15 +2369,25 @@ function checkClosesN2(branch, prBody, trancheFiles, taskIssueRefs) {
   return { ok: true, expectedIssue };
 }
 // ../../packages/aeg-core/src/verdict-extraction.ts
+var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
+function extractHeadSha(comment) {
+  const m = comment.match(HEAD_SHA_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
 function extractVerdict(comments, valuePattern, missingLabel) {
   const clearHits = comments.filter((c) => valuePattern.test(c));
   if (clearHits.length > 0) {
     const latest = clearHits[clearHits.length - 1];
     const m = latest.match(valuePattern);
-    return { value: m[1].toUpperCase().replace(/[_-]/g, " "), danglingNote: null };
+    return {
+      value: m[1].toUpperCase().replace(/[_-]/g, " "),
+      headSha: extractHeadSha(latest),
+      danglingNote: null
+    };
   }
   return {
     value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
+    headSha: null,
     danglingNote: `no ${missingLabel} verdict comment found on this PR`
   };
 }
@@ -2391,6 +2401,11 @@ function extractSecurityReviewVerdict(comments) {
 function isReviewGateExemptBranch(branch) {
   return branch.startsWith("plan/");
 }
+function isBoundToHead(extraction, headSha) {
+  if (!extraction.headSha)
+    return false;
+  return headSha.toLowerCase().startsWith(extraction.headSha.toLowerCase());
+}
 function checkReviewGate(input) {
   const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const waived = isWaiverLabelActorVerified({
@@ -2413,18 +2428,26 @@ function checkReviewGate(input) {
   const security = extractSecurityReviewVerdict(verifiedBodies);
   const codeReviewClean = codeReview.value === "APPROVE";
   const securityClean = security.value === "PASS";
-  if (codeReviewClean && securityClean) {
+  const codeReviewBound = isBoundToHead(codeReview, input.headSha);
+  const securityBound = isBoundToHead(security, input.headSha);
+  if (codeReviewClean && codeReviewBound && securityClean && securityBound) {
     return {
       verdict: "pass",
-      reason: "code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS.",
+      reason: `code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS, both covering head ${input.headSha}.`,
       waived: false
     };
   }
   const problems = [];
-  if (!codeReviewClean)
+  if (!codeReviewClean) {
     problems.push(`code-reviewer verdict is not a clean APPROVE (found: ${codeReview.value})`);
-  if (!securityClean)
+  } else if (!codeReviewBound) {
+    problems.push(`the newest code-review verdict covers ${codeReview.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
+  if (!securityClean) {
     problems.push(`security-review verdict is not a clean PASS (found: ${security.value})`);
+  } else if (!securityBound) {
+    problems.push(`the newest security-review verdict covers ${security.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
   const ignoredNote = ignoredCount > 0 ? ` ${ignoredCount} verdict-shaped comment(s) from authors outside the principal allowlist were ignored.` : "";
   return {
     verdict: "fail",
@@ -3148,7 +3171,8 @@ var VinayaConfigSchema = z2.object({
   briefSchema: BriefSchemaSchema.optional(),
   managed: ManagedManifestSchema.optional(),
   principals: z2.array(z2.string()).min(1).optional(),
-  ci: z2.object({ setup: z2.string().min(1) }).optional()
+  ci: z2.object({ setup: z2.string().min(1) }).optional(),
+  blastRadius: z2.object({ extraDomains: z2.array(z2.string()).optional() }).optional()
 });
 var GLOBAL_VINAYA_HOME = join(homedir(), ".vinaya");
 var GLOBAL_CONFIG_PATH = join(GLOBAL_VINAYA_HOME, "config.json");

package/dist/checks/bin/check-doc-coverage-push.js

@@ -2369,15 +2369,25 @@ function checkClosesN2(branch, prBody, trancheFiles, taskIssueRefs) {
   return { ok: true, expectedIssue };
 }
 // ../../packages/aeg-core/src/verdict-extraction.ts
+var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
+function extractHeadSha(comment) {
+  const m = comment.match(HEAD_SHA_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
 function extractVerdict(comments, valuePattern, missingLabel) {
   const clearHits = comments.filter((c) => valuePattern.test(c));
   if (clearHits.length > 0) {
     const latest = clearHits[clearHits.length - 1];
     const m = latest.match(valuePattern);
-    return { value: m[1].toUpperCase().replace(/[_-]/g, " "), danglingNote: null };
+    return {
+      value: m[1].toUpperCase().replace(/[_-]/g, " "),
+      headSha: extractHeadSha(latest),
+      danglingNote: null
+    };
   }
   return {
     value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
+    headSha: null,
     danglingNote: `no ${missingLabel} verdict comment found on this PR`
   };
 }
@@ -2391,6 +2401,11 @@ function extractSecurityReviewVerdict(comments) {
 function isReviewGateExemptBranch(branch) {
   return branch.startsWith("plan/");
 }
+function isBoundToHead(extraction, headSha) {
+  if (!extraction.headSha)
+    return false;
+  return headSha.toLowerCase().startsWith(extraction.headSha.toLowerCase());
+}
 function checkReviewGate(input) {
   const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const waived = isWaiverLabelActorVerified({
@@ -2413,18 +2428,26 @@ function checkReviewGate(input) {
   const security = extractSecurityReviewVerdict(verifiedBodies);
   const codeReviewClean = codeReview.value === "APPROVE";
   const securityClean = security.value === "PASS";
-  if (codeReviewClean && securityClean) {
+  const codeReviewBound = isBoundToHead(codeReview, input.headSha);
+  const securityBound = isBoundToHead(security, input.headSha);
+  if (codeReviewClean && codeReviewBound && securityClean && securityBound) {
     return {
       verdict: "pass",
-      reason: "code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS.",
+      reason: `code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS, both covering head ${input.headSha}.`,
       waived: false
     };
   }
   const problems = [];
-  if (!codeReviewClean)
+  if (!codeReviewClean) {
     problems.push(`code-reviewer verdict is not a clean APPROVE (found: ${codeReview.value})`);
-  if (!securityClean)
+  } else if (!codeReviewBound) {
+    problems.push(`the newest code-review verdict covers ${codeReview.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
+  if (!securityClean) {
     problems.push(`security-review verdict is not a clean PASS (found: ${security.value})`);
+  } else if (!securityBound) {
+    problems.push(`the newest security-review verdict covers ${security.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
   const ignoredNote = ignoredCount > 0 ? ` ${ignoredCount} verdict-shaped comment(s) from authors outside the principal allowlist were ignored.` : "";
   return {
     verdict: "fail",
@@ -3149,7 +3172,8 @@ var VinayaConfigSchema = z.object({
   briefSchema: BriefSchemaSchema.optional(),
   managed: ManagedManifestSchema.optional(),
   principals: z.array(z.string()).min(1).optional(),
-  ci: z.object({ setup: z.string().min(1) }).optional()
+  ci: z.object({ setup: z.string().min(1) }).optional(),
+  blastRadius: z.object({ extraDomains: z.array(z.string()).optional() }).optional()
 });
 var GLOBAL_VINAYA_HOME = join(homedir(), ".vinaya");
 var GLOBAL_CONFIG_PATH = join(GLOBAL_VINAYA_HOME, "config.json");

package/dist/checks/bin/check-doc-coverage.js

@@ -2370,15 +2370,25 @@ function checkClosesN2(branch, prBody, trancheFiles, taskIssueRefs) {
   return { ok: true, expectedIssue };
 }
 // ../../packages/aeg-core/src/verdict-extraction.ts
+var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
+function extractHeadSha(comment) {
+  const m = comment.match(HEAD_SHA_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
 function extractVerdict(comments, valuePattern, missingLabel) {
   const clearHits = comments.filter((c) => valuePattern.test(c));
   if (clearHits.length > 0) {
     const latest = clearHits[clearHits.length - 1];
     const m = latest.match(valuePattern);
-    return { value: m[1].toUpperCase().replace(/[_-]/g, " "), danglingNote: null };
+    return {
+      value: m[1].toUpperCase().replace(/[_-]/g, " "),
+      headSha: extractHeadSha(latest),
+      danglingNote: null
+    };
   }
   return {
     value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
+    headSha: null,
     danglingNote: `no ${missingLabel} verdict comment found on this PR`
   };
 }
@@ -2392,6 +2402,11 @@ function extractSecurityReviewVerdict(comments) {
 function isReviewGateExemptBranch(branch) {
   return branch.startsWith("plan/");
 }
+function isBoundToHead(extraction, headSha) {
+  if (!extraction.headSha)
+    return false;
+  return headSha.toLowerCase().startsWith(extraction.headSha.toLowerCase());
+}
 function checkReviewGate(input) {
   const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const waived = isWaiverLabelActorVerified({
@@ -2414,18 +2429,26 @@ function checkReviewGate(input) {
   const security = extractSecurityReviewVerdict(verifiedBodies);
   const codeReviewClean = codeReview.value === "APPROVE";
   const securityClean = security.value === "PASS";
-  if (codeReviewClean && securityClean) {
+  const codeReviewBound = isBoundToHead(codeReview, input.headSha);
+  const securityBound = isBoundToHead(security, input.headSha);
+  if (codeReviewClean && codeReviewBound && securityClean && securityBound) {
     return {
       verdict: "pass",
-      reason: "code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS.",
+      reason: `code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS, both covering head ${input.headSha}.`,
       waived: false
     };
   }
   const problems = [];
-  if (!codeReviewClean)
+  if (!codeReviewClean) {
     problems.push(`code-reviewer verdict is not a clean APPROVE (found: ${codeReview.value})`);
-  if (!securityClean)
+  } else if (!codeReviewBound) {
+    problems.push(`the newest code-review verdict covers ${codeReview.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
+  if (!securityClean) {
     problems.push(`security-review verdict is not a clean PASS (found: ${security.value})`);
+  } else if (!securityBound) {
+    problems.push(`the newest security-review verdict covers ${security.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
   const ignoredNote = ignoredCount > 0 ? ` ${ignoredCount} verdict-shaped comment(s) from authors outside the principal allowlist were ignored.` : "";
   return {
     verdict: "fail",
@@ -3150,7 +3173,8 @@ var VinayaConfigSchema = z.object({
   briefSchema: BriefSchemaSchema.optional(),
   managed: ManagedManifestSchema.optional(),
   principals: z.array(z.string()).min(1).optional(),
-  ci: z.object({ setup: z.string().min(1) }).optional()
+  ci: z.object({ setup: z.string().min(1) }).optional(),
+  blastRadius: z.object({ extraDomains: z.array(z.string()).optional() }).optional()
 });
 var GLOBAL_VINAYA_HOME = join(homedir(), ".vinaya");
 var GLOBAL_CONFIG_PATH = join(GLOBAL_VINAYA_HOME, "config.json");

package/dist/checks/bin/check-evidence-fresh.js

@@ -2368,15 +2368,25 @@ function checkClosesN2(branch, prBody, trancheFiles, taskIssueRefs) {
   return { ok: true, expectedIssue };
 }
 // ../../packages/aeg-core/src/verdict-extraction.ts
+var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
+function extractHeadSha(comment) {
+  const m = comment.match(HEAD_SHA_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
 function extractVerdict(comments, valuePattern, missingLabel) {
   const clearHits = comments.filter((c) => valuePattern.test(c));
   if (clearHits.length > 0) {
     const latest = clearHits[clearHits.length - 1];
     const m = latest.match(valuePattern);
-    return { value: m[1].toUpperCase().replace(/[_-]/g, " "), danglingNote: null };
+    return {
+      value: m[1].toUpperCase().replace(/[_-]/g, " "),
+      headSha: extractHeadSha(latest),
+      danglingNote: null
+    };
   }
   return {
     value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
+    headSha: null,
     danglingNote: `no ${missingLabel} verdict comment found on this PR`
   };
 }
@@ -2390,6 +2400,11 @@ function extractSecurityReviewVerdict(comments) {
 function isReviewGateExemptBranch(branch) {
   return branch.startsWith("plan/");
 }
+function isBoundToHead(extraction, headSha) {
+  if (!extraction.headSha)
+    return false;
+  return headSha.toLowerCase().startsWith(extraction.headSha.toLowerCase());
+}
 function checkReviewGate(input) {
   const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const waived = isWaiverLabelActorVerified({
@@ -2412,18 +2427,26 @@ function checkReviewGate(input) {
   const security = extractSecurityReviewVerdict(verifiedBodies);
   const codeReviewClean = codeReview.value === "APPROVE";
   const securityClean = security.value === "PASS";
-  if (codeReviewClean && securityClean) {
+  const codeReviewBound = isBoundToHead(codeReview, input.headSha);
+  const securityBound = isBoundToHead(security, input.headSha);
+  if (codeReviewClean && codeReviewBound && securityClean && securityBound) {
     return {
       verdict: "pass",
-      reason: "code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS.",
+      reason: `code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS, both covering head ${input.headSha}.`,
       waived: false
     };
   }
   const problems = [];
-  if (!codeReviewClean)
+  if (!codeReviewClean) {
     problems.push(`code-reviewer verdict is not a clean APPROVE (found: ${codeReview.value})`);
-  if (!securityClean)
+  } else if (!codeReviewBound) {
+    problems.push(`the newest code-review verdict covers ${codeReview.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
+  if (!securityClean) {
     problems.push(`security-review verdict is not a clean PASS (found: ${security.value})`);
+  } else if (!securityBound) {
+    problems.push(`the newest security-review verdict covers ${security.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
   const ignoredNote = ignoredCount > 0 ? ` ${ignoredCount} verdict-shaped comment(s) from authors outside the principal allowlist were ignored.` : "";
   return {
     verdict: "fail",