@attalabs/vinaya 0.12.0 → 0.16.0

package/dist/index.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync19 } from "node:fs";
-import { dirname as dirname8, join as join21 } from "node:path";
+import { readFileSync as readFileSync20 } from "node:fs";
+import { dirname as dirname8, join as join22 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/commands/archive.ts
-import { execFileSync as execFileSync3 } from "node:child_process";
+import { execFileSync as execFileSync4 } from "node:child_process";
 // ../../packages/aeg-forge-state/src/strip-code.ts
 function maskCode(body) {
   const fill = (line) => " ".repeat(line.length);
@@ -392,6 +392,85 @@ function splitTableRow(row) {
     parts.pop();
   return parts.map((p) => p.split(PLACEHOLDER).join("|"));
 }
+// ../../packages/aeg-core/src/blast-radius-domains.ts
+function resolveWorkspaceEntry(entry2, listDirs) {
+  if (entry2.endsWith("/*")) {
+    const baseDir = entry2.slice(0, -2);
+    return listDirs(baseDir).map((name) => `${baseDir}/${name}`);
+  }
+  if (entry2.includes("*"))
+    return [];
+  return [entry2];
+}
+function deriveWorkspacePackageDomains(workspaces, listDirs) {
+  const positive = workspaces.filter((entry2) => !entry2.startsWith("!"));
+  const negative = workspaces.filter((entry2) => entry2.startsWith("!")).map((entry2) => entry2.slice(1));
+  const excluded = new Set;
+  for (const entry2 of negative) {
+    for (const member of resolveWorkspaceEntry(entry2, listDirs))
+      excluded.add(member);
+  }
+  const domains = new Set;
+  for (const entry2 of positive) {
+    for (const member of resolveWorkspaceEntry(entry2, listDirs)) {
+      if (excluded.has(member))
+        continue;
+      const segments = member.split("/");
+      if (segments[0] !== "packages" || segments.length < 2)
+        continue;
+      domains.add(`packages/${segments[1]}`);
+    }
+  }
+  return [...domains].sort();
+}
+function parsePnpmWorkspaceYaml(content) {
+  const unquote = (s) => {
+    const t = s.trim();
+    if (t.length >= 2 && (t[0] === "'" && t.at(-1) === "'" || t[0] === '"' && t.at(-1) === '"')) {
+      return t.slice(1, -1);
+    }
+    return t;
+  };
+  const inlineMatch = content.match(/^packages:\s*\[(.*)\]\s*$/m);
+  if (inlineMatch) {
+    return (inlineMatch[1] ?? "").split(",").map(unquote).filter((s) => s.length > 0);
+  }
+  const entries = [];
+  let inBlock = false;
+  for (const rawLine of content.split(`
+`)) {
+    const line = rawLine.replace(/#.*$/, "");
+    if (/^packages:\s*$/.test(line)) {
+      inBlock = true;
+      continue;
+    }
+    if (!inBlock)
+      continue;
+    const itemMatch = line.match(/^\s+-\s*(.+?)\s*$/);
+    if (itemMatch?.[1]) {
+      entries.push(unquote(itemMatch[1]));
+      continue;
+    }
+    if (line.trim().length === 0)
+      continue;
+    break;
+  }
+  return entries;
+}
+var CROSS_CUTTING_CANDIDATES = [
+  "bun.lock",
+  "package-lock.json",
+  "pnpm-lock.yaml",
+  "yarn.lock",
+  "turbo.json",
+  "biome.json",
+  "tsconfig.json",
+  ".github/workflows",
+  ".husky"
+];
+function deriveBuiltinCrossCuttingDefaults(exists) {
+  return CROSS_CUTTING_CANDIDATES.filter((path) => exists(path));
+}
 // ../../packages/aeg-core/src/state-machine-model.ts
 var FORGE_FACT_INPUTS = [
   {
@@ -457,12 +536,30 @@ var DERIVED_STATUSES = [
   "incoherent"
 ];
 var DERIVABLE_STATUSES = DERIVED_STATUSES.filter((s) => s !== "backlog");
+// ../../packages/aeg-core/src/file-classify.ts
+function isCodeFile(p) {
+  if (p.endsWith(".md"))
+    return false;
+  return /\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs|sql|css)$/.test(p);
+}
 // ../../packages/aeg-core/src/waiver-label.ts
 var WAIVER_LABEL = label("waiver-docs");
 var WAIVER_LABEL_REVIEW = label("waiver-review");
+var PRINCIPAL_ALLOWLIST = ["daniboomerang"];
+function isPrincipal(login, principalAllowlist) {
+  if (login === null)
+    return false;
+  const normalized = login.toLowerCase();
+  return principalAllowlist.some((p) => p.toLowerCase() === normalized);
+}
 
 // ../../packages/aeg-core/src/doc-owners.ts
 var DOC_OWNERS_PATH = ".vinaya/doc-owners";
+function classifyDocOwnersManifest(content) {
+  if (content === null)
+    return "absent";
+  return content.trim() === "" ? "empty" : "present";
+}
 function parseDocOwners(content) {
   const bindings = [];
   const errors = [];
@@ -507,6 +604,13 @@ function globToRegex(pat) {
   re += "$";
   return new RegExp(re);
 }
+function isUrlPointer(p) {
+  return /^https?:\/\//.test(p);
+}
+function pointerToPath(p) {
+  const idx = p.indexOf("#");
+  return idx === -1 ? p : p.slice(0, idx);
+}
 var SEPARATOR = /(?:[ \t]*[—–][ \t]*|[ \t]+-[ \t]+)/.source;
 // ../../packages/aeg-core/src/pr-tier.ts
 function readTierFromPrBody(prBody) {
@@ -793,15 +897,25 @@ function isTaskIssueLabelSet(labels) {
 // ../../packages/aeg-core/src/coherence-checks.ts
 var R1_GRANDFATHERED_ISSUES = new Set([279, 280, 281, 282]);
 // ../../packages/aeg-core/src/verdict-extraction.ts
+var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
+function extractHeadSha(comment) {
+  const m = comment.match(HEAD_SHA_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
 function extractVerdict(comments, valuePattern, missingLabel) {
   const clearHits = comments.filter((c) => valuePattern.test(c));
   if (clearHits.length > 0) {
     const latest = clearHits[clearHits.length - 1];
     const m = latest.match(valuePattern);
-    return { value: m[1].toUpperCase().replace(/[_-]/g, " "), danglingNote: null };
+    return {
+      value: m[1].toUpperCase().replace(/[_-]/g, " "),
+      headSha: extractHeadSha(latest),
+      danglingNote: null
+    };
   }
   return {
     value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
+    headSha: null,
     danglingNote: `no ${missingLabel} verdict comment found on this PR`
   };
 }
@@ -1536,6 +1650,14 @@ function starterDocOwners() {
 #   This file absent, OR no glob matches any changed code file → silent no-op.
 #   The gate has no opinion until you teach it one.
 #
+# \`vinaya doctor\` (never \`vinaya check\`) separately reports — it does not
+# fail the check — any binding whose code glob matches zero tracked files
+# anywhere in the repo, or whose in-repo pointer doesn't exist on disk. This
+# catches what the dormancy rule above structurally cannot: a glob matching
+# nothing trivially satisfies "no changed file matched" on every diff,
+# forever, so a binding naming deleted or renamed code reads as healthy
+# indefinitely unless something walks the whole repo, not just one diff.
+#
 # ── No-doc allow-list ───────────────────────────────────────────────────────
 # Surfaces that legitimately need no bound doc are listed below. Format:
 #   # no-doc: <glob> — <reason>
@@ -1668,11 +1790,12 @@ function buildInitProductOps(name) {
 }
 
 // src/lib/ops.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
+import { execFileSync as execFileSync3 } from "node:child_process";
 import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname3, isAbsolute, join as join4, resolve, sep } from "node:path";
 
 // src/lib/config.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname as dirname2, join as join3 } from "node:path";
@@ -1800,7 +1923,8 @@ var VinayaConfigSchema = z.object({
   briefSchema: BriefSchemaSchema.optional(),
   managed: ManagedManifestSchema.optional(),
   principals: z.array(z.string()).min(1).optional(),
-  ci: z.object({ setup: z.string().min(1) }).optional()
+  ci: z.object({ setup: z.string().min(1) }).optional(),
+  blastRadius: z.object({ extraDomains: z.array(z.string()).optional() }).optional()
 });
 var GLOBAL_VINAYA_HOME = join3(homedir(), ".vinaya");
 var GLOBAL_CONFIG_PATH = join3(GLOBAL_VINAYA_HOME, "config.json");
@@ -1847,6 +1971,75 @@ function stripGlobalOnlyKeys(config, path) {
   }
   return result;
 }
+function resolvePrincipalAllowlist(config) {
+  return config?.principals ?? PRINCIPAL_ALLOWLIST;
+}
+function trustAnchorRepo() {
+  const wellFormed = (slug) => /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
+  const fromRunner = process.env.GITHUB_REPOSITORY?.trim();
+  if (fromRunner) {
+    const validated = wellFormed(fromRunner);
+    if (validated)
+      return validated;
+  }
+  try {
+    const url = execFileSync2("git", ["remote", "get-url", "origin"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+    const m = url.match(/github\.com[:/]([^/]+)\/(.+?)(?:\.git)?\/?$/);
+    return m?.[1] && m[2] ? wellFormed(`${m[1]}/${m[2]}`) : null;
+  } catch {
+    return null;
+  }
+}
+function ghFetchTrustAnchorConfig() {
+  const repo = trustAnchorRepo();
+  if (!repo)
+    throw new Error("could not resolve repo identity for the trust-anchor read");
+  return execFileSync2("gh", ["api", `repos/${repo}/contents/${LOCAL_CONFIG_FILENAME}`, "--jq", ".content"], {
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+}
+function firstLine(err) {
+  return err?.message?.split(`
+`)[0] ?? "unknown error";
+}
+function isMissingFileError(err) {
+  const stderr = err?.stderr;
+  const haystack = [
+    err?.message ?? "",
+    typeof stderr === "string" ? stderr : stderr?.toString() ?? ""
+  ].join(`
+`);
+  return /\b404\b|not found/i.test(haystack);
+}
+function loadTrustAnchorConfig(fetcher = ghFetchTrustAnchorConfig) {
+  const warn = (why) => process.stdout.write(`⚠ could not read \`principals\` from the default branch (${why}) — falling back to vinaya's built-in principal allowlist.
+`);
+  let base64;
+  try {
+    base64 = fetcher().trim();
+  } catch (err) {
+    if (!isMissingFileError(err))
+      warn(firstLine(err));
+    return null;
+  }
+  if (!base64)
+    return null;
+  try {
+    const raw = Buffer.from(base64, "base64").toString("utf-8");
+    const parsed = VinayaConfigSchema.safeParse(JSON.parse(raw));
+    if (parsed.success)
+      return parsed.data;
+    warn("it did not satisfy the config schema");
+    return null;
+  } catch {
+    warn("it was not readable as JSON");
+    return null;
+  }
+}
 function readRepoCiSetup(repoRoot) {
   const p = join3(repoRoot, "vinaya.config.json");
   if (!existsSync2(p))
@@ -1897,7 +2090,7 @@ function resolveManagedBlockPath(repoRoot, opPath) {
   if (!opPath.startsWith(".git/"))
     return join4(repoRoot, opPath);
   try {
-    const commonDir = execFileSync2("git", ["-C", repoRoot, "rev-parse", "--git-common-dir"], {
+    const commonDir = execFileSync3("git", ["-C", repoRoot, "rev-parse", "--git-common-dir"], {
       encoding: "utf8"
     }).trim();
     const gitDir = isAbsolute(commonDir) ? commonDir : join4(repoRoot, commonDir);
@@ -2463,7 +2656,7 @@ function realDeps() {
   return { detectRepo: detectGitRepo };
 }
 function sh(args, input) {
-  return execFileSync3(args[0], args.slice(1), { encoding: "utf8", input }).trim();
+  return execFileSync4(args[0], args.slice(1), { encoding: "utf8", input }).trim();
 }
 function shJson(args) {
   return JSON.parse(sh(args));
@@ -2639,7 +2832,7 @@ async function archiveTrancheCommand(args) {
 }
 
 // src/commands/audit.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
+import { execFileSync as execFileSync5 } from "node:child_process";
 
 // src/lib/envelope.ts
 var ENVELOPE_SCHEMA_VERSION = 1;
@@ -2667,7 +2860,7 @@ var DIRECT_PUSH_MARKER = `<!-- ${DIRECT_PUSH_LABEL} -->`;
 var DIRECT_PUSH_LABEL_DESCRIPTION = "A commit landed on main with no associated merged PR (ring-2 detection)";
 function shSoft(args, input) {
   try {
-    return execFileSync4(args[0], args.slice(1), {
+    return execFileSync5(args[0], args.slice(1), {
       encoding: "utf8",
       input,
       timeout: COMMAND_TIMEOUT_MS
@@ -2691,7 +2884,7 @@ function shSoftJson(args) {
   }
 }
 function sh2(args, input) {
-  return execFileSync4(args[0], args.slice(1), { encoding: "utf8", input }).trim();
+  return execFileSync5(args[0], args.slice(1), { encoding: "utf8", input }).trim();
 }
 function listTaskBranches() {
   const out = shSoft(["git", "ls-remote", "--heads", "origin", "task/*"]);
@@ -2941,7 +3134,7 @@ async function auditCommand(args) {
 }
 
 // src/commands/check.ts
-import { execFileSync as execFileSync5 } from "node:child_process";
+import { execFileSync as execFileSync6 } from "node:child_process";
 
 // src/checks/contract.ts
 var CHECK_SCHEMA_VERSION = 1;
@@ -3478,7 +3671,7 @@ async function runChecks(specs, opts) {
 // src/commands/check.ts
 function git(args) {
   try {
-    return execFileSync5("git", args, { encoding: "utf8" }).trim();
+    return execFileSync6("git", args, { encoding: "utf8" }).trim();
   } catch {
     return "";
   }
@@ -3611,11 +3804,13 @@ async function checkCommand(args) {
       process.stdout.write(`${renderPlanTable(result)}
 `);
     }
-    process.exit(result.failures.length > 0 ? 1 : 0);
+    process.exitCode = result.failures.length > 0 ? 1 : 0;
+    return;
   }
   if (!allRequested && !requestedName) {
     console.error("Usage: vinaya check <name> | --all | --plan [--json] [--diff-only] [--local] [--parallel[=n]]");
-    process.exit(2);
+    process.exitCode = 2;
+    return;
   }
   if (refusals.length > 0) {
     const outcome = {
@@ -3636,7 +3831,8 @@ async function checkCommand(args) {
         process.stdout.write(`    ${e.severity}: ${e.message}
 `);
     }
-    process.exit(1);
+    process.exitCode = 1;
+    return;
   }
   const allSpecs = result.resolved.map((entry2) => entry2.spec);
   const notices = substitutionNotices(result.resolved);
@@ -3650,7 +3846,8 @@ async function checkCommand(args) {
   const specsToRun = allRequested ? allSpecs.filter(runsUnderAll) : allSpecs.filter((s) => s.name === requestedName);
   if (!allRequested && specsToRun.length === 0) {
     console.error(`Unknown check: ${requestedName}`);
-    process.exit(2);
+    process.exitCode = 2;
+    return;
   }
   const changed = diffOnly ? changedFiles() : null;
   const outcomes = specsToRun.length > 0 ? await runChecks(specsToRun, {
@@ -3677,18 +3874,18 @@ async function checkCommand(args) {
     }
   }
   const failed = outcomes.some((o) => o.status === "fail" || o.status === "error" || o.status === "timeout");
-  process.exit(failed ? 1 : 0);
+  process.exitCode = failed ? 1 : 0;
 }
 
 // src/commands/demo.ts
-import { execFileSync as execFileSync6, spawnSync } from "node:child_process";
+import { execFileSync as execFileSync7, spawnSync } from "node:child_process";
 import { existsSync as existsSync6, readFileSync as readFileSync5, rmSync as rmSync2, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
 import { isAbsolute as isAbsolute2, join as join7 } from "node:path";
 var DEMO_BRANCH_PREFIX = "vinaya/demo-break-";
 var FIXTURE_PATH = ".vinaya-demo-brief.md";
 var STATE_FILENAME = "vinaya-demo-state.json";
 function gitCapture(repoRoot, args) {
-  return execFileSync6("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+  return execFileSync7("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 function currentBranchName(repoRoot) {
   try {
@@ -3699,7 +3896,7 @@ function currentBranchName(repoRoot) {
 }
 function branchExists(repoRoot, name) {
   try {
-    execFileSync6("git", ["rev-parse", "--verify", "--quiet", `refs/heads/${name}`], {
+    execFileSync7("git", ["rev-parse", "--verify", "--quiet", `refs/heads/${name}`], {
       cwd: repoRoot,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -3901,7 +4098,8 @@ async function demoBreakCommand(args) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync8, readFileSync as readFileSync8, statSync as statSync2 } from "node:fs";
+import { execFileSync as execFileSync8 } from "node:child_process";
+import { existsSync as existsSync8, readdirSync as readdirSync3, readFileSync as readFileSync8, statSync as statSync2 } from "node:fs";
 import { join as join9 } from "node:path";
 
 // src/lib/self-host.ts
@@ -4182,6 +4380,90 @@ function diagnoseCustomChecks(repoRoot, config) {
   }
   return findings;
 }
+function listTrackedFiles(repoRoot) {
+  try {
+    return execFileSync8("git", ["ls-files"], { cwd: repoRoot, encoding: "utf-8" }).split(`
+`).map((s) => s.trim()).filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+function diagnoseDocOwnersHealth(repoRoot) {
+  const path = join9(repoRoot, DOC_OWNERS_PATH);
+  const content = existsSync8(path) ? readFileSync8(path, "utf-8") : null;
+  const state = classifyDocOwnersManifest(content);
+  if (state === "absent" || state === "empty")
+    return [];
+  const { bindings } = parseDocOwners(content);
+  if (bindings.length === 0)
+    return [];
+  const codeFiles = listTrackedFiles(repoRoot).filter(isCodeFile);
+  const findings = [];
+  for (const b of bindings) {
+    let flagged = false;
+    const re = globToRegex(b.glob);
+    if (!codeFiles.some((f) => re.test(f))) {
+      flagged = true;
+      findings.push(warn("doc-owners", `${DOC_OWNERS_PATH}:${b.lineNum} binds glob '${b.glob}', which matches none of the ${codeFiles.length} ` + "tracked code file(s) in this repo — the code it names may have been deleted, renamed, or never " + "existed. Repoint the binding to the code's new location, or remove it."));
+    }
+    if (!isUrlPointer(b.pointer)) {
+      const pointerPath = join9(repoRoot, pointerToPath(b.pointer));
+      if (!existsSync8(pointerPath)) {
+        flagged = true;
+        findings.push(warn("doc-owners", `${DOC_OWNERS_PATH}:${b.lineNum} points to ${b.pointer}, which does not exist on disk. Repoint the ` + "binding, or add the missing doc."));
+      }
+    }
+    if (!flagged) {
+      findings.push(ok("doc-owners", `${DOC_OWNERS_PATH}:${b.lineNum} — '${b.glob}' → ${b.pointer} is live.`));
+    }
+  }
+  return findings;
+}
+var LEGACY_AEG_PACKAGES_PATH = ".aeg/packages";
+function readWorkspacesForDoctor(repoRoot) {
+  const fromPackageJson = () => {
+    try {
+      const pkg = JSON.parse(readFileSync8(join9(repoRoot, "package.json"), "utf-8"));
+      return Array.isArray(pkg.workspaces) ? pkg.workspaces.filter((w) => typeof w === "string") : [];
+    } catch {
+      return [];
+    }
+  };
+  const fromPnpmWorkspaceYaml = () => {
+    try {
+      return parsePnpmWorkspaceYaml(readFileSync8(join9(repoRoot, "pnpm-workspace.yaml"), "utf-8"));
+    } catch {
+      return [];
+    }
+  };
+  return [...fromPackageJson(), ...fromPnpmWorkspaceYaml()];
+}
+function listChildDirsForDoctor(dir, repoRoot) {
+  try {
+    return readdirSync3(join9(repoRoot, dir), { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    return [];
+  }
+}
+function diagnoseBlastRadiusDeprecation(repoRoot, config) {
+  const derived = deriveWorkspacePackageDomains(readWorkspacesForDoctor(repoRoot), (dir) => listChildDirsForDoctor(dir, repoRoot));
+  const defaults = deriveBuiltinCrossCuttingDefaults((p) => existsSync8(join9(repoRoot, p)));
+  const covered = new Set([...derived, ...defaults]);
+  const configExtra = new Set(config?.blastRadius?.extraDomains ?? []);
+  const legacyPath = join9(repoRoot, LEGACY_AEG_PACKAGES_PATH);
+  if (!existsSync8(legacyPath)) {
+    return [
+      info("blast-radius", `checkBlastRadiusScope is active via live derivation (${derived.length} packages/* domain(s)) + built-in defaults (${defaults.length} present) — no ${LEGACY_AEG_PACKAGES_PATH}, and the check is not dormant.`)
+    ];
+  }
+  const legacyEntries = readFileSync8(legacyPath, "utf-8").split(`
+`).map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith("#"));
+  const uncovered = legacyEntries.filter((e) => !covered.has(e) && !configExtra.has(e));
+  const migrationNote = uncovered.length === 0 ? "every entry is already covered by live derivation, the built-in defaults, or vinaya.config.json blastRadius.extraDomains — the file can be deleted." : `migrate ${uncovered.length} entr${uncovered.length === 1 ? "y" : "ies"} not yet covered before deleting it: ${uncovered.join(", ")}.`;
+  return [
+    warn("blast-radius", `${LEGACY_AEG_PACKAGES_PATH} is deprecated — checkBlastRadiusScope now derives packages/* domains live and ships built-in cross-cutting defaults. Declare anything beyond those in vinaya.config.json's blastRadius.extraDomains instead. ${migrationNote}`)
+  ];
+}
 function diagnoseEnvDeclarations(repoRoot, config) {
   const resolved = resolveChecks(coreCheckRegistry(), config?.checks).resolved;
   const specs = resolved.map((entry2) => entry2.source === "config" ? { ...entry2.spec, run: join9(repoRoot, entry2.spec.run) } : entry2.spec);
@@ -4242,6 +4524,29 @@ async function diagnoseBranchProtection(deps, owner, repo) {
   }
   return info("branch-protection", "main branch protection could not be determined (no gh auth, no remote, or a permission gap).");
 }
+var TEST_INVOCATION_SUBSTRINGS = ["npm test", "npm run test", "bun test", "bunx turbo test"];
+function diagnoseTestCi(repoRoot) {
+  let pkg;
+  try {
+    pkg = JSON.parse(readFileSync8(join9(repoRoot, "package.json"), "utf-8"));
+  } catch {
+    return [];
+  }
+  const testScript = pkg?.scripts?.test;
+  if (typeof testScript !== "string" || testScript.trim() === "")
+    return [];
+  const workflowsDir = join9(repoRoot, ".github/workflows");
+  const files = existsSync8(workflowsDir) ? readdirSync3(workflowsDir).filter((name) => statSync2(join9(workflowsDir, name)).isFile()) : [];
+  const invoked = files.some((name) => {
+    const content = readFileSync8(join9(workflowsDir, name), "utf-8");
+    return TEST_INVOCATION_SUBSTRINGS.some((s) => content.includes(s));
+  });
+  if (invoked)
+    return [];
+  return [
+    warn("test-ci", "no workflow under .github/workflows/ appears to invoke this repo's `package.json` test script — " + "vinaya requires a Test Plan on every PR and enforces it as a blocking gate, but nothing here verifies that tests actually run.")
+  ];
+}
 function symbolFor(severity) {
   switch (severity) {
     case "ok":
@@ -4295,12 +4600,15 @@ async function runDoctor(args, deps) {
     hasDrift = install.hasDrift;
     findings.push(...await diagnoseHookRouting(repo.repoRoot, hookDir, deps.readHooksPath));
     findings.push(...diagnoseCustomChecks(repo.repoRoot, configRead.config));
+    findings.push(...diagnoseDocOwnersHealth(repo.repoRoot));
   }
+  findings.push(...diagnoseBlastRadiusDeprecation(repo.repoRoot, configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseEnvDeclarations(repo.repoRoot, configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseCheckClassification(configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseGlobalConfigChecks());
   findings.push(...await diagnoseEnvironment(deps, hasDrift));
   findings.push(await diagnoseBranchProtection(deps, repo.owner, repo.repo));
+  findings.push(...diagnoseTestCi(repo.repoRoot));
   const healthy = findings.every((f) => f.severity === "ok" || f.severity === "info");
   if (jsonOutput) {
     printJson({ healthy, findings });
@@ -4314,7 +4622,7 @@ async function doctorCommand(args) {
 }
 
 // src/commands/doctrine.ts
-import { existsSync as existsSync9 } from "node:fs";
+import { existsSync as existsSync9, readdirSync as readdirSync4 } from "node:fs";
 import { dirname as dirname4, join as join10, sep as sep3 } from "node:path";
 var ENTRY_SEGMENTS = ["skills", "aeg", "SKILL.md"];
 function resolveDoctrineRoot(pkg = packageRoot(import.meta.url)) {
@@ -4327,6 +4635,12 @@ function resolveDoctrineRoot(pkg = packageRoot(import.meta.url)) {
   }
   return null;
 }
+function listRoleNames(root) {
+  const rolesDir = join10(root, "roles");
+  if (!existsSync9(rolesDir))
+    return [];
+  return readdirSync4(rolesDir).filter((name) => name.endsWith(".md")).map((name) => name.slice(0, -".md".length)).sort();
+}
 function doctrineCommand(args) {
   const root = resolveDoctrineRoot();
   if (root === null) {
@@ -4334,6 +4648,24 @@ function doctrineCommand(args) {
 `);
     process.exit(1);
   }
+  const roleFlagIndex = args.indexOf("--role");
+  if (roleFlagIndex !== -1) {
+    const roleName = args[roleFlagIndex + 1];
+    const validRoleNames = listRoleNames(root);
+    if (roleName === undefined || roleName.startsWith("--") || !validRoleNames.includes(roleName)) {
+      process.stderr.write(`vinaya doctrine --role: '${roleName ?? ""}' is not a known role. ` + `Valid role names: ${validRoleNames.join(", ")}
+`);
+      process.exit(1);
+    }
+    const entry3 = join10(root, "roles", `${roleName}.md`);
+    if (args.includes("--json")) {
+      printJson({ root, entry: entry3 });
+      return;
+    }
+    process.stdout.write(`${entry3}
+`);
+    return;
+  }
   const entry2 = join10(root, ...ENTRY_SEGMENTS);
   if (args.includes("--json")) {
     printJson({ root, entry: entry2 });
@@ -4750,7 +5082,7 @@ async function initProductCommand(args) {
 }
 
 // src/commands/issue.ts
-import { execFileSync as execFileSync7 } from "node:child_process";
+import { execFileSync as execFileSync9 } from "node:child_process";
 
 // src/lib/forge-write.ts
 import { mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "node:fs";
@@ -4973,7 +5305,7 @@ function locateBodyOrRefuse(ghArgs, retryCommand) {
 function fetchForgeLabels(issueRef) {
   let out;
   try {
-    out = execFileSync7("gh", ["issue", "view", issueRef, "--json", "labels"], {
+    out = execFileSync9("gh", ["issue", "view", issueRef, "--json", "labels"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -5001,7 +5333,7 @@ function reportPass(json, command) {
 function runGhWrite(ghCmd, ghArgs, bodyResult, json) {
   const { finalArgs, cleanup: cleanup2 } = resolveShippableArgs(ghArgs, bodyResult);
   try {
-    const out = execFileSync7("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
+    const out = execFileSync9("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
     const url = out.trim();
     if (json)
       printJson({ validated: true, written: true, url });
@@ -5115,12 +5447,12 @@ ${registration}
 }
 
 // src/commands/pr.ts
-import { execFileSync as execFileSync8 } from "node:child_process";
+import { execFileSync as execFileSync10 } from "node:child_process";
 var RETRY_CREATE2 = "vinaya pr create --validate-only …";
 var RETRY_EDIT2 = "vinaya pr edit <n> --validate-only …";
 function git2(args) {
   try {
-    return execFileSync8("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync10("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return "";
   }
@@ -5154,7 +5486,7 @@ function reportPass2(json, command) {
 function runGhWrite2(ghCmd, ghArgs, bodyResult, json) {
   const { finalArgs, cleanup: cleanup2 } = resolveShippableArgs(ghArgs, bodyResult);
   try {
-    const out = execFileSync8("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
+    const out = execFileSync10("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
     const url = out.trim();
     if (json)
       printJson({ validated: true, written: true, url });
@@ -5168,7 +5500,7 @@ function runGhWrite2(ghCmd, ghArgs, bodyResult, json) {
 function fetchPrForgeContext(prRef) {
   let viewOut;
   try {
-    viewOut = execFileSync8("gh", ["pr", "view", prRef, "--json", "headRefName,files"], {
+    viewOut = execFileSync10("gh", ["pr", "view", prRef, "--json", "headRefName,files"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -5270,14 +5602,14 @@ function prEditCommand(args) {
 }
 
 // src/commands/pr-report.ts
-import { execFileSync as execFileSync9, spawnSync as spawnSync2 } from "node:child_process";
+import { execFileSync as execFileSync11, spawnSync as spawnSync2 } from "node:child_process";
 import { existsSync as existsSync14, readFileSync as readFileSync14, writeFileSync as writeFileSync8 } from "node:fs";
 import { join as join16 } from "node:path";
 var EVIDENCE_START = "<!-- AEG:EVIDENCE:START -->";
 var EVIDENCE_END = "<!-- AEG:EVIDENCE:END -->";
 function git3(args) {
   try {
-    return execFileSync9("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync11("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return "";
   }
@@ -5295,7 +5627,7 @@ class GitCommandError extends Error {
 }
 function gitStrict(args) {
   try {
-    return execFileSync9("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync11("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (err) {
     const stderr = err.stderr;
     throw new GitCommandError(args, String(stderr ?? err.message).trim() || "non-zero exit");
@@ -5449,7 +5781,7 @@ async function prReportCommand(args) {
 }
 
 // src/commands/quickstart.ts
-import { execFileSync as execFileSync10 } from "node:child_process";
+import { execFileSync as execFileSync12 } from "node:child_process";
 import { existsSync as existsSync16, readFileSync as readFileSync16 } from "node:fs";
 import { join as join18 } from "node:path";
 
@@ -5645,7 +5977,7 @@ function realDeps6() {
   };
 }
 function execGit(repoRoot, args) {
-  return execFileSync10("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+  return execFileSync12("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 function errorDetail(err) {
   const stderr = err.stderr;
@@ -5761,11 +6093,331 @@ async function quickstartCommand(args) {
   process.exit(await runQuickstart(args, realDeps6()));
 }
 
+// src/commands/review-post.ts
+import { execFileSync as execFileSync13 } from "node:child_process";
+import { readFileSync as readFileSync17, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join19 } from "node:path";
+class FindingsParseError extends Error {
+}
+var CODE_REVIEW_SEVERITIES = ["BLOCKER", "MAJOR", "MINOR"];
+var SECURITY_SEVERITIES = ["CRITICAL", "HIGH", "MEDIUM", "LOW"];
+function parseFindingsFile(content, allowedSeverities) {
+  const lines = content.split(`
+`).map((l) => l.trim()).filter((l) => l.length > 0);
+  return lines.map((line, idx) => {
+    const parts = line.split("|");
+    if (parts.length !== 3) {
+      throw new FindingsParseError(`findings file line ${idx + 1}: expected exactly 3 \`|\`-delimited fields (SEVERITY|file:line|description), found ${parts.length}: ${line}`);
+    }
+    const severity = parts[0].trim().toUpperCase();
+    const location = parts[1].trim();
+    const description = parts[2].trim();
+    if (!allowedSeverities.includes(severity)) {
+      throw new FindingsParseError(`findings file line ${idx + 1}: severity "${parts[0]}" is not one of ${allowedSeverities.join("|")}: ${line}`);
+    }
+    if (!location || !description) {
+      throw new FindingsParseError(`findings file line ${idx + 1}: file:line and description must both be non-empty: ${line}`);
+    }
+    return { severity, location, description };
+  });
+}
+function sortBySeverity(findings, order) {
+  return findings.map((f, i) => ({ f, i })).sort((a, b) => order.indexOf(a.f.severity) - order.indexOf(b.f.severity) || a.i - b.i).map(({ f }) => f);
+}
+function renderFindingsSection(findings) {
+  if (findings.length === 0)
+    return "None.";
+  return findings.map((f, i) => `${i + 1}. [${f.severity}] ${f.location} — ${f.description}`).join(`
+`);
+}
+function renderTokensLine(role, roleLabel, input) {
+  return `Tokens: ${input.taskId}: ${role} — ${roleLabel} — ${input.model} — ${input.tokensIn}/${input.tokensOut}/${input.cost}`;
+}
+var CODE_REVIEW_VERDICT_TEXT = {
+  APPROVE: "APPROVE",
+  REQUEST_CHANGES: "REQUEST CHANGES"
+};
+function renderCodeReviewComment(input) {
+  const sorted = sortBySeverity(input.findings, CODE_REVIEW_SEVERITIES);
+  return [
+    `VERDICT: ${CODE_REVIEW_VERDICT_TEXT[input.verdict]}`,
+    "",
+    `Judged head: ${input.headSha}`,
+    "",
+    `BRIEF CONFORMANCE: ${input.briefConformance}`,
+    `SPEC CONFORMANCE: ${input.specConformance}`,
+    "",
+    "FINDINGS (ordered by severity):",
+    renderFindingsSection(sorted),
+    "",
+    `SCOPE: ${input.scope}`,
+    `TESTS: ${input.tests}`,
+    `DOCS: ${input.docs}`,
+    "",
+    renderTokensLine("review", "Reviewer", input)
+  ].join(`
+`);
+}
+function isNoneFoundClaim(value) {
+  return value.trim().toLowerCase().replace(/[-_]+/g, " ").replace(/\s+/g, " ") === "none found";
+}
+function renderSecurityComment(input) {
+  const sorted = sortBySeverity(input.findings, SECURITY_SEVERITIES);
+  const lines = [
+    `VERDICT: ${input.verdict}`,
+    "",
+    `Judged head: ${input.headSha}`,
+    "",
+    "FINDINGS (ordered by severity):",
+    renderFindingsSection(sorted),
+    "",
+    `CONFIG SCAN: ${input.configScan}`,
+    ""
+  ];
+  if (input.secretsEvidence !== null) {
+    lines.push("```", input.secretsEvidence, "```", "");
+  }
+  lines.push(`SECRETS: ${input.secrets}`, "", renderTokensLine("security", "Security", input));
+  return lines.join(`
+`);
+}
+function isBoundToHead(extraction, headSha) {
+  if (!extraction.headSha)
+    return false;
+  return headSha.toLowerCase().startsWith(extraction.headSha.toLowerCase());
+}
+function checkExtraction(extraction, expectedValue, headSha) {
+  if (extraction.danglingNote) {
+    return {
+      ok: false,
+      reason: `no clean VERDICT was found on re-fetch (${extraction.danglingNote}) — the posted comment does not match the gate's line-anchored \`VERDICT:\` pattern.`
+    };
+  }
+  if (extraction.value !== expectedValue) {
+    return {
+      ok: false,
+      reason: `re-extraction found VERDICT "${extraction.value}", expected "${expectedValue}" — the posted comment's VERDICT line does not match what this command rendered.`
+    };
+  }
+  if (!extraction.headSha) {
+    return { ok: false, reason: "the winning VERDICT comment carries no `Judged head:` line on re-fetch." };
+  }
+  if (!isBoundToHead(extraction, headSha)) {
+    return {
+      ok: false,
+      reason: `re-extraction found \`Judged head: ${extraction.headSha}\`, which does not cover the resolved head ${headSha}.`
+    };
+  }
+  return { ok: true, reason: "clean" };
+}
+function principalBodies(comments, principalAllowlist) {
+  return comments.filter((c) => isPrincipal(c.author, principalAllowlist)).map((c) => c.body);
+}
+function verifyPostedCodeReview(comments, verdict, headSha, principalAllowlist) {
+  return checkExtraction(extractCodeReviewVerdict(principalBodies(comments, principalAllowlist)), CODE_REVIEW_VERDICT_TEXT[verdict], headSha);
+}
+function verifyPostedSecurity(comments, verdict, headSha, principalAllowlist) {
+  return checkExtraction(extractSecurityReviewVerdict(principalBodies(comments, principalAllowlist)), verdict, headSha);
+}
+function parseFlags(args) {
+  const map = new Map;
+  for (let i = 0;i < args.length; i++) {
+    const a = args[i];
+    if (a.startsWith("--")) {
+      const value = args[i + 1];
+      if (value === undefined || value.startsWith("--")) {
+        map.set(a, "");
+        continue;
+      }
+      map.set(a, value);
+      i++;
+    }
+  }
+  return map;
+}
+function refuseCmd(message, recovery) {
+  refuse([makeCheckError("review-post", message, recovery)]);
+}
+function requireFlag(flags2, name) {
+  const v = flags2.get(name);
+  if (v === undefined || v === "") {
+    refuseCmd(`Missing required \`${name}\` flag.`, `Pass \`${name} <value>\`, then re-run \`vinaya review post ...\`.`);
+  }
+  return v;
+}
+function requireTokenField(flags2, name) {
+  const v = requireFlag(flags2, name);
+  if (v !== "-" && !/^\d+$/.test(v)) {
+    refuseCmd(`\`${name} ${v}\` is neither a non-negative integer nor \`-\` (unknown).`, `Pass a whole number or \`-\` for ${name}.`);
+  }
+  return v;
+}
+function readFindingsFile(path, allowedSeverities) {
+  if (!path)
+    return [];
+  let content;
+  try {
+    content = readFileSync17(path, "utf8");
+  } catch {
+    refuseCmd(`Could not read findings file at ${path}.`, "Check the path and re-run.");
+  }
+  try {
+    return parseFindingsFile(content, allowedSeverities);
+  } catch (err) {
+    if (err instanceof FindingsParseError) {
+      refuseCmd(err.message, "Fix the malformed line in the findings file, then re-run.");
+    }
+    throw err;
+  }
+}
+function normalizeCodeReviewVerdict(raw) {
+  const v = raw.trim().toUpperCase().replace(/[-\s]+/g, "_");
+  if (v === "APPROVE")
+    return "APPROVE";
+  if (v === "REQUEST_CHANGES")
+    return "REQUEST_CHANGES";
+  refuseCmd(`\`--verdict ${raw}\` is not APPROVE or REQUEST_CHANGES.`, "Pass `--verdict APPROVE` or `--verdict REQUEST_CHANGES`.");
+}
+function normalizeSecurityVerdict(raw) {
+  const v = raw.trim().toUpperCase();
+  if (v === "PASS")
+    return "PASS";
+  if (v === "FAIL")
+    return "FAIL";
+  refuseCmd(`\`--verdict ${raw}\` is not PASS or FAIL.`, "Pass `--verdict PASS` or `--verdict FAIL`.");
+}
+function gh(args) {
+  try {
+    return execFileSync13("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+  } catch (err) {
+    const stderr = err.stderr;
+    throw new Error(String(stderr ?? err.message).trim() || "gh command failed");
+  }
+}
+function resolveHeadSha(pr) {
+  let out;
+  try {
+    out = gh(["pr", "view", pr, "--json", "headRefOid", "-q", ".headRefOid"]);
+  } catch (err) {
+    refuseCmd(`Could not resolve PR ${pr}'s head via \`gh pr view --json headRefOid\`: ${err instanceof Error ? err.message : String(err)}`, "Confirm `gh auth status` passes and the PR number is correct, then re-run.");
+  }
+  if (!out) {
+    refuseCmd(`\`gh pr view ${pr} --json headRefOid\` returned no head sha.`, "Confirm PR exists, then re-run.");
+  }
+  return out;
+}
+function postComment(pr, body) {
+  const tmp = join19(tmpdir2(), `vinaya-review-post-${process.pid}-${Date.now()}.md`);
+  writeFileSync10(tmp, body);
+  try {
+    return gh(["pr", "comment", pr, "--body-file", tmp]).trim();
+  } catch (err) {
+    refuseCmd(`Rendered comment failed to post via \`gh pr comment\`: ${err instanceof Error ? err.message : String(err)}`, "Check `gh auth status`/network, then re-run — nothing was posted.");
+  } finally {
+    rmSync4(tmp, { force: true });
+  }
+}
+function fetchComments(pr) {
+  const out = gh(["pr", "view", pr, "--json", "comments"]);
+  const parsed = JSON.parse(out);
+  return parsed.comments.map((c) => ({ body: c.body, author: c.author?.login ?? null }));
+}
+async function reviewPostCommand(args) {
+  const json = args.includes("--json");
+  const flags2 = parseFlags(args.filter((a) => a !== "--json"));
+  const role = flags2.get("--role");
+  if (role !== "code-reviewer" && role !== "security") {
+    refuseCmd(`\`--role ${role ?? "(missing)"}\` is not \`code-reviewer\` or \`security\`.`, "Pass `--role code-reviewer` or `--role security`.");
+  }
+  const pr = requireFlag(flags2, "--pr");
+  const taskId = requireFlag(flags2, "--task-id");
+  const model = requireFlag(flags2, "--model");
+  const tokensIn = requireTokenField(flags2, "--tokens-in");
+  const tokensOut = requireTokenField(flags2, "--tokens-out");
+  const cost = requireFlag(flags2, "--cost");
+  const tokens = { taskId, model, tokensIn, tokensOut, cost };
+  const headSha = resolveHeadSha(pr);
+  const principalAllowlist = resolvePrincipalAllowlist(loadTrustAnchorConfig());
+  let body;
+  let verify;
+  if (role === "code-reviewer") {
+    const verdict = normalizeCodeReviewVerdict(requireFlag(flags2, "--verdict"));
+    const findings = readFindingsFile(flags2.get("--findings-file"), CODE_REVIEW_SEVERITIES);
+    if (findings.some((f) => f.severity === "BLOCKER") && verdict === "APPROVE") {
+      refuseCmd("Findings include a BLOCKER but `--verdict APPROVE` — reviewer.md requires REQUEST CHANGES whenever any BLOCKER finding exists.", "Pass `--verdict REQUEST_CHANGES`, or fix the finding severity if BLOCKER was a miscategorization.");
+    }
+    const input = {
+      ...tokens,
+      headSha,
+      verdict,
+      briefConformance: requireFlag(flags2, "--brief-conformance"),
+      specConformance: requireFlag(flags2, "--spec-conformance"),
+      findings,
+      scope: requireFlag(flags2, "--scope"),
+      tests: requireFlag(flags2, "--tests"),
+      docs: requireFlag(flags2, "--docs")
+    };
+    body = renderCodeReviewComment(input);
+    verify = (comments2) => verifyPostedCodeReview(comments2, verdict, headSha, principalAllowlist);
+  } else {
+    const verdict = normalizeSecurityVerdict(requireFlag(flags2, "--verdict"));
+    const findings = readFindingsFile(flags2.get("--findings-file"), SECURITY_SEVERITIES);
+    if (findings.some((f) => f.severity === "CRITICAL" || f.severity === "HIGH") && verdict === "PASS") {
+      refuseCmd("Findings include a CRITICAL/HIGH finding but `--verdict PASS` — security.md requires FAIL whenever any CRITICAL or HIGH finding exists.", "Pass `--verdict FAIL`, or fix the finding severity if it was a miscategorization.");
+    }
+    const secrets = requireFlag(flags2, "--secrets");
+    const secretsEvidenceFile = flags2.get("--secrets-evidence-file");
+    if (isNoneFoundClaim(secrets) && !secretsEvidenceFile) {
+      refuseCmd('`--secrets` normalizes to "none found" but no `--secrets-evidence-file` was given — security.md: "SECRETS: none found" with no scan output pasted is an unbacked self-attestation.', "Pass `--secrets-evidence-file <path>` containing the actual scanner output, or change `--secrets` to describe what was found instead.");
+    }
+    let secretsEvidence = null;
+    if (secretsEvidenceFile) {
+      try {
+        secretsEvidence = readFileSync17(secretsEvidenceFile, "utf8");
+      } catch {
+        refuseCmd(`Could not read secrets evidence file at ${secretsEvidenceFile}.`, "Check the path and re-run.");
+      }
+    }
+    const input = {
+      ...tokens,
+      headSha,
+      verdict,
+      findings,
+      configScan: requireFlag(flags2, "--config-scan"),
+      secrets,
+      secretsEvidence
+    };
+    body = renderSecurityComment(input);
+    verify = (comments2) => verifyPostedSecurity(comments2, verdict, headSha, principalAllowlist);
+  }
+  const url = postComment(pr, body);
+  let comments;
+  try {
+    comments = fetchComments(pr);
+  } catch (err) {
+    refuseCmd(`Posted the comment (${url}) but could not re-fetch PR ${pr}'s comments to self-verify: ${err instanceof Error ? err.message : String(err)}`, "Check `gh auth status`/network and manually confirm the posted comment parses cleanly — this command could not verify it.");
+  }
+  const result = verify(comments);
+  if (!result.ok) {
+    refuseCmd(`Posted comment ${url}, but self-verification FAILED on re-parse: ${result.reason}`, "The posted comment does not re-parse clean through the same extractCodeReviewVerdict/extractSecurityReviewVerdict functions the merge gate calls. Do not treat the post as valid — inspect the comment and this command for drift, fix, and re-run.");
+  }
+  if (json) {
+    printJson({ posted: true, url, role, headSha, selfVerified: true });
+  } else {
+    process.stdout.write(`${body}
+
+Posted: ${url}
+Self-verification: clean — re-parsed VERDICT is bound to head ${headSha}.
+`);
+  }
+}
+
 // src/commands/studio.ts
 import { execFile as execFile5, spawn as spawn2 } from "node:child_process";
-import { existsSync as existsSync17, readFileSync as readFileSync17, renameSync } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync18, renameSync } from "node:fs";
 import net from "node:net";
-import { dirname as dirname7, join as join19 } from "node:path";
+import { dirname as dirname7, join as join20 } from "node:path";
 import { promisify as promisify5 } from "node:util";
 
 // src/lib/studio-bundle.ts
@@ -5781,25 +6433,25 @@ var FALLBACK_PORT = 3108;
 function resolveStudioTarget(cwd, moduleUrl = import.meta.url) {
   let dir = cwd;
   for (;; ) {
-    const webDir = join19(dir, "apps", "vinaya-studio", "web");
-    const pkgPath = join19(webDir, "package.json");
+    const webDir = join20(dir, "apps", "vinaya-studio", "web");
+    const pkgPath = join20(webDir, "package.json");
     if (existsSync17(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync17(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync18(pkgPath, "utf-8"));
         if (pkg.name === "@atta/vinaya-studio-web") {
           return { kind: "workspace", webDir };
         }
       } catch {}
     }
-    if (existsSync17(join19(dir, ".git")))
+    if (existsSync17(join20(dir, ".git")))
       break;
     const parent = dirname7(dir);
     if (parent === dir)
       break;
     dir = parent;
   }
-  const standaloneWebDir = join19(packageRoot(moduleUrl), "studio-standalone", "apps", "vinaya-studio", "web");
-  if (existsSync17(join19(standaloneWebDir, "server.js"))) {
+  const standaloneWebDir = join20(packageRoot(moduleUrl), "studio-standalone", "apps", "vinaya-studio", "web");
+  if (existsSync17(join20(standaloneWebDir, "server.js"))) {
     return { kind: "package", packageDir: standaloneWebDir };
   }
   return { kind: "missing" };
@@ -5819,8 +6471,8 @@ function isPortFree(port) {
   });
 }
 function ensureStudioNodeModules(bundleRoot) {
-  const real = join19(bundleRoot, "node_modules");
-  const packed = join19(bundleRoot, STUDIO_NODE_MODULES_PACKED_DIRNAME);
+  const real = join20(bundleRoot, "node_modules");
+  const packed = join20(bundleRoot, STUDIO_NODE_MODULES_PACKED_DIRNAME);
   if (!existsSync17(real) && existsSync17(packed)) {
     renameSync(packed, real);
   }
@@ -5847,8 +6499,8 @@ async function runStudio(cwd, args, moduleUrl = import.meta.url) {
     case "workspace":
       return spawnDev(target.webDir, args);
     case "package": {
-      const bundleRoot = join19(target.packageDir, "..", "..", "..");
-      return spawnStandalone(cwd, join19(target.packageDir, "server.js"), bundleRoot);
+      const bundleRoot = join20(target.packageDir, "..", "..", "..");
+      return spawnStandalone(cwd, join20(target.packageDir, "server.js"), bundleRoot);
     }
     case "missing":
       console.error("Vinaya Studio isn't available in this install — no published @attalabs/vinaya build bundles the Studio app yet. Inside a checkout that contains Studio's source (apps/vinaya-studio/web), `vinaya studio` runs it directly.");
@@ -5857,8 +6509,8 @@ async function runStudio(cwd, args, moduleUrl = import.meta.url) {
 }
 
 // src/commands/upgrade.ts
-import { existsSync as existsSync18, readFileSync as readFileSync18, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join20 } from "node:path";
+import { existsSync as existsSync18, readFileSync as readFileSync19, rmSync as rmSync5, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join21 } from "node:path";
 function realDeps7() {
   return {
     detectRepo: detectGitRepo,
@@ -5876,12 +6528,12 @@ function flags2(args) {
   return { dryRun: args.includes("--dry-run"), yes: args.includes("--yes") };
 }
 function readManifest3(repoRoot) {
-  const p = join20(repoRoot, CONFIG_PATH);
+  const p = join21(repoRoot, CONFIG_PATH);
   if (!existsSync18(p))
     return { kind: "missing" };
   let raw;
   try {
-    raw = JSON.parse(readFileSync18(p, "utf-8"));
+    raw = JSON.parse(readFileSync19(p, "utf-8"));
   } catch (err) {
     return { kind: "invalid", error: `invalid JSON: ${err.message}` };
   }
@@ -5897,17 +6549,17 @@ function readManifest3(repoRoot) {
   return { kind: "ok", manifest: parsed.data.managed };
 }
 function writeManifestVersion(repoRoot, manifest) {
-  const configAbs = join20(repoRoot, CONFIG_PATH);
-  const seed = JSON.parse(readFileSync18(configAbs, "utf-8"));
+  const configAbs = join21(repoRoot, CONFIG_PATH);
+  const seed = JSON.parse(readFileSync19(configAbs, "utf-8"));
   const updated = { ...manifest, version: MANAGED_MANIFEST_VERSION };
-  writeFileSync10(configAbs, `${JSON.stringify({ ...seed, managed: updated }, null, 2)}
+  writeFileSync11(configAbs, `${JSON.stringify({ ...seed, managed: updated }, null, 2)}
 `, "utf-8");
 }
 function stripFor(repoRoot, path, marker, comment) {
   const abs2 = resolveManagedBlockPath(repoRoot, path);
   if (!existsSync18(abs2))
     return { path, marker, comment, present: false, removesHost: false };
-  const stripped = stripBlockFromContent(readFileSync18(abs2, "utf-8"), marker, comment);
+  const stripped = stripBlockFromContent(readFileSync19(abs2, "utf-8"), marker, comment);
   if (stripped === null)
     return { path, marker, comment, present: false, removesHost: false };
   return { path, marker, comment, present: true, removesHost: blockStripLeavesEmpty(stripped) };
@@ -5936,7 +6588,7 @@ function planHookRouting(repoRoot, manifest, recorded, hooksPathValue) {
     const abs2 = resolveManagedBlockPath(repoRoot, b.path);
     if (!existsSync18(abs2))
       continue;
-    const stripped = stripBlockFromContent(readFileSync18(abs2, "utf-8"), b.marker, b.comment);
+    const stripped = stripBlockFromContent(readFileSync19(abs2, "utf-8"), b.marker, b.comment);
     if (stripped === null)
       blocked.push(`${b.path} exists without vinaya's managed block`);
     else if (!blockStripLeavesEmpty(stripped))
@@ -5971,7 +6623,7 @@ function planUpgrade(ops, repoRoot, manifest, routing) {
   const ownedBlocks = new Set(manifest.blocks.map((b) => blockKey(b.path, b.marker)));
   for (const op of ops) {
     if (op.kind === "create-file") {
-      const abs2 = join20(repoRoot, op.path);
+      const abs2 = join21(repoRoot, op.path);
       const exists = existsSync18(abs2);
       const owned = ownedFiles.has(op.path);
       let action;
@@ -5982,7 +6634,7 @@ function planUpgrade(ops, repoRoot, manifest, routing) {
       } else if (!exists) {
         action = "recreate";
         hasChanges = true;
-      } else if (readFileSync18(abs2, "utf-8") !== op.content) {
+      } else if (readFileSync19(abs2, "utf-8") !== op.content) {
         action = "regenerate";
         hasChanges = true;
       } else {
@@ -5999,7 +6651,7 @@ function planUpgrade(ops, repoRoot, manifest, routing) {
         action = "recreate-host";
         hasChanges = true;
       } else {
-        const content = readFileSync18(abs2, "utf-8");
+        const content = readFileSync19(abs2, "utf-8");
         const { begin, end } = markerLines(op.marker, op.comment);
         if (!(content.includes(begin) && content.includes(end))) {
           action = "recreate-append";
@@ -6099,10 +6751,10 @@ function renderUpgradeDiff(plan) {
 }
 function regenerateBlock(repoRoot, op) {
   const abs2 = resolveManagedBlockPath(repoRoot, op.path);
-  const content = readFileSync18(abs2, "utf-8");
+  const content = readFileSync19(abs2, "utf-8");
   const stripped = stripBlockFromContent(content, op.marker, op.comment);
   if (stripped !== null) {
-    writeFileSync10(abs2, stripped.endsWith(`
+    writeFileSync11(abs2, stripped.endsWith(`
 `) ? stripped : `${stripped}
 `, "utf-8");
   }
@@ -6112,7 +6764,7 @@ function applyUpgrade(plan, repoRoot) {
   for (const e of plan.entries) {
     if (e.kind === "create-file") {
       if (e.action === "regenerate" || e.action === "recreate") {
-        writeFileWithDirs(join20(repoRoot, e.op.path), e.op.content, e.op.mode);
+        writeFileWithDirs(join21(repoRoot, e.op.path), e.op.content, e.op.mode);
       }
     } else {
       if (e.action === "recreate-host")
@@ -6129,13 +6781,13 @@ function applyUpgrade(plan, repoRoot) {
     const abs2 = resolveManagedBlockPath(repoRoot, s.path);
     if (!existsSync18(abs2))
       continue;
-    const stripped = stripBlockFromContent(readFileSync18(abs2, "utf-8"), s.marker, s.comment);
+    const stripped = stripBlockFromContent(readFileSync19(abs2, "utf-8"), s.marker, s.comment);
     if (stripped === null)
       continue;
     if (blockStripLeavesEmpty(stripped))
-      rmSync4(abs2, { force: true });
+      rmSync5(abs2, { force: true });
     else
-      writeFileSync10(abs2, stripped.endsWith(`
+      writeFileSync11(abs2, stripped.endsWith(`
 `) ? stripped : `${stripped}
 `, "utf-8");
   }
@@ -6217,16 +6869,16 @@ async function upgradeCommand(args) {
 }
 
 // src/commands/waiver.ts
-import { execFileSync as execFileSync11 } from "node:child_process";
+import { execFileSync as execFileSync14 } from "node:child_process";
 function labelFor(kind) {
   return kind === "docs" ? WAIVER_LABEL : WAIVER_LABEL_REVIEW;
 }
-function gh(args) {
-  return execFileSync11("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: process.env }).trim();
+function gh2(args) {
+  return execFileSync14("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: process.env }).trim();
 }
 function detectPrNumber() {
   try {
-    const out = gh(["pr", "view", "--json", "number", "-q", ".number"]);
+    const out = gh2(["pr", "view", "--json", "number", "-q", ".number"]);
     return /^\d+$/.test(out) ? out : null;
   } catch {
     return null;
@@ -6322,8 +6974,8 @@ Reason: ${reason}`];
   }
   process.stdout.write(`Applying \`${label2}\` to PR #${prNumber} under your authenticated \`gh\` identity — vinaya never fabricates an actor.
 `);
-  execFileSync11("gh", editArgs, { stdio: "inherit", env: process.env });
-  execFileSync11("gh", commentArgs, { stdio: "inherit", env: process.env });
+  execFileSync14("gh", editArgs, { stdio: "inherit", env: process.env });
+  execFileSync14("gh", commentArgs, { stdio: "inherit", env: process.env });
   process.stdout.write(`
 ✓ Label applied and reason posted as a PR comment.
 `);
@@ -6483,6 +7135,48 @@ var COMMANDS = [
     ],
     status: "shipped"
   },
+  {
+    name: "review post",
+    description: "Render, post, and self-verify a code-reviewer or security-review verdict comment on a PR",
+    flags: [
+      { flag: "--role", description: "`code-reviewer` or `security` — selects which role template is rendered" },
+      {
+        flag: "--pr",
+        description: "Target PR number — its real head is resolved via `gh pr view`, never caller-supplied"
+      },
+      {
+        flag: "--verdict",
+        description: "code-reviewer: `APPROVE` | `REQUEST_CHANGES`. security: `PASS` | `FAIL`"
+      },
+      {
+        flag: "--findings-file",
+        description: "One finding per line: `SEVERITY|file:line|description` (`|`-delimited). Omit for zero findings."
+      },
+      { flag: "--brief-conformance", description: "code-reviewer only: the BRIEF CONFORMANCE line" },
+      { flag: "--spec-conformance", description: "code-reviewer only: the SPEC CONFORMANCE line" },
+      { flag: "--scope", description: "code-reviewer only: the SCOPE line" },
+      { flag: "--tests", description: "code-reviewer only: the TESTS line" },
+      { flag: "--docs", description: "code-reviewer only: the DOCS line" },
+      { flag: "--config-scan", description: "security only: the CONFIG SCAN line" },
+      { flag: "--secrets", description: "security only: the SECRETS line" },
+      {
+        flag: "--secrets-evidence-file",
+        description: 'security only: required whenever `--secrets` claims "none found" — the pasted scanner output backing that claim'
+      },
+      { flag: "--task-id", description: "the closing `Tokens:` line's task id" },
+      { flag: "--model", description: "the closing `Tokens:` line's model name" },
+      { flag: "--tokens-in", description: "a non-negative integer, or `-` if unknown" },
+      { flag: "--tokens-out", description: "a non-negative integer, or `-` if unknown" },
+      { flag: "--cost", description: "free text, or `-` if unknown" },
+      { flag: "--json", description: "Enveloped JSON output (schema: 1)" }
+    ],
+    details: [
+      "Every structural line (`VERDICT:`, `Judged head:`) is rendered from this command's own validated enum/sha inputs — never from a caller-supplied string — so a Reviewer's free-typed prose can no longer produce a shape the merge gate's line-anchored regex fails to see.",
+      "Refuses a contradictory verdict before posting anything: a BLOCKER finding with `--verdict APPROVE`, or a CRITICAL/HIGH finding with `--verdict PASS`, is rejected outright, mirroring each role doc's own consistency rule.",
+      "After posting, re-fetches the PR's comments and runs them through the exact `extractCodeReviewVerdict`/`extractSecurityReviewVerdict` functions `checkReviewGate` calls — the same functions, not a second implementation — and exits non-zero naming precisely what failed to re-parse if the post does not come back clean and bound to the resolved head. There is no `--skip-verify` escape."
+    ],
+    status: "shipped"
+  },
   {
     name: "doctor",
     description: "Diagnose hook, workflow, and config health — report only, never mutates",
@@ -6628,9 +7322,9 @@ function printHelp() {
 }
 
 // src/index.ts
-var PACKAGE_ROOT = join21(dirname8(fileURLToPath2(import.meta.url)), "..");
+var PACKAGE_ROOT = join22(dirname8(fileURLToPath2(import.meta.url)), "..");
 function readVersion2() {
-  const pkg = JSON.parse(readFileSync19(join21(PACKAGE_ROOT, "package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync20(join22(PACKAGE_ROOT, "package.json"), "utf-8"));
   return pkg.version;
 }
 var [, , command, ...args] = process.argv;
@@ -6733,6 +7427,16 @@ try {
       }
       break;
     }
+    case "review": {
+      const [subcommand, ...rest] = args;
+      if (subcommand === "post") {
+        await reviewPostCommand(rest);
+      } else {
+        console.error(`Unknown 'review' subcommand: ${subcommand ?? "(none)"} (expected 'post')`);
+        process.exit(2);
+      }
+      break;
+    }
     case "demo": {
       const [subcommand, ...rest] = args;
       if (subcommand === "break") {