@attalabs/vinaya 0.12.0 → 0.17.0

package/dist/checks/bin/check-body-bare-digits.js

@@ -0,0 +1,3545 @@
+#!/usr/bin/env node
+// @bun
+
+// src/checks/bin/check-body-bare-digits.ts
+import { execFileSync as execFileSync3 } from "child_process";
+// ../../packages/aeg-forge-state/src/strip-code.ts
+function maskCode(body) {
+  const fill = (line) => " ".repeat(line.length);
+  const blocksMasked = maskIndentedCode(maskFencedCode(body, fill), fill);
+  return blocksMasked.split(`
+`).map((line) => replaceInlineSpans(line, (span) => " ".repeat(span.length))).join(`
+`);
+}
+var DETAILS_OPEN = /<details\b[^>]*>/gi;
+var DETAILS_CLOSE = /<\/details\s*>/gi;
+function maskDetailsBlocks(body) {
+  const fill = (line) => " ".repeat(line.length);
+  const lines = body.split(`
+`);
+  let depth = 0;
+  const out = lines.map((line) => {
+    const opens = line.match(DETAILS_OPEN)?.length ?? 0;
+    const closes = line.match(DETAILS_CLOSE)?.length ?? 0;
+    const maskThisLine = depth > 0 || opens > 0;
+    depth = Math.max(0, depth + opens - closes);
+    return maskThisLine ? fill(line) : line;
+  });
+  return out.join(`
+`);
+}
+function stripCode(body, options = {}) {
+  const normalised = body.replace(/\r\n?/g, `
+`);
+  const blank = () => "";
+  const blocksStripped = maskIndentedCode(maskFencedCode(normalised, blank), blank);
+  if (options.inlineSpans === "keep")
+    return blocksStripped;
+  return blocksStripped.split(`
+`).map((line) => replaceInlineSpans(line, () => "")).join(`
+`);
+}
+function replaceInlineSpans(line, replace) {
+  let result = "";
+  let i = 0;
+  const runLengthAt = (at) => {
+    let j = at;
+    while (j < line.length && line[j] === "`")
+      j++;
+    return j - at;
+  };
+  while (i < line.length) {
+    if (line[i] !== "`") {
+      result += line[i];
+      i++;
+      continue;
+    }
+    const openLen = runLengthAt(i);
+    const openEnd = i + openLen;
+    let j = openEnd;
+    let closeEnd = -1;
+    while (j < line.length) {
+      if (line[j] !== "`") {
+        j++;
+        continue;
+      }
+      const runLen = runLengthAt(j);
+      if (runLen === openLen) {
+        closeEnd = j + runLen;
+        break;
+      }
+      j += runLen;
+    }
+    if (closeEnd === -1) {
+      result += line.slice(i, openEnd);
+      i = openEnd;
+    } else {
+      result += replace(line.slice(i, closeEnd));
+      i = closeEnd;
+    }
+  }
+  return result;
+}
+var FENCE_OPEN = /^ {0,3}(`{3,}|~{3,})([^\r\n]*)\r?$/;
+var FENCE_CLOSE = /^ {0,3}(`+|~+)[ \t]*\r?$/;
+function maskFencedCode(body, fill) {
+  const { lines } = scanFencedCode(body);
+  return lines.map(({ line, inCode }) => inCode ? fill(line) : line).join(`
+`);
+}
+function scanFencedCode(body) {
+  let fenceChar = null;
+  let fenceLen = 0;
+  const lines = body.split(`
+`).map((line) => {
+    if (fenceChar === null) {
+      const open = line.match(FENCE_OPEN);
+      if (!open)
+        return { line, inCode: false };
+      const marker = open[1];
+      if (marker[0] === "`" && open[2].includes("`"))
+        return { line, inCode: false };
+      fenceChar = marker[0];
+      fenceLen = marker.length;
+      return { line, inCode: true };
+    }
+    const close = line.match(FENCE_CLOSE);
+    if (close && close[1][0] === fenceChar && close[1].length >= fenceLen) {
+      fenceChar = null;
+      fenceLen = 0;
+    }
+    return { line, inCode: true };
+  });
+  return { lines, unterminated: fenceChar !== null };
+}
+function hasUnterminatedFence(body) {
+  return scanFencedCode(body.replace(/\r\n?/g, `
+`)).unterminated;
+}
+var LIST_MARKER = /^ {0,3}(?:[-*+]|\d{1,9}[.)])(?:\s|$)/;
+function indentWidth(line) {
+  let width = 0;
+  for (const ch of line) {
+    if (ch === " ")
+      width += 1;
+    else if (ch === "\t")
+      width += 4;
+    else
+      break;
+  }
+  return width;
+}
+function maskIndentedCode(body, fill) {
+  const lines = body.split(`
+`);
+  let inList = false;
+  let inCode = false;
+  let prevBlank = true;
+  const out = lines.map((line) => {
+    if (line.trim() === "") {
+      prevBlank = true;
+      return line;
+    }
+    const indent = indentWidth(line);
+    if (indent >= 4 && (inCode || prevBlank && !inList)) {
+      inCode = true;
+      prevBlank = false;
+      return fill(line);
+    }
+    inCode = false;
+    if (indent < 4 && LIST_MARKER.test(line))
+      inList = true;
+    else if (indent === 0)
+      inList = false;
+    prevBlank = false;
+    return line;
+  });
+  return out.join(`
+`);
+}
+
+// ../../packages/aeg-forge-state/src/parse-rationale-deps.ts
+var SECTION_HEADER = /\*\*Dependency rationale\*\*/i;
+var NEXT_HEADER = /\*\*[A-Z][^*]*\*\*/;
+var FIELD_LABEL = /^(Depends-on|Conflicts-with)\s*:\s*(.*)$/i;
+var ID_TOKEN = /^(?:[\w.-]+\s+)?#?\d+[a-z]?$/i;
+var SLUG_QUALIFIED_ID = /^([\w.-]+)\s+(#?\d+[a-z]?)$/i;
+function isEmptyMarker(s) {
+  const t = s.trim();
+  return t === "" || t === "—" || t === "-" || t === "–";
+}
+function pushUnique(arr, ids) {
+  for (const id of ids) {
+    if (!arr.includes(id))
+      arr.push(id);
+  }
+}
+function splitIds(raw) {
+  if (isEmptyMarker(raw))
+    return [];
+  return raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0 && !isEmptyMarker(s) && ID_TOKEN.test(s));
+}
+function resolveIds(raw, lastSlug) {
+  const ids = splitIds(raw);
+  const resolved = [];
+  for (const id of ids) {
+    const qualified = id.match(SLUG_QUALIFIED_ID);
+    if (qualified) {
+      lastSlug.current = qualified[1] ?? null;
+      resolved.push(id);
+    } else if (lastSlug.current) {
+      resolved.push(`${lastSlug.current} ${id}`);
+      lastSlug.current = null;
+    } else {
+      resolved.push(id);
+    }
+  }
+  return resolved;
+}
+function extractSection(body) {
+  const start = body.match(SECTION_HEADER);
+  if (!start || start.index === undefined)
+    return "";
+  const rest = body.slice(start.index + start[0].length);
+  const next = rest.match(NEXT_HEADER);
+  const end = next && next.index !== undefined ? next.index : rest.length;
+  return rest.slice(0, end);
+}
+function parseRationaleDeps(body) {
+  const section = extractSection(body);
+  const dependsOn = [];
+  const conflictsWith = [];
+  let current = null;
+  const assignedFields = new Set;
+  const lastSlugByField = {
+    dependsOn: { current: null },
+    conflictsWith: { current: null }
+  };
+  const spanPattern = /`([^`]*)`/g;
+  let match = spanPattern.exec(section);
+  while (match !== null) {
+    const content = (match[1] ?? "").trim();
+    const labelMatch = content.match(FIELD_LABEL);
+    if (labelMatch) {
+      const field = labelMatch[1]?.toLowerCase() === "conflicts-with" ? "conflictsWith" : "dependsOn";
+      if (!assignedFields.has(field)) {
+        assignedFields.add(field);
+        current = field;
+        const ids = resolveIds(labelMatch[2] ?? "", lastSlugByField[field]);
+        pushUnique(field === "dependsOn" ? dependsOn : conflictsWith, ids);
+      }
+    } else if (current) {
+      const ids = resolveIds(content, lastSlugByField[current]);
+      pushUnique(current === "dependsOn" ? dependsOn : conflictsWith, ids);
+    }
+    match = spanPattern.exec(section);
+  }
+  return { dependsOn, conflictsWith };
+}
+// ../../packages/aeg-forge-state/src/gh.ts
+import { execFile, execFileSync } from "node:child_process";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
+var systemEnv = {
+  ...process.env,
+  PATH: [process.env.PATH, "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].filter(Boolean).join(":")
+};
+function run(args) {
+  return execFileSync("gh", args, { encoding: "utf8", env: systemEnv });
+}
+async function runAsync(args) {
+  const { stdout } = await execFileAsync("gh", args, {
+    encoding: "utf8",
+    env: systemEnv,
+    maxBuffer: 16 * 1024 * 1024
+  });
+  return stdout;
+}
+function ghApiGet(path) {
+  return JSON.parse(run(["api", path]));
+}
+function issueListByLabelArgs(owner, repo, label) {
+  return [
+    "issue",
+    "list",
+    "--repo",
+    `${owner}/${repo}`,
+    "--label",
+    label,
+    "--state",
+    "all",
+    "--json",
+    "number,title,body,state,labels,milestone",
+    "--limit",
+    "200"
+  ];
+}
+async function ghIssueListByLabelAsync(owner, repo, label) {
+  return JSON.parse(await runAsync(issueListByLabelArgs(owner, repo, label)));
+}
+function dedupeByNumber(issues) {
+  const byNumber = new Map;
+  for (const issue of issues)
+    if (!byNumber.has(issue.number))
+      byNumber.set(issue.number, issue);
+  return [...byNumber.values()];
+}
+async function ghIssueListByAnyLabelAsync(owner, repo, labels) {
+  const perLabel = await Promise.all(labels.map((l) => ghIssueListByLabelAsync(owner, repo, l)));
+  return dedupeByNumber(perLabel.flat());
+}
+
+// ../../packages/aeg-forge-state/src/fetch-milestone.ts
+function findMilestoneForSlug(owner, repo, slug) {
+  const milestones = ghApiGet(`repos/${owner}/${repo}/milestones?state=all&per_page=100`);
+  const match = milestones.find((m) => m.title === slug);
+  if (!match)
+    return null;
+  return {
+    goal: match.description ?? "",
+    lifecycle: match.state === "closed" ? "complete" : "active"
+  };
+}
+
+// ../../packages/aeg-forge-state/src/labels.ts
+var LABELS = [
+  {
+    key: "blocked",
+    id: "vinaya/blocked",
+    category: "state",
+    form: "literal",
+    carries: "Execution is halted pending an external unblock; wins over every other derived status."
+  },
+  {
+    key: "tier-0",
+    id: "vinaya/tier:0",
+    category: "tier",
+    form: "literal",
+    carries: "Lowest governance weight — typecheck, lint, tests, and a conforming PR body."
+  },
+  {
+    key: "tier-1",
+    id: "vinaya/tier:1",
+    category: "tier",
+    form: "literal",
+    carries: "Tier 0 plus spec/skill coverage and a passing verify-docs run."
+  },
+  {
+    key: "tier-3",
+    id: "vinaya/tier:3",
+    category: "tier",
+    form: "literal",
+    carries: "Tier 1 plus the reasoning for the change, stated in the pull request that makes it."
+  },
+  {
+    key: "tranche",
+    id: "vinaya/tranche:",
+    category: "tranche",
+    form: "prefix",
+    carries: "The tranche slug this task Issue belongs to — the forge's grouping key, matched by prefix."
+  },
+  {
+    key: "needs-execution-input",
+    id: "vinaya/needs:execution-input",
+    category: "needs",
+    form: "literal",
+    carries: "Waiting on a missing execution detail — a flag, a dependency, a value the brief did not carry."
+  },
+  {
+    key: "needs-strategy-input",
+    id: "vinaya/needs:strategy-input",
+    category: "needs",
+    form: "literal",
+    carries: "Waiting on a strategy call — the brief assumes an approach the codebase has moved away from."
+  },
+  {
+    key: "needs-principal-input",
+    id: "vinaya/needs:principal-input",
+    category: "needs",
+    form: "literal",
+    carries: "Waiting on the Principal — a product-level call no agent may make."
+  },
+  {
+    key: "needs-brief-correction",
+    id: "vinaya/needs:brief-correction",
+    category: "needs",
+    form: "literal",
+    carries: "Waiting on the Brief Author — the brief contradicts the surface it describes."
+  },
+  {
+    key: "waiver-docs",
+    id: "vinaya/waiver:docs",
+    category: "waiver",
+    form: "literal",
+    carries: "Doc-coverage gate excused for this PR — honored only when a principal applied it."
+  },
+  {
+    key: "waiver-review",
+    id: "vinaya/waiver:review",
+    category: "waiver",
+    form: "literal",
+    carries: "Review gate excused for this PR — honored only when a principal applied it."
+  },
+  {
+    key: "override-docs",
+    id: "vinaya/override:docs",
+    category: "waiver",
+    form: "literal",
+    carries: "The whole verify-docs gate suppressed for this PR — a Principal-only blunt override, wider than a waiver."
+  },
+  {
+    key: "incoherent",
+    id: "vinaya/incoherent",
+    category: "flag",
+    form: "literal",
+    carries: "Closed COMPLETED with no merged-PR link — done-but-unprovable, surfaced for a human."
+  },
+  {
+    key: "direct-main-push",
+    id: "vinaya/direct-main-push",
+    category: "flag",
+    form: "literal",
+    carries: "A commit reached main with no associated merged PR — ring-2 detection, never a mutation."
+  },
+  {
+    key: "dead-branch-push",
+    id: "vinaya/dead-branch-push",
+    category: "flag",
+    form: "literal",
+    carries: "Commits landed on a branch after its PR had already resolved — daily-drift detection."
+  },
+  {
+    key: "state-object",
+    id: "vinaya/state-object",
+    category: "kind",
+    form: "literal",
+    carries: "A permanent forge-native storage object, never actionable work — excluded from every backlog."
+  }
+];
+var BY_KEY = new Map(LABELS.map((l) => [l.key, l]));
+function entry(key) {
+  const found = BY_KEY.get(key);
+  if (!found)
+    throw new Error(`labels.ts: no LABELS entry for key '${key}'`);
+  return found;
+}
+function label(key) {
+  return entry(key).id;
+}
+function trancheLabel(slug) {
+  return `${label("tranche")}${slug}`;
+}
+function matchesLabel(key, name) {
+  const l = entry(key);
+  if (l.form === "prefix")
+    return name.startsWith(l.id);
+  return name === l.id;
+}
+function hasLabel(key, names) {
+  return names.some((n) => matchesLabel(key, n));
+}
+function trancheSlugOf(name) {
+  const prefix = entry("tranche").id;
+  return name.startsWith(prefix) ? name.slice(prefix.length) : null;
+}
+function findTrancheSlug(names) {
+  for (const n of names) {
+    const slug = trancheSlugOf(n);
+    if (slug !== null)
+      return slug;
+  }
+  return null;
+}
+
+// ../../packages/aeg-forge-state/src/list-tasks.ts
+var TITLE_PATTERN = /^\[([^\]]+)]\s*(\S+)\s*—\s*(.+)$/;
+var PROJECT_SLUG = /^[a-z0-9][a-z0-9-]*$/i;
+var PROJECT_FIELD = /^\s*(?:\*\*)?Project(?:\(s\))?(?:\*\*)?\s*:\s*(?:\*\*)?\s*(.+)$/im;
+var VALUE_EDGE_MARKUP = /^[`.;\s]+|[`.;\s]+$/g;
+function unwrapValue(raw) {
+  return raw.replace(/\*\*/g, "").replace(VALUE_EDGE_MARKUP, "");
+}
+function projectFieldFromBody(body) {
+  const m = stripCode(body, { inlineSpans: "keep" }).match(PROJECT_FIELD);
+  if (m)
+    return parseFieldValue(m[1] ?? "");
+  if (hasUnterminatedFence(body)) {
+    const raw = body.match(PROJECT_FIELD);
+    if (raw)
+      return { declared: true, names: [], unparsed: [(raw[1] ?? "").trim()], unreadable: true };
+  }
+  return { declared: false, names: [], unparsed: [], unreadable: false };
+}
+function parseFieldValue(value) {
+  const names = [];
+  const unparsed = [];
+  for (const raw of value.split(",")) {
+    const name = unwrapValue(raw);
+    if (name.length === 0)
+      continue;
+    if (PROJECT_SLUG.test(name))
+      names.push(name);
+    else
+      unparsed.push(raw.trim());
+  }
+  return { declared: true, names: [...new Set(names)], unparsed, unreadable: false };
+}
+function projectsFromBody(body) {
+  return projectFieldFromBody(body).names;
+}
+function taskFromIssue(issue) {
+  const m = issue.title.match(TITLE_PATTERN);
+  if (!m)
+    return null;
+  const id = (m[2] ?? "").trim();
+  const title = (m[3] ?? "").trim();
+  if (!id || !title)
+    return null;
+  const body = issue.body ?? "";
+  const { dependsOn, conflictsWith } = parseRationaleDeps(body);
+  return {
+    id,
+    title,
+    issue: issue.number,
+    projects: projectsFromBody(body),
+    dependsOn,
+    conflictsWith,
+    rationaleMarkdown: body
+  };
+}
+function compareTaskIds(a, b) {
+  const numA = a.match(/^(\d+)(.*)$/);
+  const numB = b.match(/^(\d+)(.*)$/);
+  if (numA && numB) {
+    const diff = Number(numA[1]) - Number(numB[1]);
+    if (diff !== 0)
+      return diff;
+    return (numA[2] ?? "").localeCompare(numB[2] ?? "");
+  }
+  return a.localeCompare(b);
+}
+function tasksFromIssues(issues) {
+  const tasks = [];
+  for (const issue of issues) {
+    const task = taskFromIssue(issue);
+    if (task)
+      tasks.push(task);
+  }
+  return tasks.sort((a, b) => compareTaskIds(a.id, b.id));
+}
+async function fetchTrancheIssuesAsync(owner, repo, slug) {
+  return ghIssueListByAnyLabelAsync(owner, repo, [trancheLabel(slug)]);
+}
+function resolveTaskIssueRef(title, labels) {
+  const m = title.match(TITLE_PATTERN);
+  if (!m)
+    return null;
+  const taskId = (m[2] ?? "").trim();
+  if (!taskId)
+    return null;
+  const trancheSlug = findTrancheSlug(labels);
+  if (!trancheSlug)
+    return null;
+  return { trancheSlug, taskId };
+}
+
+// ../../packages/aeg-forge-state/src/derive-from-forge.ts
+function trancheFromIssues(slug, issues, known) {
+  return {
+    name: slug,
+    lifecycle: known?.lifecycle ?? "active",
+    goal: known?.goal ?? "",
+    tasks: tasksFromIssues(issues),
+    backlog: []
+  };
+}
+async function deriveTrancheFromForge(owner, repo, slug, known) {
+  const milestone = known ?? findMilestoneForSlug(owner, repo, slug);
+  const issues = await fetchTrancheIssuesAsync(owner, repo, slug);
+  return trancheFromIssues(slug, issues, milestone);
+}
+// ../../node_modules/universal-user-agent/index.js
+function getUserAgent() {
+  if (typeof navigator === "object" && "userAgent" in navigator) {
+    return navigator.userAgent;
+  }
+  if (typeof process === "object" && process.version !== undefined) {
+    return `Node.js/${process.version.substr(1)} (${process.platform}; ${process.arch})`;
+  }
+  return "<environment undetectable>";
+}
+
+// ../../node_modules/@octokit/endpoint/dist-bundle/index.js
+var VERSION = "0.0.0-development";
+var userAgent = `octokit-endpoint.js/${VERSION} ${getUserAgent()}`;
+var DEFAULTS = {
+  method: "GET",
+  baseUrl: "https://api.github.com",
+  headers: {
+    accept: "application/vnd.github.v3+json",
+    "user-agent": userAgent
+  },
+  mediaType: {
+    format: ""
+  }
+};
+function lowercaseKeys(object) {
+  if (!object) {
+    return {};
+  }
+  return Object.keys(object).reduce((newObj, key) => {
+    newObj[key.toLowerCase()] = object[key];
+    return newObj;
+  }, {});
+}
+function isPlainObject(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  if (Object.prototype.toString.call(value) !== "[object Object]")
+    return false;
+  const proto = Object.getPrototypeOf(value);
+  if (proto === null)
+    return true;
+  const Ctor = Object.prototype.hasOwnProperty.call(proto, "constructor") && proto.constructor;
+  return typeof Ctor === "function" && Ctor instanceof Ctor && Function.prototype.call(Ctor) === Function.prototype.call(value);
+}
+function mergeDeep(defaults, options) {
+  const result = Object.assign({}, defaults);
+  Object.keys(options).forEach((key) => {
+    if (isPlainObject(options[key])) {
+      if (!(key in defaults))
+        Object.assign(result, { [key]: options[key] });
+      else
+        result[key] = mergeDeep(defaults[key], options[key]);
+    } else {
+      Object.assign(result, { [key]: options[key] });
+    }
+  });
+  return result;
+}
+function removeUndefinedProperties(obj) {
+  for (const key in obj) {
+    if (obj[key] === undefined) {
+      delete obj[key];
+    }
+  }
+  return obj;
+}
+function merge(defaults, route, options) {
+  if (typeof route === "string") {
+    let [method, url] = route.split(" ");
+    options = Object.assign(url ? { method, url } : { url: method }, options);
+  } else {
+    options = Object.assign({}, route);
+  }
+  options.headers = lowercaseKeys(options.headers);
+  removeUndefinedProperties(options);
+  removeUndefinedProperties(options.headers);
+  const mergedOptions = mergeDeep(defaults || {}, options);
+  if (options.url === "/graphql") {
+    if (defaults && defaults.mediaType.previews?.length) {
+      mergedOptions.mediaType.previews = defaults.mediaType.previews.filter((preview) => !mergedOptions.mediaType.previews.includes(preview)).concat(mergedOptions.mediaType.previews);
+    }
+    mergedOptions.mediaType.previews = (mergedOptions.mediaType.previews || []).map((preview) => preview.replace(/-preview/, ""));
+  }
+  return mergedOptions;
+}
+function addQueryParameters(url, parameters) {
+  const separator = /\?/.test(url) ? "&" : "?";
+  const names = Object.keys(parameters);
+  if (names.length === 0) {
+    return url;
+  }
+  return url + separator + names.map((name) => {
+    if (name === "q") {
+      return "q=" + parameters.q.split("+").map(encodeURIComponent).join("+");
+    }
+    return `${name}=${encodeURIComponent(parameters[name])}`;
+  }).join("&");
+}
+var urlVariableRegex = /\{[^{}}]+\}/g;
+function removeNonChars(variableName) {
+  return variableName.replace(/(?:^\W+)|(?:(?<!\W)\W+$)/g, "").split(/,/);
+}
+function extractUrlVariableNames(url) {
+  const matches = url.match(urlVariableRegex);
+  if (!matches) {
+    return [];
+  }
+  return matches.map(removeNonChars).reduce((a, b) => a.concat(b), []);
+}
+function omit(object, keysToOmit) {
+  const result = { __proto__: null };
+  for (const key of Object.keys(object)) {
+    if (keysToOmit.indexOf(key) === -1) {
+      result[key] = object[key];
+    }
+  }
+  return result;
+}
+function encodeReserved(str) {
+  return str.split(/(%[0-9A-Fa-f]{2})/g).map(function(part) {
+    if (!/%[0-9A-Fa-f]/.test(part)) {
+      part = encodeURI(part).replace(/%5B/g, "[").replace(/%5D/g, "]");
+    }
+    return part;
+  }).join("");
+}
+function encodeUnreserved(str) {
+  return encodeURIComponent(str).replace(/[!'()*]/g, function(c) {
+    return "%" + c.charCodeAt(0).toString(16).toUpperCase();
+  });
+}
+function encodeValue(operator, value, key) {
+  value = operator === "+" || operator === "#" ? encodeReserved(value) : encodeUnreserved(value);
+  if (key) {
+    return encodeUnreserved(key) + "=" + value;
+  } else {
+    return value;
+  }
+}
+function isDefined(value) {
+  return value !== undefined && value !== null;
+}
+function isKeyOperator(operator) {
+  return operator === ";" || operator === "&" || operator === "?";
+}
+function getValues(context, operator, key, modifier) {
+  var value = context[key], result = [];
+  if (isDefined(value) && value !== "") {
+    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+      value = value.toString();
+      if (modifier && modifier !== "*") {
+        value = value.substring(0, parseInt(modifier, 10));
+      }
+      result.push(encodeValue(operator, value, isKeyOperator(operator) ? key : ""));
+    } else {
+      if (modifier === "*") {
+        if (Array.isArray(value)) {
+          value.filter(isDefined).forEach(function(value2) {
+            result.push(encodeValue(operator, value2, isKeyOperator(operator) ? key : ""));
+          });
+        } else {
+          Object.keys(value).forEach(function(k) {
+            if (isDefined(value[k])) {
+              result.push(encodeValue(operator, value[k], k));
+            }
+          });
+        }
+      } else {
+        const tmp = [];
+        if (Array.isArray(value)) {
+          value.filter(isDefined).forEach(function(value2) {
+            tmp.push(encodeValue(operator, value2));
+          });
+        } else {
+          Object.keys(value).forEach(function(k) {
+            if (isDefined(value[k])) {
+              tmp.push(encodeUnreserved(k));
+              tmp.push(encodeValue(operator, value[k].toString()));
+            }
+          });
+        }
+        if (isKeyOperator(operator)) {
+          result.push(encodeUnreserved(key) + "=" + tmp.join(","));
+        } else if (tmp.length !== 0) {
+          result.push(tmp.join(","));
+        }
+      }
+    }
+  } else {
+    if (operator === ";") {
+      if (isDefined(value)) {
+        result.push(encodeUnreserved(key));
+      }
+    } else if (value === "" && (operator === "&" || operator === "?")) {
+      result.push(encodeUnreserved(key) + "=");
+    } else if (value === "") {
+      result.push("");
+    }
+  }
+  return result;
+}
+function parseUrl(template) {
+  return {
+    expand: expand.bind(null, template)
+  };
+}
+function expand(template, context) {
+  var operators = ["+", "#", ".", "/", ";", "?", "&"];
+  template = template.replace(/\{([^\{\}]+)\}|([^\{\}]+)/g, function(_, expression, literal) {
+    if (expression) {
+      let operator = "";
+      const values = [];
+      if (operators.indexOf(expression.charAt(0)) !== -1) {
+        operator = expression.charAt(0);
+        expression = expression.substr(1);
+      }
+      expression.split(/,/g).forEach(function(variable) {
+        var tmp = /([^:\*]*)(?::(\d+)|(\*))?/.exec(variable);
+        values.push(getValues(context, operator, tmp[1], tmp[2] || tmp[3]));
+      });
+      if (operator && operator !== "+") {
+        var separator = ",";
+        if (operator === "?") {
+          separator = "&";
+        } else if (operator !== "#") {
+          separator = operator;
+        }
+        return (values.length !== 0 ? operator : "") + values.join(separator);
+      } else {
+        return values.join(",");
+      }
+    } else {
+      return encodeReserved(literal);
+    }
+  });
+  if (template === "/") {
+    return template;
+  } else {
+    return template.replace(/\/$/, "");
+  }
+}
+function parse(options) {
+  let method = options.method.toUpperCase();
+  let url = (options.url || "/").replace(/:([a-z]\w+)/g, "{$1}");
+  let headers = Object.assign({}, options.headers);
+  let body;
+  let parameters = omit(options, [
+    "method",
+    "baseUrl",
+    "url",
+    "headers",
+    "request",
+    "mediaType"
+  ]);
+  const urlVariableNames = extractUrlVariableNames(url);
+  url = parseUrl(url).expand(parameters);
+  if (!/^http/.test(url)) {
+    url = options.baseUrl + url;
+  }
+  const omittedParameters = Object.keys(options).filter((option) => urlVariableNames.includes(option)).concat("baseUrl");
+  const remainingParameters = omit(parameters, omittedParameters);
+  const isBinaryRequest = /application\/octet-stream/i.test(headers.accept);
+  if (!isBinaryRequest) {
+    if (options.mediaType.format) {
+      headers.accept = headers.accept.split(/,/).map((format) => format.replace(/application\/vnd(\.\w+)(\.v3)?(\.\w+)?(\+json)?$/, `application/vnd$1$2.${options.mediaType.format}`)).join(",");
+    }
+    if (url.endsWith("/graphql")) {
+      if (options.mediaType.previews?.length) {
+        const previewsFromAcceptHeader = headers.accept.match(/(?<![\w-])[\w-]+(?=-preview)/g) || [];
+        headers.accept = previewsFromAcceptHeader.concat(options.mediaType.previews).map((preview) => {
+          const format = options.mediaType.format ? `.${options.mediaType.format}` : "+json";
+          return `application/vnd.github.${preview}-preview${format}`;
+        }).join(",");
+      }
+    }
+  }
+  if (["GET", "HEAD"].includes(method)) {
+    url = addQueryParameters(url, remainingParameters);
+  } else {
+    if ("data" in remainingParameters) {
+      body = remainingParameters.data;
+    } else {
+      if (Object.keys(remainingParameters).length) {
+        body = remainingParameters;
+      }
+    }
+  }
+  if (!headers["content-type"] && typeof body !== "undefined") {
+    headers["content-type"] = "application/json; charset=utf-8";
+  }
+  if (["PATCH", "PUT"].includes(method) && typeof body === "undefined") {
+    body = "";
+  }
+  return Object.assign({ method, url, headers }, typeof body !== "undefined" ? { body } : null, options.request ? { request: options.request } : null);
+}
+function endpointWithDefaults(defaults, route, options) {
+  return parse(merge(defaults, route, options));
+}
+function withDefaults(oldDefaults, newDefaults) {
+  const DEFAULTS2 = merge(oldDefaults, newDefaults);
+  const endpoint2 = endpointWithDefaults.bind(null, DEFAULTS2);
+  return Object.assign(endpoint2, {
+    DEFAULTS: DEFAULTS2,
+    defaults: withDefaults.bind(null, DEFAULTS2),
+    merge: merge.bind(null, DEFAULTS2),
+    parse
+  });
+}
+var endpoint = withDefaults(null, DEFAULTS);
+
+// ../../node_modules/fast-content-type-parse/index.js
+var NullObject = function NullObject2() {};
+NullObject.prototype = Object.create(null);
+var paramRE = /; *([!#$%&'*+.^\w`|~-]+)=("(?:[\v\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\v\u0020-\u00ff])*"|[!#$%&'*+.^\w`|~-]+) */gu;
+var quotedPairRE = /\\([\v\u0020-\u00ff])/gu;
+var mediaTypeRE = /^[!#$%&'*+.^\w|~-]+\/[!#$%&'*+.^\w|~-]+$/u;
+var defaultContentType = { type: "", parameters: new NullObject };
+Object.freeze(defaultContentType.parameters);
+Object.freeze(defaultContentType);
+function safeParse(header) {
+  if (typeof header !== "string") {
+    return defaultContentType;
+  }
+  let index = header.indexOf(";");
+  const type = index !== -1 ? header.slice(0, index).trim() : header.trim();
+  if (mediaTypeRE.test(type) === false) {
+    return defaultContentType;
+  }
+  const result = {
+    type: type.toLowerCase(),
+    parameters: new NullObject
+  };
+  if (index === -1) {
+    return result;
+  }
+  let key;
+  let match;
+  let value;
+  paramRE.lastIndex = index;
+  while (match = paramRE.exec(header)) {
+    if (match.index !== index) {
+      return defaultContentType;
+    }
+    index += match[0].length;
+    key = match[1].toLowerCase();
+    value = match[2];
+    if (value[0] === '"') {
+      value = value.slice(1, value.length - 1);
+      quotedPairRE.test(value) && (value = value.replace(quotedPairRE, "$1"));
+    }
+    result.parameters[key] = value;
+  }
+  if (index !== header.length) {
+    return defaultContentType;
+  }
+  return result;
+}
+var $safeParse = safeParse;
+
+// ../../node_modules/@octokit/request-error/dist-src/index.js
+class RequestError extends Error {
+  name;
+  status;
+  request;
+  response;
+  constructor(message, statusCode, options) {
+    super(message);
+    this.name = "HttpError";
+    this.status = Number.parseInt(statusCode);
+    if (Number.isNaN(this.status)) {
+      this.status = 0;
+    }
+    if ("response" in options) {
+      this.response = options.response;
+    }
+    const requestCopy = Object.assign({}, options.request);
+    if (options.request.headers.authorization) {
+      requestCopy.headers = Object.assign({}, options.request.headers, {
+        authorization: options.request.headers.authorization.replace(/(?<! ) .*$/, " [REDACTED]")
+      });
+    }
+    requestCopy.url = requestCopy.url.replace(/\bclient_secret=\w+/g, "client_secret=[REDACTED]").replace(/\baccess_token=\w+/g, "access_token=[REDACTED]");
+    this.request = requestCopy;
+  }
+}
+
+// ../../node_modules/@octokit/request/dist-bundle/index.js
+var VERSION2 = "9.2.4";
+var defaults_default = {
+  headers: {
+    "user-agent": `octokit-request.js/${VERSION2} ${getUserAgent()}`
+  }
+};
+function isPlainObject2(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  if (Object.prototype.toString.call(value) !== "[object Object]")
+    return false;
+  const proto = Object.getPrototypeOf(value);
+  if (proto === null)
+    return true;
+  const Ctor = Object.prototype.hasOwnProperty.call(proto, "constructor") && proto.constructor;
+  return typeof Ctor === "function" && Ctor instanceof Ctor && Function.prototype.call(Ctor) === Function.prototype.call(value);
+}
+async function fetchWrapper(requestOptions) {
+  const fetch = requestOptions.request?.fetch || globalThis.fetch;
+  if (!fetch) {
+    throw new Error("fetch is not set. Please pass a fetch implementation as new Octokit({ request: { fetch }}). Learn more at https://github.com/octokit/octokit.js/#fetch-missing");
+  }
+  const log = requestOptions.request?.log || console;
+  const parseSuccessResponseBody = requestOptions.request?.parseSuccessResponseBody !== false;
+  const body = isPlainObject2(requestOptions.body) || Array.isArray(requestOptions.body) ? JSON.stringify(requestOptions.body) : requestOptions.body;
+  const requestHeaders = Object.fromEntries(Object.entries(requestOptions.headers).map(([name, value]) => [
+    name,
+    String(value)
+  ]));
+  let fetchResponse;
+  try {
+    fetchResponse = await fetch(requestOptions.url, {
+      method: requestOptions.method,
+      body,
+      redirect: requestOptions.request?.redirect,
+      headers: requestHeaders,
+      signal: requestOptions.request?.signal,
+      ...requestOptions.body && { duplex: "half" }
+    });
+  } catch (error) {
+    let message = "Unknown Error";
+    if (error instanceof Error) {
+      if (error.name === "AbortError") {
+        error.status = 500;
+        throw error;
+      }
+      message = error.message;
+      if (error.name === "TypeError" && "cause" in error) {
+        if (error.cause instanceof Error) {
+          message = error.cause.message;
+        } else if (typeof error.cause === "string") {
+          message = error.cause;
+        }
+      }
+    }
+    const requestError = new RequestError(message, 500, {
+      request: requestOptions
+    });
+    requestError.cause = error;
+    throw requestError;
+  }
+  const status = fetchResponse.status;
+  const url = fetchResponse.url;
+  const responseHeaders = {};
+  for (const [key, value] of fetchResponse.headers) {
+    responseHeaders[key] = value;
+  }
+  const octokitResponse = {
+    url,
+    status,
+    headers: responseHeaders,
+    data: ""
+  };
+  if ("deprecation" in responseHeaders) {
+    const matches = responseHeaders.link && responseHeaders.link.match(/<([^<>]+)>; rel="deprecation"/);
+    const deprecationLink = matches && matches.pop();
+    log.warn(`[@octokit/request] "${requestOptions.method} ${requestOptions.url}" is deprecated. It is scheduled to be removed on ${responseHeaders.sunset}${deprecationLink ? `. See ${deprecationLink}` : ""}`);
+  }
+  if (status === 204 || status === 205) {
+    return octokitResponse;
+  }
+  if (requestOptions.method === "HEAD") {
+    if (status < 400) {
+      return octokitResponse;
+    }
+    throw new RequestError(fetchResponse.statusText, status, {
+      response: octokitResponse,
+      request: requestOptions
+    });
+  }
+  if (status === 304) {
+    octokitResponse.data = await getResponseData(fetchResponse);
+    throw new RequestError("Not modified", status, {
+      response: octokitResponse,
+      request: requestOptions
+    });
+  }
+  if (status >= 400) {
+    octokitResponse.data = await getResponseData(fetchResponse);
+    throw new RequestError(toErrorMessage(octokitResponse.data), status, {
+      response: octokitResponse,
+      request: requestOptions
+    });
+  }
+  octokitResponse.data = parseSuccessResponseBody ? await getResponseData(fetchResponse) : fetchResponse.body;
+  return octokitResponse;
+}
+async function getResponseData(response) {
+  const contentType = response.headers.get("content-type");
+  if (!contentType) {
+    return response.text().catch(() => "");
+  }
+  const mimetype = $safeParse(contentType);
+  if (isJSONResponse(mimetype)) {
+    let text = "";
+    try {
+      text = await response.text();
+      return JSON.parse(text);
+    } catch (err) {
+      return text;
+    }
+  } else if (mimetype.type.startsWith("text/") || mimetype.parameters.charset?.toLowerCase() === "utf-8") {
+    return response.text().catch(() => "");
+  } else {
+    return response.arrayBuffer().catch(() => new ArrayBuffer(0));
+  }
+}
+function isJSONResponse(mimetype) {
+  return mimetype.type === "application/json" || mimetype.type === "application/scim+json";
+}
+function toErrorMessage(data) {
+  if (typeof data === "string") {
+    return data;
+  }
+  if (data instanceof ArrayBuffer) {
+    return "Unknown error";
+  }
+  if ("message" in data) {
+    const suffix = "documentation_url" in data ? ` - ${data.documentation_url}` : "";
+    return Array.isArray(data.errors) ? `${data.message}: ${data.errors.map((v) => JSON.stringify(v)).join(", ")}${suffix}` : `${data.message}${suffix}`;
+  }
+  return `Unknown error: ${JSON.stringify(data)}`;
+}
+function withDefaults2(oldEndpoint, newDefaults) {
+  const endpoint2 = oldEndpoint.defaults(newDefaults);
+  const newApi = function(route, parameters) {
+    const endpointOptions = endpoint2.merge(route, parameters);
+    if (!endpointOptions.request || !endpointOptions.request.hook) {
+      return fetchWrapper(endpoint2.parse(endpointOptions));
+    }
+    const request2 = (route2, parameters2) => {
+      return fetchWrapper(endpoint2.parse(endpoint2.merge(route2, parameters2)));
+    };
+    Object.assign(request2, {
+      endpoint: endpoint2,
+      defaults: withDefaults2.bind(null, endpoint2)
+    });
+    return endpointOptions.request.hook(request2, endpointOptions);
+  };
+  return Object.assign(newApi, {
+    endpoint: endpoint2,
+    defaults: withDefaults2.bind(null, endpoint2)
+  });
+}
+var request = withDefaults2(endpoint, defaults_default);
+
+// ../../node_modules/@octokit/graphql/dist-bundle/index.js
+var VERSION3 = "0.0.0-development";
+function _buildMessageForResponseErrors(data) {
+  return `Request failed due to following response errors:
+` + data.errors.map((e) => ` - ${e.message}`).join(`
+`);
+}
+var GraphqlResponseError = class extends Error {
+  constructor(request2, headers, response) {
+    super(_buildMessageForResponseErrors(response));
+    this.request = request2;
+    this.headers = headers;
+    this.response = response;
+    this.errors = response.errors;
+    this.data = response.data;
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, this.constructor);
+    }
+  }
+  name = "GraphqlResponseError";
+  errors;
+  data;
+};
+var NON_VARIABLE_OPTIONS = [
+  "method",
+  "baseUrl",
+  "url",
+  "headers",
+  "request",
+  "query",
+  "mediaType",
+  "operationName"
+];
+var FORBIDDEN_VARIABLE_OPTIONS = ["query", "method", "url"];
+var GHES_V3_SUFFIX_REGEX = /\/api\/v3\/?$/;
+function graphql(request2, query, options) {
+  if (options) {
+    if (typeof query === "string" && "query" in options) {
+      return Promise.reject(new Error(`[@octokit/graphql] "query" cannot be used as variable name`));
+    }
+    for (const key in options) {
+      if (!FORBIDDEN_VARIABLE_OPTIONS.includes(key))
+        continue;
+      return Promise.reject(new Error(`[@octokit/graphql] "${key}" cannot be used as variable name`));
+    }
+  }
+  const parsedOptions = typeof query === "string" ? Object.assign({ query }, options) : query;
+  const requestOptions = Object.keys(parsedOptions).reduce((result, key) => {
+    if (NON_VARIABLE_OPTIONS.includes(key)) {
+      result[key] = parsedOptions[key];
+      return result;
+    }
+    if (!result.variables) {
+      result.variables = {};
+    }
+    result.variables[key] = parsedOptions[key];
+    return result;
+  }, {});
+  const baseUrl = parsedOptions.baseUrl || request2.endpoint.DEFAULTS.baseUrl;
+  if (GHES_V3_SUFFIX_REGEX.test(baseUrl)) {
+    requestOptions.url = baseUrl.replace(GHES_V3_SUFFIX_REGEX, "/api/graphql");
+  }
+  return request2(requestOptions).then((response) => {
+    if (response.data.errors) {
+      const headers = {};
+      for (const key of Object.keys(response.headers)) {
+        headers[key] = response.headers[key];
+      }
+      throw new GraphqlResponseError(requestOptions, headers, response.data);
+    }
+    return response.data.data;
+  });
+}
+function withDefaults3(request2, newDefaults) {
+  const newRequest = request2.defaults(newDefaults);
+  const newApi = (query, options) => {
+    return graphql(newRequest, query, options);
+  };
+  return Object.assign(newApi, {
+    defaults: withDefaults3.bind(null, newRequest),
+    endpoint: newRequest.endpoint
+  });
+}
+var graphql2 = withDefaults3(request, {
+  headers: {
+    "user-agent": `octokit-graphql.js/${VERSION3} ${getUserAgent()}`
+  },
+  method: "POST",
+  url: "/graphql"
+});
+// ../../packages/aeg-forge-state/src/github-token.ts
+import { execFile as execFile2 } from "node:child_process";
+import { promisify as promisify2 } from "node:util";
+var execFileAsync2 = promisify2(execFile2);
+var systemEnv2 = {
+  ...process.env,
+  PATH: [process.env.PATH, "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].filter(Boolean).join(":")
+};
+async function resolveGithubToken(explicit) {
+  if (explicit && explicit.length > 0)
+    return explicit;
+  if (process.env.GITHUB_TOKEN)
+    return process.env.GITHUB_TOKEN;
+  if (process.env.GH_TOKEN)
+    return process.env.GH_TOKEN;
+  try {
+    const { stdout } = await execFileAsync2("gh", ["auth", "token"], { env: systemEnv2, timeout: 5000 });
+    const token = stdout.trim();
+    return token.length > 0 ? token : null;
+  } catch {
+    return null;
+  }
+}
+
+// ../../packages/aeg-forge-state/src/map-forge-facts.ts
+function mapForgeFacts(raw) {
+  if (!raw.issue)
+    return null;
+  return {
+    issueState: raw.issue.state === "OPEN" ? "open" : "closed",
+    assigned: raw.issue.assigneesCount > 0,
+    blockedLabel: hasLabel("blocked", raw.issue.labels),
+    branchExists: raw.refExists,
+    prState: mapPrState(raw.pullRequest?.state),
+    reviewDecision: mapReviewDecision(raw.pullRequest?.reviewDecision),
+    stateReason: mapStateReason(raw.issue.stateReason),
+    closedAt: raw.issue.closedAt ?? null,
+    mergedAt: raw.pullRequest?.mergedAt ?? null,
+    closedByActor: raw.closedByActor ?? null
+  };
+}
+function mapStateReason(reason) {
+  if (reason === "COMPLETED")
+    return "completed";
+  if (reason === "NOT_PLANNED")
+    return "not_planned";
+  return null;
+}
+function mapPrState(state) {
+  if (state === "OPEN")
+    return "open";
+  if (state === "MERGED")
+    return "merged";
+  return "none";
+}
+function mapReviewDecision(decision) {
+  if (decision === "APPROVED")
+    return "approved";
+  if (decision === "CHANGES_REQUESTED")
+    return "changes_requested";
+  return "none";
+}
+
+// ../../packages/aeg-forge-state/src/fetch-forge-facts.ts
+function buildBranchName(tranche, taskId) {
+  return `task/${tranche}/${taskId}`;
+}
+async function fetchForgeFacts(input) {
+  const token = await resolveGithubToken(input.token);
+  if (!token) {
+    return {
+      facts: new Map,
+      prRefs: new Map,
+      unavailable: true,
+      reason: "No GitHub token available (set GITHUB_TOKEN/GH_TOKEN or `gh auth login`)."
+    };
+  }
+  const queriedTasks = input.tasks.filter((t) => t.issue !== null);
+  if (queriedTasks.length === 0) {
+    return { facts: new Map, prRefs: new Map, unavailable: false };
+  }
+  const client = graphql2.defaults({ headers: { authorization: `bearer ${token}` } });
+  const query = buildBatchQuery(input.tranche, queriedTasks);
+  let response;
+  try {
+    response = await client(query, { owner: input.owner, repo: input.repo });
+  } catch (err) {
+    return {
+      facts: new Map,
+      prRefs: new Map,
+      unavailable: true,
+      reason: `GitHub query failed: ${describeError(err)}`
+    };
+  }
+  const facts = new Map;
+  const prRefs = new Map;
+  if (!response.repository) {
+    return {
+      facts,
+      prRefs,
+      unavailable: true,
+      reason: `Repository ${input.owner}/${input.repo} not visible to this token.`
+    };
+  }
+  for (const task of queriedTasks) {
+    const alias = aliasFor(task.id);
+    const raw = extractRawFromResponse(response.repository, alias);
+    const mapped = mapForgeFacts(raw);
+    if (mapped)
+      facts.set(task.id, mapped);
+    const pr = raw.pullRequest;
+    if (pr && typeof pr.number === "number" && typeof pr.url === "string") {
+      prRefs.set(task.id, { number: pr.number, url: pr.url, state: pr.state });
+    }
+  }
+  return { facts, prRefs, unavailable: false };
+}
+function buildBatchQuery(tranche, tasks) {
+  const perTask = tasks.map((task) => {
+    const a = aliasFor(task.id);
+    const branch = buildBranchName(tranche, task.id);
+    return `
+    ${a}_issue: issue(number: ${task.issue}) {
+      state
+      stateReason
+      closedAt
+      assignees(first: 1) { totalCount }
+      labels(first: 50) { nodes { name } }
+      timelineItems(last: 1, itemTypes: [CLOSED_EVENT]) {
+        nodes {
+          ... on ClosedEvent {
+            actor { login }
+            closer {
+              ... on PullRequest {
+                number
+                url
+                state
+                reviewDecision
+                mergedAt
+              }
+            }
+          }
+        }
+      }
+    }
+    ${a}_ref: ref(qualifiedName: ${JSON.stringify(`refs/heads/${branch}`)}) {
+      name
+    }
+    ${a}_prs: pullRequests(
+      first: 1,
+      headRefName: ${JSON.stringify(branch)},
+      orderBy: { field: CREATED_AT, direction: DESC }
+    ) {
+      nodes { number url state reviewDecision mergedAt }
+    }`;
+  }).join("");
+  return `query ForgeFacts($owner: String!, $repo: String!) {
+  repository(owner: $owner, name: $repo) {${perTask}
+  }
+}`;
+}
+function aliasFor(taskId) {
+  const sanitized = taskId.replace(/[^a-zA-Z0-9_]/g, "_");
+  return `t_${sanitized}`;
+}
+function extractRawFromResponse(repository, alias) {
+  const issue = repository[`${alias}_issue`];
+  const ref = repository[`${alias}_ref`];
+  const prs = repository[`${alias}_prs`];
+  const timelineNode = issue?.timelineItems?.nodes?.[0];
+  const rawCloser = timelineNode?.closer ?? null;
+  const closingPr = rawCloser && typeof rawCloser.number === "number" && typeof rawCloser.url === "string" ? rawCloser : null;
+  const branchPr = prs && prs.nodes.length > 0 && prs.nodes[0] ? prs.nodes[0] : null;
+  return {
+    issue: issue ? {
+      state: issue.state,
+      stateReason: issue.stateReason,
+      closedAt: issue.closedAt ?? null,
+      assigneesCount: issue.assignees.totalCount,
+      labels: issue.labels.nodes.map((n) => n.name)
+    } : null,
+    refExists: Boolean(ref && ref.name.length > 0),
+    pullRequest: closingPr ?? branchPr,
+    closedByActor: timelineNode?.actor?.login ?? null
+  };
+}
+function describeError(err) {
+  if (err instanceof Error)
+    return err.message;
+  if (typeof err === "string")
+    return err;
+  return "unknown error";
+}
+// ../../packages/aeg-forge-state/src/fetch-open-issues.ts
+async function fetchOpenIssuesByLabel(slugs, owner, repo, token) {
+  const result = new Map;
+  if (slugs.length === 0)
+    return result;
+  const client = graphql2.defaults({ headers: { authorization: `bearer ${token}` } });
+  const toAlias = (slug) => `tranche_${slug.replace(/-/g, "_")}`;
+  const perSlug = slugs.map((slug) => `
+    ${toAlias(slug)}: issues(states: [OPEN], labels: [${JSON.stringify(trancheLabel(slug))}], first: 100) {
+      nodes { number body labels(first: 20) { nodes { name } } }
+    }`).join("");
+  const query = `query LabeledIssues($owner: String!, $repo: String!) {
+  repository(owner: $owner, name: $repo) {${perSlug}
+  }
+}`;
+  let response;
+  try {
+    response = await client(query, { owner, repo });
+  } catch {
+    return result;
+  }
+  if (!response.repository)
+    return result;
+  for (const slug of slugs) {
+    const conn = response.repository[toAlias(slug)];
+    const issues = (conn?.nodes ?? []).map((n) => ({
+      number: n.number,
+      body: n.body ?? "",
+      labels: n.labels?.nodes?.map((l) => l.name) ?? []
+    }));
+    result.set(slug, issues);
+  }
+  return result;
+}
+// ../../packages/aeg-forge-state/src/fetch-task-issue-refs.ts
+async function fetchTaskIssueRefs(owner, repo, issueNumbers, token) {
+  const result = new Map;
+  if (issueNumbers.length === 0)
+    return result;
+  const resolvedToken = await resolveGithubToken(token);
+  if (!resolvedToken)
+    return result;
+  const client = graphql2.defaults({ headers: { authorization: `bearer ${resolvedToken}` } });
+  let response;
+  try {
+    response = await client(buildQuery(issueNumbers), { owner, repo });
+  } catch {
+    return result;
+  }
+  if (!response.repository)
+    return result;
+  for (const n of issueNumbers) {
+    const node = response.repository[aliasFor2(n)];
+    if (!node)
+      continue;
+    const labels = node.labels.nodes.map((l) => l.name);
+    result.set(n, resolveTaskIssueRef(node.title, labels));
+  }
+  return result;
+}
+function aliasFor2(n) {
+  return `i_${n}`;
+}
+function buildQuery(issueNumbers) {
+  const perIssue = issueNumbers.map((n) => `
+    ${aliasFor2(n)}: issue(number: ${n}) {
+      title
+      labels(first: 50) { nodes { name } }
+    }`).join("");
+  return `query TaskIssueRefs($owner: String!, $repo: String!) {
+  repository(owner: $owner, name: $repo) {${perIssue}
+  }
+}`;
+}
+// ../../packages/aeg-forge-state/src/resolve-repo.ts
+import { execFile as execFile3 } from "node:child_process";
+import { promisify as promisify3 } from "node:util";
+var execFileAsync3 = promisify3(execFile3);
+var systemEnv3 = {
+  ...process.env,
+  PATH: [process.env.PATH, "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].filter(Boolean).join(":")
+};
+// ../../packages/aeg-core/src/anchored-region.ts
+function anchoredRegionBounds(body, field) {
+  const masked = maskCode(body);
+  const start = new RegExp(`<!--\\s*AEG:${field}:START\\s*-->`).exec(masked);
+  if (!start)
+    return null;
+  const innerStart = start.index + start[0].length;
+  const end = new RegExp(`<!--\\s*AEG:${field}:END\\s*-->`).exec(masked.slice(innerStart));
+  if (!end)
+    return null;
+  const innerEnd = innerStart + end.index;
+  return { outerStart: start.index, outerEnd: innerEnd + end[0].length, innerStart, innerEnd };
+}
+function anchoredRegion(body, field) {
+  const bounds = anchoredRegionBounds(body, field);
+  if (!bounds)
+    return null;
+  return body.slice(bounds.innerStart, bounds.innerEnd);
+}
+// ../../packages/aeg-core/src/parse-registry.ts
+function parseRegistry(md) {
+  const rows = readMarkdownTable(md, /^##\s+Registry\b/i);
+  const projects = [];
+  for (const row of rows) {
+    if (row.length < 4)
+      continue;
+    const name = stripBackticks(row[0] ?? "").trim();
+    const path = stripBackticks(row[1] ?? "").trim();
+    const specsPath = stripBackticks(row[2] ?? "").trim();
+    const stateCell = (row[3] ?? "").trim();
+    if (!name || !path || !specsPath)
+      continue;
+    projects.push({
+      name,
+      path,
+      specsPath,
+      statePath: parseStateCell(stateCell)
+    });
+  }
+  return projects;
+}
+function parseStateCell(cell) {
+  if (!cell)
+    return null;
+  const stripped = stripBackticks(cell).trim();
+  if (/^[\w./@-]+\/?$/.test(stripped) && cell.includes("`")) {
+    return stripped;
+  }
+  return null;
+}
+function stripBackticks(s) {
+  return s.replace(/`/g, "");
+}
+function readMarkdownTable(md, headingMatcher) {
+  const lines = md.split(/\r?\n/);
+  let i = 0;
+  for (;i < lines.length; i++) {
+    if (headingMatcher.test(lines[i] ?? "")) {
+      i++;
+      break;
+    }
+  }
+  if (i >= lines.length)
+    return [];
+  for (;i < lines.length; i++) {
+    if ((lines[i] ?? "").trim().startsWith("|"))
+      break;
+  }
+  if (i + 1 >= lines.length)
+    return [];
+  i += 2;
+  const out = [];
+  for (;i < lines.length; i++) {
+    const trimmed = (lines[i] ?? "").trim();
+    if (!trimmed.startsWith("|"))
+      break;
+    out.push(splitTableRow(trimmed));
+  }
+  return out;
+}
+function splitTableRow(row) {
+  const PLACEHOLDER = "\x00PIPE\x00";
+  const escaped = row.replace(/\\\|/g, PLACEHOLDER);
+  const parts = escaped.split("|").map((s) => s.trim());
+  if (parts.length && parts[0] === "")
+    parts.shift();
+  if (parts.length && parts[parts.length - 1] === "")
+    parts.pop();
+  return parts.map((p) => p.split(PLACEHOLDER).join("|"));
+}
+// ../../packages/aeg-core/src/state-machine-model.ts
+var FORGE_FACT_INPUTS = [
+  {
+    fact: "issueState",
+    readsFrom: "Issue.state (OPEN | CLOSED)",
+    meaning: "Whether the task Issue is still open — the anchor for the honest terminal statuses."
+  },
+  {
+    fact: "assigned",
+    readsFrom: "Issue.assignees (count > 0)",
+    meaning: "An assignee exists. No longer affects derivation: assigned and unassigned are both todo."
+  },
+  {
+    fact: "branchExists",
+    readsFrom: "Ref refs/heads/task/<tranche>/<id>",
+    meaning: "A task branch has been published — the todo → in-flight transition, written by git push, not by hand."
+  },
+  {
+    fact: "prState",
+    readsFrom: "PullRequest.state (OPEN | CLOSED | MERGED)",
+    meaning: "Whether work is proposed or landed. CLOSED-without-merge collapses to none — AEG models open/merged/none."
+  },
+  {
+    fact: "reviewDecision",
+    readsFrom: "PullRequest.reviewDecision",
+    meaning: "Only 'changes_requested' flips status; approved-but-unmerged stays in-review."
+  },
+  {
+    fact: "blockedLabel",
+    readsFrom: `Issue.labels contains '${label("blocked")}'`,
+    meaning: "Execution halted pending an external unblock. Wins over every other rule."
+  },
+  {
+    fact: "stateReason",
+    readsFrom: "Issue.stateReason (COMPLETED | NOT_PLANNED | REOPENED | null)",
+    meaning: "Separates a legitimate drop from an incoherent close on a closed, never-merged Issue."
+  },
+  {
+    fact: "closedAt",
+    readsFrom: "Issue.closedAt",
+    meaning: "Timestamp for the coherence oracle grandfather cutoff. No derivation rule reads it."
+  },
+  {
+    fact: "mergedAt",
+    readsFrom: "PullRequest.mergedAt",
+    meaning: "Timestamp for the coherence oracle grandfather cutoff. No derivation rule reads it."
+  },
+  {
+    fact: "closedByActor",
+    readsFrom: "ClosedEvent.actor.login (most recent timeline CLOSED_EVENT)",
+    meaning: "GitHub login that hand-closed the Issue. No task-status derivation rule reads it — it is consumed by dispatch-gate.ts/coherence-checks.ts A1 to recognize a hand-closed dependency as resolved (task vinaya-engine-v1 21, #99), not by this status model."
+  }
+];
+var DERIVED_STATUSES = [
+  "backlog",
+  "todo",
+  "in-flight",
+  "in-review",
+  "changes-requested",
+  "merged",
+  "blocked",
+  "dropped",
+  "incoherent"
+];
+var DERIVABLE_STATUSES = DERIVED_STATUSES.filter((s) => s !== "backlog");
+// ../../packages/aeg-core/src/file-classify.ts
+function isCodeFile(p) {
+  if (p.endsWith(".md"))
+    return false;
+  return /\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs|sql|css)$/.test(p);
+}
+// ../../packages/aeg-core/src/waiver-label.ts
+var WAIVER_LABEL = label("waiver-docs");
+var WAIVER_LABEL_REVIEW = label("waiver-review");
+var PRINCIPAL_ALLOWLIST = ["daniboomerang"];
+function isPrincipal(login, principalAllowlist) {
+  if (login === null)
+    return false;
+  const normalized = login.toLowerCase();
+  return principalAllowlist.some((p) => p.toLowerCase() === normalized);
+}
+function isWaiverLabelActorVerified(opts) {
+  if (!opts.labels.includes(opts.label))
+    return false;
+  return isPrincipal(opts.labelActor, opts.principalAllowlist);
+}
+
+// ../../packages/aeg-core/src/doc-owners.ts
+var DOC_OWNERS_PATH = ".vinaya/doc-owners";
+function parseDocOwners(content) {
+  const bindings = [];
+  const errors = [];
+  const lines = content.split(`
+`);
+  for (let i = 0;i < lines.length; i++) {
+    const raw = lines[i] ?? "";
+    const stripped = raw.replace(/#.*$/, "").trim();
+    if (!stripped)
+      continue;
+    const parts = stripped.split(/\s+/);
+    if (parts.length < 2) {
+      errors.push(`C5 doc-owners-parse: ${DOC_OWNERS_PATH}:${i + 1} — malformed binding (expected "<glob>  <pointer>", got "${raw.trim()}").`);
+      continue;
+    }
+    const [glob, ...pointerParts] = parts;
+    bindings.push({ glob: glob ?? "", pointer: pointerParts.join(" "), lineNum: i + 1 });
+  }
+  return { bindings, errors };
+}
+function globToRegex(pat) {
+  let re = "^";
+  let i = 0;
+  while (i < pat.length) {
+    const c = pat[i];
+    if (c === "*") {
+      if (pat[i + 1] === "*") {
+        re += ".*";
+        i += 2;
+      } else {
+        re += "[^/]*";
+        i += 1;
+      }
+    } else if (/[.+^$|(){}[\]\\?]/.test(c)) {
+      re += `\\${c}`;
+      i += 1;
+    } else {
+      re += c;
+      i += 1;
+    }
+  }
+  re += "$";
+  return new RegExp(re);
+}
+function isUrlPointer(p) {
+  return /^https?:\/\//.test(p);
+}
+function pointerToPath(p) {
+  const idx = p.indexOf("#");
+  return idx === -1 ? p : p.slice(0, idx);
+}
+var SEPARATOR = /(?:[ \t]*[—–][ \t]*|[ \t]+-[ \t]+)/.source;
+function readPointerNoteField(body, field) {
+  const out = [];
+  const re = new RegExp(`^[ \\t]*${field}[ \\t]*:[ \\t]*(.+?)${SEPARATOR}(.+?)[ \\t]*$`, "gim");
+  for (const m of body.matchAll(re)) {
+    out.push({ surface: (m[1] ?? "").trim(), note: (m[2] ?? "").trim() });
+  }
+  return out;
+}
+function readDocAcks(body) {
+  return readPointerNoteField(body, "Doc-ack");
+}
+function readDocNeutrals(body) {
+  return readPointerNoteField(body, "Doc-neutral");
+}
+var LANGUAGE_COMMENT_PREFIXES = [
+  { test: /\.(ts|tsx|js|jsx|mjs|cjs)$/, prefixes: ["//"] },
+  { test: /(^|\/)(pre-push|pre-commit|pre-merge-commit)$/, prefixes: ["#"] },
+  { test: /\.(sh|bash)$/, prefixes: ["#"] },
+  { test: /\.ya?ml$/, prefixes: ["#"] },
+  { test: /\.py$/, prefixes: ["#"] }
+];
+function commentPrefixesForPath(path) {
+  for (const { test, prefixes } of LANGUAGE_COMMENT_PREFIXES) {
+    if (test.test(path))
+      return prefixes;
+  }
+  return [];
+}
+function isNeutralDiffContentLine(line, prefixes) {
+  const t = line.trim();
+  if (t === "")
+    return true;
+  if (t.startsWith("#!"))
+    return false;
+  return prefixes.some((p) => t.startsWith(p));
+}
+function isMechanicallyNeutralDiff(diffText, path) {
+  const prefixes = commentPrefixesForPath(path);
+  let sawChange = false;
+  for (const raw of diffText.split(`
+`)) {
+    if (raw.startsWith("+++ ") || raw.startsWith("--- ") || raw.startsWith("@@"))
+      continue;
+    if (raw.startsWith("+") || raw.startsWith("-")) {
+      if (!isNeutralDiffContentLine(raw.slice(1), prefixes))
+        return false;
+      sawChange = true;
+    }
+  }
+  return sawChange;
+}
+function evaluateC5(changed, docOwnersContent, prBody, fileExists, waiverActive, getDiff) {
+  const out = { errors: [], notes: [] };
+  if (docOwnersContent === null)
+    return out;
+  const { bindings, errors: parseErrors } = parseDocOwners(docOwnersContent);
+  for (const e of parseErrors)
+    out.errors.push(e);
+  if (bindings.length === 0)
+    return out;
+  const codeFiles = changed.filter(isCodeFile);
+  const fired = [];
+  for (const b of bindings) {
+    const re = globToRegex(b.glob);
+    const matchedFiles = codeFiles.filter((f) => re.test(f));
+    if (matchedFiles.length > 0)
+      fired.push({ binding: b, matchedFiles });
+  }
+  if (fired.length === 0)
+    return out;
+  const acks = readDocAcks(prBody);
+  const neutrals = readDocNeutrals(prBody);
+  for (const { binding: b, matchedFiles } of fired) {
+    if (waiverActive) {
+      out.notes.push(`C5 doc-waiver active for ${b.pointer} (binding ${DOC_OWNERS_PATH}:${b.lineNum})`);
+      continue;
+    }
+    if (isUrlPointer(b.pointer)) {
+      const acked = acks.some((a) => a.surface === b.pointer);
+      if (!acked) {
+        out.errors.push(`C5 doc-coverage: code change matched ${DOC_OWNERS_PATH}:${b.lineNum} (glob \`${b.glob}\` → ${b.pointer}). External pointer requires \`Doc-ack: ${b.pointer} — <note>\` in the PR body, or an actor-verified \`${WAIVER_LABEL}\` label to skip.`);
+      }
+      continue;
+    }
+    const pointerPath = pointerToPath(b.pointer);
+    if (!fileExists(pointerPath)) {
+      out.errors.push(`C5 doc-owners-dangling: ${DOC_OWNERS_PATH}:${b.lineNum} points to ${b.pointer}, which does not exist on disk. Fix the binding or add the doc.`);
+      continue;
+    }
+    if (changed.includes(pointerPath))
+      continue;
+    const declared = neutrals.find((n) => n.surface === b.pointer);
+    if (declared) {
+      const evidenced = getDiff !== undefined && matchedFiles.every((f) => {
+        const diff = getDiff(f);
+        return diff !== null && isMechanicallyNeutralDiff(diff, f);
+      });
+      if (evidenced) {
+        out.notes.push(`C5 doc-neutral: ${b.pointer} not required for ${DOC_OWNERS_PATH}:${b.lineNum} (glob \`${b.glob}\`) — declared neutral ("${declared.note}"), diff of ${matchedFiles.join(", ")} confirmed comment/whitespace-only.`);
+        continue;
+      }
+      out.errors.push(`C5 doc-neutral-unverified: ${DOC_OWNERS_PATH}:${b.lineNum} (glob \`${b.glob}\` → ${b.pointer}) declared \`Doc-neutral: ${b.pointer} — ${declared.note}\`, but the diff of ${matchedFiles.join(", ")} contains changes beyond comments/whitespace. Update ${pointerPath}, or have a principal apply the \`${WAIVER_LABEL}\` label.`);
+      continue;
+    }
+    out.errors.push(`C5 doc-coverage: code change matched ${DOC_OWNERS_PATH}:${b.lineNum} (glob \`${b.glob}\` → ${b.pointer}), but ${pointerPath} is not in the PR diff. Update it, declare \`Doc-neutral: ${b.pointer} — <why>\` if the change is genuinely mechanically-neutral, or have a principal apply the \`${WAIVER_LABEL}\` label.`);
+  }
+  return out;
+}
+// ../../packages/aeg-core/src/pr-tier.ts
+var TIER_FIELD = /(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i;
+function readTierFromPrBody(prBody) {
+  const searchIn = anchoredRegion(prBody, "TIER") ?? prBody;
+  const m = searchIn.match(TIER_FIELD);
+  if (!m)
+    return null;
+  const t = Number(m[4]);
+  return t === 0 || t === 1 || t === 3 ? t : null;
+}
+var OVERRIDE_BODY_TOKEN = `[${label("override-docs")}]`;
+function overrideActive(opts) {
+  if (opts.overrideDocsEnv === "1")
+    return true;
+  const labels = (opts.prLabels || "").split(",").map((s) => s.trim());
+  if (hasLabel("override-docs", labels))
+    return true;
+  if ((opts.prBody || "").includes(OVERRIDE_BODY_TOKEN))
+    return true;
+  return false;
+}
+// ../../packages/aeg-core/src/premise-check.ts
+var ASSERTION_KINDS = new Set(["contains", "absent", "sha256"]);
+
+// ../../packages/aeg-core/src/test-plan-section.ts
+var HEADING_FORM_RE = /^#{1,4}[ \t]*(?:\d+[a-z]?\.[ \t]*)?\*{0,2}Test Plan\*{0,2}[ \t]*$/im;
+var INLINE_FORM_RE = /^[ \t]*\*{0,2}Test Plan:?\*{0,2}/im;
+var NEXT_SECTION_RE = /\n(?:#{1,3}[ \t]|\*\*[A-Z][^*\n]*:\*\*)/;
+function locateTestPlanSection(body) {
+  const region = anchoredRegion(body, "TEST-PLAN");
+  if (region !== null)
+    return { found: true, section: region };
+  const headingMatch = HEADING_FORM_RE.exec(body);
+  const match = headingMatch ?? INLINE_FORM_RE.exec(body);
+  if (!match || match.index === undefined)
+    return { found: false };
+  const sectionBody = body.slice(match.index);
+  const firstLineEnd = sectionBody.indexOf(`
+`);
+  const searchFrom = firstLineEnd === -1 ? sectionBody.length : firstLineEnd + 1;
+  const nextMatch = sectionBody.slice(searchFrom).match(NEXT_SECTION_RE);
+  const sectionEnd = nextMatch ? searchFrom + (nextMatch.index ?? 0) : sectionBody.length;
+  return { found: true, section: sectionBody.slice(0, sectionEnd) };
+}
+
+// ../../packages/aeg-core/src/brief-validation.ts
+function headerRegion(prBody) {
+  const m = prBody.match(/^##\s/m);
+  return m?.index !== undefined ? prBody.slice(0, m.index) : prBody;
+}
+function headerField(prBody, labelPattern, anchor) {
+  const anchored = anchor !== undefined ? anchoredRegion(prBody, anchor) : null;
+  const region = anchored ?? headerRegion(prBody);
+  const re = new RegExp(`^(?:\\*\\*)?\\s*${labelPattern}\\s*(?:\\*\\*)?\\s*:\\s*(?:\\*\\*)?\\s*([^\\n·]+)`, "im");
+  const m = region.match(re);
+  if (!m)
+    return null;
+  const value = m[1].trim();
+  return value.length > 0 ? value : null;
+}
+function normalize(text) {
+  return text.replace(/[*_]/g, "").replace(/\s+/g, " ");
+}
+function headingCheck(prBody, keywordPattern, sectionName) {
+  const re = new RegExp(`^#{1,4}\\s*(?:\\*\\*)?(?:\\d+[a-z]?\\.\\s*)?[^\\n]*${keywordPattern}`, "im");
+  if (re.test(prBody))
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [`brief-validation ${sectionName}: no "${sectionName}" section found in the PR body.`]
+  };
+}
+function checkTierField(prBody, readTier) {
+  if (readTier(prBody) !== null)
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      "brief-validation tier: no `Tier:` field found in the PR body (expected `Tier: 0|1|3` or `**Tier:** 0|1|3`)."
+    ]
+  };
+}
+var TEST_PLAN_UNIT_TESTS_ONLY_RE = /(?:\*\*)?Test Plan(?:\*\*)?\s*:\s*(?:\*\*)?\s*unit-tests-only/i;
+function testPlanRegion(prBody) {
+  const located = locateTestPlanSection(prBody);
+  return located.found ? located.section : prBody;
+}
+function checkTestPlan(prBody) {
+  const region = testPlanRegion(prBody);
+  if (TEST_PLAN_UNIT_TESTS_ONLY_RE.test(region))
+    return { status: "pass", errors: [] };
+  if (/\*\*\[(?:agent|principal)\]\*\*/.test(region))
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      "brief-validation Test Plan: no Test Plan section found — expected `Test Plan: unit-tests-only`, or at least one `**[agent]**`/`**[principal]**`-tagged checklist item."
+    ]
+  };
+}
+function checkTestPlanExclusivity(prBody) {
+  const region = testPlanRegion(prBody);
+  if (!TEST_PLAN_UNIT_TESTS_ONLY_RE.test(region))
+    return { status: "pass", errors: [] };
+  if (/^-\s*\[[ xX]\]\s*\*{2}\[(?:agent|principal)\]\*{2}/im.test(region)) {
+    return {
+      status: "fail",
+      errors: [
+        "brief-validation Test Plan shape: `Test Plan: unit-tests-only` and a `- [ ]`/`- [x]` tagged checkbox item are mutually exclusive (brief-authoring §9) — declare one form, not both."
+      ]
+    };
+  }
+  return { status: "pass", errors: [] };
+}
+function checkPrincipalPlaceholder(prBody) {
+  const region = testPlanRegion(prBody);
+  const lineRe = /^-\s*\[[ xX]\]\s*\*{2}\[principal\]\*{2}(.*)$/gim;
+  for (const m of region.matchAll(lineRe)) {
+    const content = m[1] ?? "";
+    if (/^\s*None\b/i.test(content)) {
+      return {
+        status: "fail",
+        errors: [
+          'brief-validation Test Plan shape: a `**[principal]**` checkbox item is a "None" placeholder — if there is no principal-runnable surface, omit the item entirely; an untickable placeholder box blocks the merge gate forever.'
+        ]
+      };
+    }
+  }
+  return { status: "pass", errors: [] };
+}
+function checkSurfaceMap(prBody) {
+  return headingCheck(prBody, "(?:technical\\s+)?surface map", "Technical surface map");
+}
+function checkDocUpdateList(prBody) {
+  return headingCheck(prBody, "(?:documentation|doc)[- ]update(?:\\s+list)?", "Documentation-update list");
+}
+function checkWorktreeStep0(prBody) {
+  if (/git worktree add/.test(prBody))
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: ["brief-validation worktree Step 0: no `git worktree add` command found in the PR body."]
+  };
+}
+function checkStopConditions(prBody) {
+  return headingCheck(prBody, "stop conditions", "Stop conditions");
+}
+function checkAutonomyClause(prBody) {
+  const normalized = normalize(prBody).toLowerCase();
+  if (/do not stop to ask clarifying questions/.test(normalized))
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      'brief-validation autonomy clause: the standing autonomy clause ("Do not stop to ask clarifying questions...") was not found in the PR body.'
+    ]
+  };
+}
+function checkProjectField(prBody) {
+  if (headerField(prBody, "Project(?:\\(s\\))?", "PROJECT") !== null)
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      "brief-validation Project: no `Project:` field found in the PR body header block (before the first `##` heading). Required per the brief-developer contract — expected `Project: <name>[, <name>]` or `**Project:** …`."
+    ]
+  };
+}
+function checkForField(prBody) {
+  if (headerField(prBody, "For") !== null)
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      "brief-validation For: no `For:` field found in the PR body header block (before the first `##` heading). Required per the brief-authoring skill — expected `For: <model + environment>` or `**For:** …`."
+    ]
+  };
+}
+function checkClosesN(prBody) {
+  const closesPattern = /(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s{0,8}:?\s{0,8}#\d+/i;
+  if (closesPattern.test(stripCode(prBody))) {
+    return { status: "pass", errors: [] };
+  }
+  if (closesPattern.test(prBody)) {
+    return {
+      status: "fail",
+      errors: [
+        "brief-validation Closes #N: `Closes #N` found only inside a code span — GitHub won't auto-close it. Put a bare `Closes #N` on its own line inside the `AEG:CLOSES` anchor."
+      ]
+    };
+  }
+  return {
+    status: "fail",
+    errors: ["brief-validation Closes #N: no `Closes #<N>` (or Fixes/Resolves) reference found in the PR body."]
+  };
+}
+var BRIEF_SHAPE_MARKERS = [checkSurfaceMap, checkDocUpdateList, checkStopConditions, checkAutonomyClause];
+var TASK_BRANCH_PATTERN = /^task\/[^/]+\/[^/]+$/;
+function isTaskBranch(branch) {
+  return TASK_BRANCH_PATTERN.test(branch);
+}
+function isBriefShaped(prBody) {
+  const stripped = stripCode(prBody);
+  return BRIEF_SHAPE_MARKERS.filter((check) => check(stripped).status === "pass").length >= 2;
+}
+function checkBriefSections(prBody, readTier, options = {}) {
+  const { requireClosesN = true } = options;
+  const results = [
+    checkTierField(prBody, readTier),
+    checkTestPlan(prBody),
+    checkTestPlanExclusivity(prBody),
+    checkPrincipalPlaceholder(prBody),
+    checkSurfaceMap(prBody),
+    checkDocUpdateList(prBody),
+    checkWorktreeStep0(prBody),
+    checkStopConditions(prBody),
+    checkAutonomyClause(prBody),
+    checkProjectField(prBody),
+    checkForField(prBody),
+    ...requireClosesN ? [checkClosesN(prBody)] : []
+  ];
+  return { errors: results.flatMap((r) => r.errors) };
+}
+// ../../packages/aeg-core/src/issue-validation.ts
+function hasRationaleField(body, labelPattern) {
+  const re = new RegExp(`(?:\\*\\*|^#{1,4}\\s+)\\s*(?:${labelPattern})`, "im");
+  return re.test(body);
+}
+var RATIONALE_FIELDS = [
+  { name: "Boundary", pattern: "Boundary" },
+  { name: "Sizing", pattern: "Sizing" },
+  { name: "Project(s) + blast radius", pattern: "Project\\(s\\)|Project(?:s)?\\s*\\+|blast radius" },
+  { name: "Dependency rationale", pattern: "Dependency rationale|Depends[- ]on" },
+  { name: "Traps to avoid", pattern: "Traps" },
+  { name: "Suggested agent-class", pattern: "(?:Suggested\\s+)?agent-class" },
+  { name: "Stop-and-escalate", pattern: "Stop-and-escalate" },
+  { name: "Docs to keep coherent", pattern: "Docs to keep coherent|§7" }
+];
+var DEPENDENCY_RATIONALE_FIELD_NAME = "Dependency rationale";
+function checkIssueRationale(body) {
+  const errors = [];
+  for (const f of RATIONALE_FIELDS) {
+    if (!hasRationaleField(body, f.pattern)) {
+      errors.push(`issue-validation ${f.name}: rationale field not found in the Issue body — every task Issue carries the full Planner's rationale (aeg-root/contracts/planner-brief.md).`);
+      continue;
+    }
+    if (f.name === DEPENDENCY_RATIONALE_FIELD_NAME && !SECTION_HEADER.test(body)) {
+      errors.push(`issue-validation ${f.name}: rationale field found, but not in the form amend-deps requires — ` + "write `**Dependency rationale** — …`, not `**Dependency rationale:** …`. " + "`amendRationaleDeps` (the only sanctioned way to edit Depends-on/Conflicts-with) locates this " + "section by the exact anchor `**Dependency rationale**`; a colon inside the bold breaks that match " + "and the Issue becomes unamendable.");
+    }
+  }
+  return { status: errors.length > 0 ? "fail" : "pass", errors };
+}
+function isTaskIssueLabelSet(labels) {
+  return hasLabel("tranche", labels);
+}
+function isControlCodePoint(codePoint) {
+  return codePoint <= 31 || codePoint >= 127 && codePoint <= 159;
+}
+function isDisplayControlCodePoint(codePoint) {
+  return codePoint >= 8203 && codePoint <= 8207 || codePoint >= 8234 && codePoint <= 8238 || codePoint >= 8294 && codePoint <= 8297 || codePoint === 65279;
+}
+var MESSAGE_VALUE_COUNT_MAX = 5;
+function residueForMessage(values) {
+  const shown = values.slice(0, MESSAGE_VALUE_COUNT_MAX).map((v) => `\`${forMessage(v)}\``);
+  const rest = values.length - shown.length;
+  return rest > 0 ? `${shown.join(", ")} and ${rest} more` : shown.join(", ");
+}
+var MESSAGE_VALUE_MAX = 64;
+function forMessage(value) {
+  const kept = [];
+  for (const ch of value.replace(/\s+/g, " ")) {
+    const codePoint = ch.codePointAt(0) ?? 0;
+    if (isControlCodePoint(codePoint) || isDisplayControlCodePoint(codePoint))
+      continue;
+    kept.push(ch);
+  }
+  const cleaned = kept.join("").trim();
+  if (cleaned.length === 0)
+    return "(unprintable)";
+  const points = Array.from(cleaned);
+  return points.length > MESSAGE_VALUE_MAX ? `${points.slice(0, MESSAGE_VALUE_MAX).join("")}…` : cleaned;
+}
+function checkProjectsRegistered(body, _labels, registeredNames) {
+  if (registeredNames.length === 0)
+    return { status: "pass", errors: [] };
+  const field = projectFieldFromBody(body);
+  if (!field.declared)
+    return { status: "pass", errors: [] };
+  const known = new Set(registeredNames.map((n) => n.trim()));
+  const registeredList = [...registeredNames].map(forMessage).join(", ");
+  const errors = [];
+  if (field.unreadable) {
+    return {
+      status: "fail",
+      errors: [
+        `issue-validation project registry: the body has an unterminated code fence, so its \`**Project:**\` field could not be read reliably — the fence runs to end of body (CommonMark, and how the forge renders it), swallowing everything after it including the foot field where the declaration lives by convention. Read from the raw body the field says ${residueForMessage(field.unparsed) || "(nothing)"}, but a line inside a swallowed region may be a quoted example rather than a real declaration, so this gate refuses rather than guessing which. Balance the fences — every opening run of backticks or tildes needs a closing run at least as long — and the field reads normally.`
+      ]
+    };
+  }
+  const unregistered = field.names.filter((p) => !known.has(p));
+  if (unregistered.length > 0) {
+    const caseHints = unregistered.map((p) => {
+      const row = [...known].find((k) => k.toLowerCase() === p.toLowerCase());
+      return row ? `\`${forMessage(p)}\` differs from the registered \`${forMessage(row)}\` only in case` : null;
+    }).filter((h) => h !== null);
+    errors.push(`issue-validation project registry: the \`**Project:**\` field declares ${unregistered.map(forMessage).join(", ")} — no such row in \`.vinaya/projects.md\`, which is the authority for valid project names (registered: ${registeredList}). Fix the name, or register the project with \`vinaya init product <name> --path <folder>\` first; an unregistered project has no specs to read and no per-project state to update.${caseHints.length > 0 ? ` Note: ${caseHints.join("; ")} — project names are matched exactly, because every downstream consumer compares them literally.` : ""} This reads the same field \`projectsFromBody\` derives the task's project from, so a name here that is not a row is a task that resolves to a project that does not exist.`);
+  }
+  if (field.names.length === 0) {
+    const residue = field.unparsed.length > 0 ? ` — ${residueForMessage(field.unparsed)}` : " — the field is empty";
+    errors.push(`issue-validation project registry: the \`**Project:**\` field is present but resolves to no project name${residue} (registered: ${registeredList}). A project name is a slug (\`[a-z0-9][a-z0-9-]*\`, matched exactly); prose, a parenthetical, or a sentence in this field resolves to no project at all, and this gate cannot check a name it never receives — which is how a declaration like this used to pass. Write the registered name on its own, or register the project with \`vinaya init product <name> --path <folder>\` first. If the task genuinely touches no registered project, omit the field rather than explaining its absence inside it — \`checkIssueRationale\` already requires the \`Project(s) + blast radius\` narrative field for that.`);
+  } else if (field.unparsed.length > 0) {
+    errors.push(`issue-validation project registry: the \`**Project:**\` field declares a value that is not a project name — ${residueForMessage(field.unparsed)} (registered: ${registeredList}). The rest of the field parsed, so this is a name the gate silently could not check rather than a field it could not read at all. A project name is a slug (\`[a-z0-9][a-z0-9-]*\`, matched exactly); write it on its own, or drop it if it names no project.`);
+  }
+  return errors.length > 0 ? { status: "fail", errors } : { status: "pass", errors: [] };
+}
+
+// ../../packages/aeg-core/src/coherence-checks.ts
+var COHERENCE_ENFORCED_FROM = "2026-07-01";
+function isGrandfathered(isoDate) {
+  if (!isoDate)
+    return false;
+  return isoDate.slice(0, 10) < COHERENCE_ENFORCED_FROM;
+}
+var R1_GRANDFATHERED_ISSUES = new Set([279, 280, 281, 282]);
+function checkA1(entries, principalAllowlist = PRINCIPAL_ALLOWLIST) {
+  const failures = [];
+  for (const e of entries) {
+    if (!e.facts)
+      continue;
+    if (e.facts.stateReason === "not_planned")
+      continue;
+    if (e.facts.issueState === "closed" && e.facts.prState !== "merged") {
+      const handClosed = e.facts.stateReason === "completed" && isPrincipal(e.facts.closedByActor, principalAllowlist);
+      if (handClosed)
+        continue;
+      failures.push({
+        issue: e.task.issue,
+        tranche: e.trancheSlug,
+        task: e.task.id,
+        reason: `Issue closed but closing PR is not merged (prState: ${e.facts.prState})`,
+        grandfathered: isGrandfathered(e.facts.closedAt)
+      });
+    }
+  }
+  const activeFails = failures.filter((f) => !f.grandfathered);
+  const status = activeFails.length > 0 ? "fail" : failures.length > 0 ? "info" : "pass";
+  return {
+    check: "A1",
+    status,
+    failures,
+    note: status === "info" ? `${failures.length} grandfathered (pre-${COHERENCE_ENFORCED_FROM})` : undefined
+  };
+}
+function checkA3(entries) {
+  const failures = [];
+  for (const e of entries) {
+    if (!e.facts)
+      continue;
+    if (e.facts.prState === "merged" && e.facts.issueState !== "closed") {
+      failures.push({
+        issue: e.task.issue,
+        tranche: e.trancheSlug,
+        task: e.task.id,
+        reason: "Closing PR is merged but Issue is still open (GitHub auto-close misfire)",
+        grandfathered: isGrandfathered(e.facts.mergedAt)
+      });
+    }
+  }
+  const activeFails = failures.filter((f) => !f.grandfathered);
+  const status = activeFails.length > 0 ? "fail" : failures.length > 0 ? "info" : "pass";
+  return {
+    check: "A3",
+    status,
+    failures,
+    note: status === "info" ? `${failures.length} grandfathered (pre-${COHERENCE_ENFORCED_FROM})` : undefined
+  };
+}
+function checkT1(entries) {
+  const failures = [];
+  for (const e of entries) {
+    if (e.task.issue === null)
+      continue;
+    if (e.facts === undefined) {
+      failures.push({
+        issue: e.task.issue,
+        tranche: e.trancheSlug,
+        task: e.task.id,
+        reason: `Issue #${e.task.issue} in topology does not resolve to a real GitHub Issue`
+      });
+    }
+  }
+  return { check: "T1", status: failures.length > 0 ? "fail" : "pass", failures };
+}
+function checkT2(openIssuesBySlug, topologyIssuesBySlug, ciTrancheSlug) {
+  const failures = [];
+  for (const [slug, openNums] of openIssuesBySlug) {
+    if (ciTrancheSlug && slug !== ciTrancheSlug)
+      continue;
+    const topologySet = topologyIssuesBySlug.get(slug) ?? new Set;
+    for (const num of openNums) {
+      if (!topologySet.has(num)) {
+        failures.push({
+          issue: num,
+          tranche: slug,
+          reason: `Issue #${num} is open and labeled ${trancheLabel(slug)} but does not appear in the topology file`
+        });
+      }
+    }
+  }
+  return { check: "T2", status: failures.length > 0 ? "fail" : "pass", failures };
+}
+function scopeT2ToPlanPr(result, isPlanPr) {
+  if (isPlanPr || result.status !== "fail")
+    return result;
+  return {
+    ...result,
+    status: "info",
+    note: result.note ?? "T2 findings are non-blocking outside plan PRs (point-of-power principle) — see aeg-root/enforcement.md."
+  };
+}
+function checkT3(entries, ciTrancheSlug, enrichedEntries, forgeUnavailableSlugs) {
+  const preEnforcement = new Set;
+  if (enrichedEntries) {
+    for (const e of enrichedEntries) {
+      if (isGrandfathered(e.facts?.closedAt) || isGrandfathered(e.facts?.mergedAt)) {
+        preEnforcement.add(e.trancheSlug);
+      }
+    }
+  }
+  const failures = [];
+  for (const e of entries) {
+    if (!e.archived && e.task.issue === null) {
+      if (ciTrancheSlug && e.trancheSlug !== ciTrancheSlug)
+        continue;
+      if (forgeUnavailableSlugs?.has(e.trancheSlug)) {
+        failures.push({
+          issue: null,
+          tranche: e.trancheSlug,
+          task: e.task.id,
+          reason: `Task ${e.task.id} in active tranche has no Issue ref (#TBD or empty), but forge data for tranche "${e.trancheSlug}" was unavailable — cannot evaluate grandfather status, not silently failed`,
+          grandfathered: true
+        });
+        continue;
+      }
+      failures.push({
+        issue: null,
+        tranche: e.trancheSlug,
+        task: e.task.id,
+        reason: `Task ${e.task.id} in active tranche has no Issue ref (#TBD or empty) — the model requires all active tasks to have Issue numbers`,
+        grandfathered: preEnforcement.has(e.trancheSlug)
+      });
+    }
+  }
+  const activeFails = failures.filter((f) => !f.grandfathered);
+  const status = activeFails.length > 0 ? "fail" : failures.length > 0 ? "info" : "pass";
+  return {
+    check: "T3",
+    status,
+    failures,
+    note: status === "info" ? `${failures.length} grandfathered (pre-${COHERENCE_ENFORCED_FROM})` : undefined
+  };
+}
+function checkD1(entries, issueToEntry, taskToEntry) {
+  const failures = [];
+  for (const e of entries) {
+    if (!e.facts)
+      continue;
+    if (e.facts.prState !== "open")
+      continue;
+    for (const dep of e.task.dependsOn) {
+      const depEntry = resolveDepEntry(dep, e.trancheSlug, issueToEntry, taskToEntry);
+      if (!depEntry)
+        continue;
+      const depFacts = depEntry.facts;
+      const depClosed = depFacts?.issueState === "closed";
+      if (!depClosed) {
+        failures.push({
+          issue: e.task.issue,
+          tranche: e.trancheSlug,
+          task: e.task.id,
+          reason: `Task has open PR but depends-on ${dep} (issue #${depEntry.task.issue ?? "?"}) is not closed`
+        });
+      }
+    }
+  }
+  return { check: "D1", status: failures.length > 0 ? "fail" : "pass", failures };
+}
+function resolveDepEntry(dep, trancheSlug, issueToEntry, taskToEntry) {
+  const issueMatch = dep.match(/^#(\d+)$/);
+  if (issueMatch?.[1])
+    return issueToEntry.get(Number(issueMatch[1]));
+  return taskToEntry.get(`${trancheSlug}/${dep}`) ?? taskToEntry.get(dep);
+}
+function checkR1(issuesBySlug, grandfatheredIssues, registeredNames = []) {
+  const failures = [];
+  for (const [slug, issues] of issuesBySlug) {
+    for (const issue of issues) {
+      if (!isTaskIssueLabelSet(issue.labels))
+        continue;
+      const errors = [
+        ...checkIssueRationale(issue.body).errors,
+        ...checkProjectsRegistered(issue.body, issue.labels, registeredNames).errors
+      ];
+      if (errors.length === 0)
+        continue;
+      failures.push({
+        issue: issue.number,
+        tranche: slug,
+        reason: `Issue #${issue.number} fails the rationale gate: ${errors.join(" | ")}`,
+        grandfathered: grandfatheredIssues.has(issue.number)
+      });
+    }
+  }
+  const activeFails = failures.filter((f) => !f.grandfathered);
+  const status = activeFails.length > 0 ? "fail" : failures.length > 0 ? "info" : "pass";
+  return {
+    check: "R1",
+    status,
+    failures,
+    note: status === "info" ? `${failures.length} grandfathered task Issue(s) predate this check's grammar (rationale fields and/or the project registry)` : undefined
+  };
+}
+function checkL1(files, entriesBySlug) {
+  const failures = [];
+  for (const f of files) {
+    if (f.archived)
+      continue;
+    const entries = entriesBySlug.get(f.slug) ?? [];
+    const withFacts = entries.filter((e) => e.facts !== undefined);
+    if (withFacts.length === 0)
+      continue;
+    const allClosed = withFacts.every((e) => e.facts?.issueState === "closed");
+    if (allClosed) {
+      failures.push({
+        tranche: f.slug,
+        reason: "Active tranche has no open task-Issues — consider archiving to completed/"
+      });
+    }
+  }
+  return {
+    check: "L1",
+    status: "info",
+    failures,
+    note: failures.length > 0 ? `${failures.length} active tranche(s) with no open task-Issues — consider archiving (advisory)` : undefined
+  };
+}
+function checkL3(files) {
+  const active = files.filter((f) => !f.archived);
+  return {
+    check: "L3",
+    status: "info",
+    failures: [],
+    note: `${active.length} active tranche(s): ${active.map((f) => f.slug).join(", ") || "(none)"}`
+  };
+}
+function extractClosesReferences(prBody) {
+  const closesPattern = /(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s{0,8}:?\s{0,8}#(\d+)/gi;
+  const stripped = stripCode(prBody);
+  const searchIn = anchoredRegion(stripped, "CLOSES") ?? stripped;
+  const referenced = new Set;
+  for (const hit of searchIn.matchAll(closesPattern)) {
+    referenced.add(Number(hit[1]));
+  }
+  return referenced;
+}
+function checkClosesN2(branch, prBody, trancheFiles, taskIssueRefs) {
+  const referenced = extractClosesReferences(prBody);
+  if (taskIssueRefs) {
+    for (const n of referenced) {
+      const ref = taskIssueRefs.get(n);
+      if (!ref)
+        continue;
+      const expectedBranch = `task/${ref.trancheSlug}/${ref.taskId}`;
+      if (branch !== expectedBranch) {
+        return {
+          ok: false,
+          message: `closes-n-reverse: branch "${branch}" closes #${n} (task ${ref.taskId} of tranche "${ref.trancheSlug}") but is not named "${expectedBranch}" — rename the branch and re-push, or if this work is intentionally outside AEG's dispatch flow, remove the Closes reference.`
+        };
+      }
+    }
+  }
+  const m = branch.match(/^task\/([^/]+)\/([^/]+)$/);
+  if (!m)
+    return { ok: true };
+  const trancheSlug = m[1];
+  const taskId = m[2];
+  const trancheFile = trancheFiles.find((f) => f.slug === trancheSlug);
+  if (!trancheFile) {
+    return {
+      ok: false,
+      message: `closes-n: branch "${branch}" references tranche "${trancheSlug}" but no topology file found at aeg-root/tranches/${trancheSlug}.md. Ensure the tranche file exists before opening the PR.`
+    };
+  }
+  const task = trancheFile.tranche.tasks.find((t) => t.id === taskId);
+  if (!task) {
+    return {
+      ok: false,
+      message: `closes-n: branch "${branch}" references task "${taskId}" not found in ${trancheSlug} topology. Verify the task ID matches the tranche file.`
+    };
+  }
+  if (task.issue === null) {
+    return {
+      ok: false,
+      message: `closes-n: task "${taskId}" in "${trancheSlug}" has no Issue number (#TBD). The Planner must cut the Issue before this PR can be validated.`
+    };
+  }
+  const expectedIssue = task.issue;
+  if (!referenced.has(expectedIssue)) {
+    return {
+      ok: false,
+      expectedIssue,
+      message: `closes-n: PR body does not contain \`Closes #${expectedIssue}\` (required for task "${taskId}" in tranche "${trancheSlug}"). Add it to the PR body Summary section.`
+    };
+  }
+  return { ok: true, expectedIssue };
+}
+// ../../packages/aeg-core/src/verdict-extraction.ts
+var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
+function extractHeadSha(comment) {
+  const m = comment.match(HEAD_SHA_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
+function extractVerdict(comments, valuePattern, missingLabel) {
+  const clearHits = comments.filter((c) => valuePattern.test(c));
+  if (clearHits.length > 0) {
+    const latest = clearHits[clearHits.length - 1];
+    const m = latest.match(valuePattern);
+    return {
+      value: m[1].toUpperCase().replace(/[_-]/g, " "),
+      headSha: extractHeadSha(latest),
+      danglingNote: null
+    };
+  }
+  return {
+    value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
+    headSha: null,
+    danglingNote: `no ${missingLabel} verdict comment found on this PR`
+  };
+}
+function extractCodeReviewVerdict(comments) {
+  return extractVerdict(comments, /^[ \t]*(?:\*{1,3}|_{1,3})?VERDICT:\s*(APPROVE|REQUEST[ _-]?CHANGES|LGTM)(?![A-Za-z0-9])/im, "code-reviewer");
+}
+function extractSecurityReviewVerdict(comments) {
+  return extractVerdict(comments, /^[ \t]*(?:\*{1,3}|_{1,3})?VERDICT:\s*(PASS|FAIL)(?![A-Za-z0-9])/im, "security-review");
+}
+// ../../packages/aeg-core/src/review-gate.ts
+function isBoundToHead(extraction, headSha) {
+  if (!extraction.headSha)
+    return false;
+  return headSha.toLowerCase().startsWith(extraction.headSha.toLowerCase());
+}
+function checkReviewGate(input) {
+  const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
+  const waived = isWaiverLabelActorVerified({
+    label: WAIVER_LABEL_REVIEW,
+    labels: input.labels,
+    labelActor: input.waiverLabelActor,
+    principalAllowlist
+  });
+  if (waived) {
+    return {
+      verdict: "pass",
+      reason: `\`${WAIVER_LABEL_REVIEW}\` label is actor-verified — review requirement waived for this PR.`,
+      waived: true
+    };
+  }
+  const verified = input.comments.filter((c) => isPrincipal(c.author, principalAllowlist));
+  const ignoredCount = input.comments.filter((c) => !isPrincipal(c.author, principalAllowlist) && c.body.includes("VERDICT")).length;
+  const verifiedBodies = verified.map((c) => c.body);
+  const codeReview = extractCodeReviewVerdict(verifiedBodies);
+  const security = extractSecurityReviewVerdict(verifiedBodies);
+  const codeReviewClean = codeReview.value === "APPROVE";
+  const securityClean = security.value === "PASS";
+  const codeReviewBound = isBoundToHead(codeReview, input.headSha);
+  const securityBound = isBoundToHead(security, input.headSha);
+  if (codeReviewClean && codeReviewBound && securityClean && securityBound) {
+    return {
+      verdict: "pass",
+      reason: `code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS, both covering head ${input.headSha}.`,
+      waived: false
+    };
+  }
+  const problems = [];
+  if (!codeReviewClean) {
+    problems.push(`code-reviewer verdict is not a clean APPROVE (found: ${codeReview.value})`);
+  } else if (!codeReviewBound) {
+    problems.push(`the newest code-review verdict covers ${codeReview.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
+  if (!securityClean) {
+    problems.push(`security-review verdict is not a clean PASS (found: ${security.value})`);
+  } else if (!securityBound) {
+    problems.push(`the newest security-review verdict covers ${security.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
+  const ignoredNote = ignoredCount > 0 ? ` ${ignoredCount} verdict-shaped comment(s) from authors outside the principal allowlist were ignored.` : "";
+  return {
+    verdict: "fail",
+    reason: `${problems.join("; ")}. A principal can apply an actor-verified \`${WAIVER_LABEL_REVIEW}\` label to skip this requirement, or post the missing/clean verdict comment(s).${ignoredNote}`,
+    waived: false
+  };
+}
+var CHANGESET_RELEASE_BRANCH = "changeset-release/main";
+var DEFAULT_RELEASE_ACTOR = "github-actions[bot]";
+function isChangesetsReleasePr(branch, author, expectedAuthor) {
+  return branch === CHANGESET_RELEASE_BRANCH && author === expectedAuthor;
+}
+// ../../packages/aeg-core/src/markdown-table.ts
+function splitRow(line) {
+  const trimmed = line.trim().replace(/^\|/, "").replace(/\|$/, "");
+  return trimmed.split("|").map((cell) => cell.trim());
+}
+var TABLE_ROW_PATTERN = /^\s*\|.*\|\s*$/;
+var SEPARATOR_ROW_PATTERN = /^\s*\|?\s*:?-+:?\s*(\|\s*:?-+:?\s*)*\|?\s*$/;
+function findTable(lines, fromLine, stopAtHeading = true) {
+  let i = fromLine - 1;
+  while (i < lines.length) {
+    const line = lines[i] ?? "";
+    if (stopAtHeading && i > fromLine - 1 && /^##\s/.test(line))
+      return null;
+    if (TABLE_ROW_PATTERN.test(line)) {
+      const headerLine = line;
+      const sepLine = lines[i + 1] ?? "";
+      if (!SEPARATOR_ROW_PATTERN.test(sepLine)) {
+        i++;
+        continue;
+      }
+      const headers = splitRow(headerLine);
+      const rows = [];
+      let j = i + 2;
+      while (j < lines.length && TABLE_ROW_PATTERN.test(lines[j] ?? "")) {
+        rows.push({ cells: splitRow(lines[j] ?? ""), line: j + 1 });
+        j++;
+      }
+      return { headers, rows };
+    }
+    i++;
+  }
+  return null;
+}
+function findHeadingLine(lines, pattern) {
+  for (let i = 0;i < lines.length; i++) {
+    if (pattern.test(lines[i] ?? ""))
+      return i + 1;
+  }
+  return null;
+}
+// ../../packages/aeg-core/src/diagram-model.ts
+import matter from "gray-matter";
+
+// ../../packages/aeg-core/src/registry-parse.ts
+var RING_HEADINGS = [
+  { ring: "ring0", pattern: /^##\s+Ring 0\b/ },
+  { ring: "ring1", pattern: /^##\s+Ring 1\b/ },
+  { ring: "ring2", pattern: /^##\s+Ring 2\b/ }
+];
+function stripBackticks2(cell) {
+  const trimmed = cell.trim();
+  if (trimmed.length >= 2 && trimmed.startsWith("`") && trimmed.endsWith("`")) {
+    return trimmed.slice(1, -1);
+  }
+  return trimmed;
+}
+function stripBold(cell) {
+  return cell.trim().replace(/\*\*/g, "");
+}
+function parseEnforcementRegistry(content) {
+  const lines = content.split(`
+`);
+  const result = [];
+  for (const { ring, pattern } of RING_HEADINGS) {
+    const headingLine = findHeadingLine(lines, pattern);
+    if (headingLine === null)
+      continue;
+    const table = findTable(lines, headingLine + 1);
+    if (!table)
+      continue;
+    const descriptionIndex = table.headers.findIndex((h) => h.trim().toLowerCase() === "description");
+    const implementationIndex = table.headers.findIndex((h) => h.trim().toLowerCase() === "implementation");
+    for (const row of table.rows) {
+      const cells = row.cells;
+      if (cells.length < 3)
+        continue;
+      const action = stripBold(cells[0] ?? "");
+      const summary = stripBackticks2(cells[1] ?? "");
+      const category = stripBackticks2(cells[2] ?? "");
+      const implementation = stripBackticks2((implementationIndex === -1 ? cells[cells.length - 1] : cells[implementationIndex]) ?? "");
+      const description = descriptionIndex === -1 ? undefined : stripBackticks2(cells[descriptionIndex] ?? "") || undefined;
+      const spec = cells.length > 4 ? stripBackticks2(cells[cells.length - 2] ?? "") : undefined;
+      result.push({ ring, action, summary, category, description, spec, implementation, line: row.line });
+    }
+  }
+  return result;
+}
+// ../../packages/aeg-core/src/registry-checks.ts
+function checkG1(rows, existsFn) {
+  const findings = [];
+  for (const row of rows) {
+    if (row.implementation === "")
+      continue;
+    if (!existsFn(row.implementation)) {
+      findings.push({
+        row: row.action,
+        path: row.implementation,
+        reason: `${row.ring} row "${row.action}" names implementation "${row.implementation}", which does not exist on disk`
+      });
+    }
+  }
+  return { check: "G1", status: findings.length > 0 ? "info" : "pass", findings };
+}
+function checkG2(rows, candidateFiles) {
+  const implementations = new Set(rows.map((r) => r.implementation).filter((p) => p !== ""));
+  const findings = [];
+  for (const path of candidateFiles) {
+    if (!implementations.has(path)) {
+      findings.push({
+        path,
+        reason: `"${path}" is not named as the implementation of any row in enforcement.md's ring tables`
+      });
+    }
+  }
+  return { check: "G2", status: findings.length > 0 ? "info" : "pass", findings };
+}
+function checkG3(ring0Rows, crossingFiles) {
+  const ring0Implementations = new Set(ring0Rows.map((r) => r.implementation));
+  const findings = [];
+  for (const path of crossingFiles) {
+    if (!ring0Implementations.has(path)) {
+      findings.push({
+        path,
+        reason: `"${path}" makes a GitHub-crossing call but is not named by any Ring-0 row's implementation — a seventh, unlisted way into GitHub`
+      });
+    }
+  }
+  return { check: "G3", status: findings.length > 0 ? "fail" : "pass", findings };
+}
+function checkG4(content, resolveFn) {
+  const cited = new Set;
+  for (const hit of content.matchAll(/#(\d{3,})\b/g)) {
+    cited.add(Number(hit[1]));
+  }
+  const findings = [];
+  for (const n of cited) {
+    if (!resolveFn(n)) {
+      findings.push({
+        reason: `#${n} is cited in enforcement.md but does not resolve to a real Issue or PR in the forge`
+      });
+    }
+  }
+  return { check: "G4", status: findings.length > 0 ? "fail" : "pass", findings };
+}
+function checkG5(roles, contracts) {
+  const roleIds = new Set(roles.map((r) => r.role_id));
+  const findings = [];
+  for (const contract of contracts) {
+    if (!roleIds.has(contract.producer)) {
+      findings.push({
+        path: contract.file,
+        reason: `contract "${contract.file}" names producer "${contract.producer}", which is not a real role_id`
+      });
+    }
+    if (!roleIds.has(contract.consumer)) {
+      findings.push({
+        path: contract.file,
+        reason: `contract "${contract.file}" names consumer "${contract.consumer}", which is not a real role_id`
+      });
+    }
+  }
+  for (const role of roles) {
+    if (role.performs.length === 0) {
+      findings.push({ path: role.file, reason: `role "${role.role_id}" has an empty performs array` });
+    }
+    if (role.refuses_when.trim() === "") {
+      findings.push({ path: role.file, reason: `role "${role.role_id}" has an empty refuses_when` });
+    }
+  }
+  return { check: "G5", status: findings.length > 0 ? "fail" : "pass", findings };
+}
+// ../../packages/aeg-core/src/dead-branch-push-guard.ts
+function checkDeadBranchPush(input) {
+  const { branch, prState, prNumber } = input;
+  if (prState === "MERGED") {
+    return {
+      verdict: "refuse",
+      reason: `Branch \`${branch}\` already has a MERGED PR (#${prNumber}) — this branch's work is done. Push a new task branch instead of pushing onto an already-resolved one.`
+    };
+  }
+  if (prState === "CLOSED") {
+    return {
+      verdict: "refuse",
+      reason: `Branch \`${branch}\` has a CLOSED PR (#${prNumber}) that was never merged — pushing here would resurrect abandoned/rejected work. Open a new task branch instead.`
+    };
+  }
+  if (prState === "OPEN") {
+    return {
+      verdict: "allow",
+      reason: `Branch \`${branch}\` has an OPEN PR (#${prNumber}) — pushing more commits to it is normal.`
+    };
+  }
+  if (prState === "NONE") {
+    return {
+      verdict: "allow",
+      reason: `Branch \`${branch}\` has no PR yet — a brand-new task branch legitimately has none.`
+    };
+  }
+  return {
+    verdict: "allow",
+    reason: `Could not determine \`${branch}\`'s PR state (forge unreachable) — failing open rather than blocking the push on a transient issue.`
+  };
+}
+// ../../packages/aeg-core/src/reader-resolvable-prose.ts
+var SHIPS_PREFIX = "aeg-root/";
+var SHIPS_ARCHIVE_PREFIX = "aeg-root/tranches/completed/";
+function isSpecFile2(path) {
+  return path.startsWith("apps/") && path.includes("/specs/") && path.endsWith(".md");
+}
+function isClaudeMdFile(path) {
+  return path === "CLAUDE.md" || path.endsWith("/CLAUDE.md");
+}
+function classifyProseFile(path, readerFacingPrefix, readerFacingSuffix) {
+  if (path.startsWith(SHIPS_PREFIX)) {
+    return path.startsWith(SHIPS_ARCHIVE_PREFIX) ? "internal" : "ships";
+  }
+  if (path.startsWith(readerFacingPrefix) && path.endsWith(readerFacingSuffix)) {
+    return "reader-facing";
+  }
+  if (isSpecFile2(path) || isClaudeMdFile(path))
+    return "internal";
+  return null;
+}
+var SWEPT_CLASSES = new Set(["ships", "reader-facing"]);
+function stripNonProse(path, content) {
+  if (path.endsWith(".md")) {
+    return content.replace(/```.*?```/gs, (m) => m.replace(/[^\n]/g, "")).replace(/`[^`\n]*`/g, (m) => m.replace(/[^\n]/g, ""));
+  }
+  if (path.endsWith(".tsx") || path.endsWith(".ts")) {
+    return content.replace(/\/\*.*?\*\//gs, (m) => m.replace(/[^\n]/g, "")).replace(/(^|[^:])\/\/[^\n]*/g, (m) => m.replace(/[^\n]/g, ""));
+  }
+  return content;
+}
+function lineAt(content, index) {
+  let line = 1;
+  for (let i = 0;i < index; i++) {
+    if (content.charCodeAt(i) === 10)
+      line++;
+  }
+  return line;
+}
+var FORGE_NUMBER_PATTERN = /#[0-9]{2,4}/g;
+var TRANCHE_SLUG_VN_PATTERN = /[a-z][a-z-]+-v[0-9]/g;
+function legacySlugPattern(legacySlugs) {
+  if (legacySlugs.length === 0)
+    return null;
+  const alternation = legacySlugs.map((s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
+  return new RegExp(`(^|[^a-zA-Z0-9\\n-])(${alternation})([^a-zA-Z0-9\\n-]|$)`, "g");
+}
+function checkUnresolvableReferences(files, readerFacingPrefix, readerFacingSuffix, legacySlugs = []) {
+  const findings = [];
+  const legacyPattern = legacySlugPattern(legacySlugs);
+  const patterns = [
+    { pattern: FORGE_NUMBER_PATTERN, what: "a forge number" },
+    { pattern: TRANCHE_SLUG_VN_PATTERN, what: "an internal tranche slug" },
+    ...legacyPattern ? [{ pattern: legacyPattern, what: "an internal tranche slug", group: 2 }] : []
+  ];
+  for (const file of files) {
+    const cls = classifyProseFile(file.path, readerFacingPrefix, readerFacingSuffix);
+    if (!cls || !SWEPT_CLASSES.has(cls))
+      continue;
+    const scrubbed = stripNonProse(file.path, file.content);
+    for (const { pattern, what, group } of patterns) {
+      pattern.lastIndex = 0;
+      let match = pattern.exec(scrubbed);
+      while (match !== null) {
+        const cited = group !== undefined ? match[group] ?? match[0] : match[0];
+        findings.push({
+          file: file.path,
+          line: lineAt(scrubbed, match.index),
+          message: `references ${what} ("${cited}") a reader outside this repo's tracker cannot resolve`
+        });
+        match = pattern.exec(scrubbed);
+      }
+    }
+  }
+  return findings;
+}
+function escapeTerm(term) {
+  return term.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function containsWholeWord(text, term) {
+  const escaped = escapeTerm(term);
+  const re = new RegExp(`(^|[^a-zA-Z])${escaped}([^a-zA-Z]|$)`, "i");
+  return re.test(text);
+}
+function findWholeWordLine(content, term) {
+  const lines = content.split(`
+`);
+  let lineNo = 0;
+  for (const line of lines) {
+    lineNo++;
+    if (containsWholeWord(line, term))
+      return lineNo;
+  }
+  return null;
+}
+function definesOrLinksGlossary(content, term) {
+  const escaped = escapeTerm(term);
+  const definesInline = new RegExp(`(^|[^a-zA-Z])${escaped}([^a-zA-Z]|$)[^\\n]{0,3}—`, "i").test(content);
+  if (definesInline)
+    return true;
+  return /docs\/glossary|glossary\.md/i.test(content);
+}
+function checkUndefinedVocabulary(files, glossaryTerms, readerFacingPrefix, readerFacingSuffix) {
+  const findings = [];
+  for (const file of files) {
+    const cls = classifyProseFile(file.path, readerFacingPrefix, readerFacingSuffix);
+    if (!cls || !SWEPT_CLASSES.has(cls))
+      continue;
+    const scrubbed = stripNonProse(file.path, file.content);
+    for (const term of glossaryTerms) {
+      const line = findWholeWordLine(scrubbed, term);
+      if (line === null)
+        continue;
+      if (definesOrLinksGlossary(scrubbed, term))
+        continue;
+      findings.push({
+        file: file.path,
+        line,
+        message: `uses coined term "${term}" without defining it inline or linking the glossary`
+      });
+    }
+  }
+  return findings;
+}
+function checkReaderResolvableProse(files, glossaryTerms, readerFacingPrefix, readerFacingSuffix, legacySlugs = []) {
+  return [
+    ...checkUnresolvableReferences(files, readerFacingPrefix, readerFacingSuffix, legacySlugs),
+    ...checkUndefinedVocabulary(files, glossaryTerms, readerFacingPrefix, readerFacingSuffix)
+  ];
+}
+function parseGlossaryTerms(glossaryContent) {
+  const terms = [];
+  const re = /^\*\*(.+?)\*\* —/gm;
+  let match = re.exec(glossaryContent);
+  while (match !== null) {
+    if (match[1] !== undefined)
+      terms.push(match[1]);
+    match = re.exec(glossaryContent);
+  }
+  return terms;
+}
+// ../../packages/aeg-core/src/dispatch-gate.ts
+function isHandClosedByRecognizedPrincipal(dep, principalAllowlist) {
+  return dep.issueState === "closed" && dep.stateReason === "completed" && isPrincipal(dep.closedByActor ?? null, principalAllowlist);
+}
+function checkDispatchReadiness(input) {
+  const { trancheSlug, task } = input;
+  const taskLabel = `task ${task.id} (tranche ${trancheSlug})`;
+  const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
+  const blockers = [];
+  if (task.issue === null) {
+    blockers.push(`dispatch-gate issue-existence: ${taskLabel} has no Issue (#TBD or blank) in the topology — not dispatchable until the Planner cuts the Issue.`);
+  } else if (input.issue === null) {
+    blockers.push(`dispatch-gate issue-existence: ${taskLabel} names Issue #${task.issue}, but it does not resolve to a real GitHub Issue (phantom reference).`);
+  }
+  if (input.issue !== null && !input.issueRationalePass) {
+    blockers.push(`dispatch-gate rationale: Issue #${input.issue.number} for ${taskLabel} fails the rationale gate (checkIssueRationale) — the Planner must complete the eight-field rationale before this task is dispatchable.`);
+  }
+  for (const dep of input.dependsOn) {
+    if (!dep.merged && !isHandClosedByRecognizedPrincipal(dep, principalAllowlist)) {
+      const issueStr = dep.issue !== null ? ` (#${dep.issue})` : "";
+      blockers.push(`dispatch-gate depends-on: ${taskLabel} depends on ${dep.id}${issueStr}, whose PR is not merged yet — not dispatchable, it serializes behind it.`);
+    }
+  }
+  for (const c of input.conflictsWith) {
+    if (c.openOrInFlight) {
+      const issueStr = c.issue !== null ? ` (#${c.issue})` : "";
+      blockers.push(`dispatch-gate conflicts-with: ${taskLabel} conflicts with ${c.id}${issueStr}, whose PR is open or in-flight — not dispatchable until it merges.`);
+    }
+  }
+  for (const proj of input.priorTrancheArchival) {
+    if (proj.priorTrancheSlug !== null && !proj.archived) {
+      blockers.push(`dispatch-gate prior-tranche-archival: project \`${proj.project}\`'s previous tranche \`${proj.priorTrancheSlug}\` is not archived — the Tranche Archivist must run before new work on this product.`);
+    }
+  }
+  return { ready: blockers.length === 0, blockers };
+}
+// ../../packages/aeg-core/src/single-plan-pr.ts
+function trancheSlugFromTopologyPath(path) {
+  const m = path.match(/^aeg-root\/tranches\/([^/]+)\.md$/);
+  if (!m)
+    return null;
+  const slug = m[1];
+  if (slug === "README" || slug.endsWith(".tokens"))
+    return null;
+  return slug;
+}
+function checkSinglePlanPr(branchFiles, otherOpenPrs) {
+  const touchedSlugs = new Set(branchFiles.map(trancheSlugFromTopologyPath).filter((s) => s !== null));
+  if (touchedSlugs.size === 0)
+    return { ok: true };
+  for (const pr of otherOpenPrs) {
+    const otherSlugs = new Set(pr.files.map(trancheSlugFromTopologyPath).filter((s) => s !== null));
+    for (const slug of touchedSlugs) {
+      if (otherSlugs.has(slug)) {
+        return {
+          ok: false,
+          message: `single-plan-pr: another open PR (#${pr.number}) already touches tranche "${slug}"'s topology file. Only one open plan PR per tranche is allowed at a time — wait for #${pr.number} to merge or close, or coordinate with its author.`
+        };
+      }
+    }
+  }
+  return { ok: true };
+}
+function touchesAnyTopology(files) {
+  return files.some((f) => trancheSlugFromTopologyPath(f) !== null);
+}
+// ../../packages/aeg-core/src/no-disk-state.ts
+var TOP_LEVEL_TOPOLOGY_FILE = /^aeg-root\/tranches\/[^/]+\.md$/;
+var ANY_DEPTH_TRANCHES_MD = /^aeg-root\/tranches\/.*\.md$/;
+var TOKENS_FILE = /\.tokens\.md$/;
+function isNewDiskStateFile(path, status) {
+  if (TOP_LEVEL_TOPOLOGY_FILE.test(path))
+    return true;
+  if (status !== "added")
+    return false;
+  return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
+}
+// ../../packages/aeg-core/src/branch-topology-gate.ts
+function taskBranchTopologyFields(branch) {
+  if (!/^task\/.*\/.*$/.test(branch))
+    return null;
+  const parts = branch.split("/");
+  return { tranche: parts[1] ?? "", taskId: parts[2] ?? "" };
+}
+function checkBranchTopology(input) {
+  const { branch, tranche, taskId, topoPath, topology } = input;
+  if (topology === null) {
+    return {
+      verdict: "refuse",
+      reason: `✖ pre-push: branch \`${branch}\` names tranche \`${tranche}\`, but ${topoPath} does not exist.
+` + "  A task branch must belong to a real tranche."
+    };
+  }
+  const hasRow = topology?.tasks.some((t) => t.id === taskId) ?? false;
+  if (!hasRow) {
+    return {
+      verdict: "refuse",
+      reason: `✖ pre-push: branch \`${branch}\` — no row with \`#\` = \`${taskId}\` in ${topoPath}.
+` + `  The branch suffix must literal-match the topology's # column.
+` + "  If the plan PR adding this row hasn't merged yet, merge it first."
+    };
+  }
+  return {
+    verdict: "allow",
+    reason: `Branch \`${branch}\` matches topology row \`${taskId}\` in ${topoPath}.`
+  };
+}
+// ../../packages/aeg-core/src/first-push-dispatch-gate.ts
+function parseTaskBranch(branch) {
+  const m = /^task\/([^/]+)\/([^/]+)$/.exec(branch);
+  return m ? { tranche: m[1], taskId: m[2] } : null;
+}
+function checkFirstPushDispatchGate(input) {
+  const { branch, prExists, readiness } = input;
+  if (parseTaskBranch(branch) === null) {
+    return {
+      verdict: "allow",
+      reason: `Branch \`${branch}\` is not a task/<tranche>/<n> branch — the first-push dispatch gate only applies to task branches.`
+    };
+  }
+  if (prExists) {
+    return {
+      verdict: "allow",
+      reason: `Branch \`${branch}\` already has an open PR — dispatch readiness was already validated on its first push; later pushes are not re-blocked by a sibling task's state change.`
+    };
+  }
+  if (readiness === "UNKNOWN") {
+    return {
+      verdict: "allow",
+      reason: `verify-dispatch could not reach the forge for \`${branch}\` (repo/token unresolvable) — failing OPEN rather than blocking the push on a transient issue.`
+    };
+  }
+  if (readiness === "NOT_READY") {
+    return {
+      verdict: "refuse",
+      reason: `verify-dispatch reports NOT READY for \`${branch}\` — see the failing predicate printed above.`
+    };
+  }
+  return {
+    verdict: "allow",
+    reason: `verify-dispatch reports READY TO DISPATCH for \`${branch}\`.`
+  };
+}
+// ../../packages/aeg-core/src/issue-assignment.ts
+function decideIssueAssignment(input) {
+  const { branch, remoteRefExists, issue, assignees, login } = input;
+  if (parseTaskBranch(branch) === null) {
+    return {
+      action: "skip",
+      reason: `Branch \`${branch}\` is not a task/<tranche>/<n> branch — Issue self-assignment only applies to task branches.`
+    };
+  }
+  if (remoteRefExists) {
+    return {
+      action: "skip",
+      reason: `Branch \`${branch}\` already exists on the remote — not its first push, nothing to assign.`
+    };
+  }
+  if (issue === null) {
+    return {
+      action: "skip",
+      reason: `No Issue resolved for \`${branch}\` from its topology row — skipping self-assignment (the gate owns refusing an unplanned branch).`
+    };
+  }
+  if (assignees === null) {
+    return {
+      action: "skip",
+      reason: `Could not read Issue #${issue}'s current assignees — skipping rather than risking a double-assign (fail-open, never a guess).`
+    };
+  }
+  if (assignees.length > 0) {
+    return {
+      action: "skip",
+      reason: `Issue #${issue} is already assigned (${assignees.join(", ")}) — no-op.`
+    };
+  }
+  if (login === null) {
+    return {
+      action: "skip",
+      reason: "Could not resolve the authenticated `gh` login — never assigning anyone other than the actual pusher, so skipping."
+    };
+  }
+  return {
+    action: "assign",
+    issue,
+    login,
+    reason: `First push of \`${branch}\` — assigning Issue #${issue} to @${login} (the authenticated pusher).`
+  };
+}
+// ../../packages/aeg-core/src/test-plan-gate.ts
+var TASK_BRANCH_PATTERN2 = /^task\/[^/]+\/[^/]+$/;
+function evaluateTestPlanGate(body, branch) {
+  if (!body) {
+    return {
+      verdict: "pass",
+      messages: [
+        "PR_BODY env var is empty; nothing to check.",
+        "PASS (no body — likely a local invocation; CI sets PR_BODY automatically)."
+      ]
+    };
+  }
+  const located = locateTestPlanSection(body);
+  if (!located.found) {
+    if (TASK_BRANCH_PATTERN2.test(branch)) {
+      return {
+        verdict: "fail",
+        messages: [
+          `FAIL — no Test Plan section found in the PR body for task branch \`${branch}\`.`,
+          "Searched for a `## Test Plan` / `## N. Test Plan` heading and an inline `**Test Plan:**`/`Test Plan:` marker — neither was found.",
+          "Per, a task PR without a Test Plan is malformed, not exempt — add one (or `Test Plan: unit-tests-only` for a pure-logic brief with no runtime surface)."
+        ]
+      };
+    }
+    return {
+      verdict: "pass",
+      messages: [
+        "No Test Plan section in PR body.",
+        "PASS (advisory) — see aeg-root/roles/developer.md (Verification) and aeg-root/skills/brief-authoring/SKILL.md §9.",
+        "Non-task branch (or BRANCH unset) — a brief that touches a runtime surface and has no Test Plan is malformed on a task branch; Brief Validation catches that case pre-dispatch."
+      ]
+    };
+  }
+  const section = located.section;
+  if (/unit-tests-only/i.test(section)) {
+    return {
+      verdict: "pass",
+      messages: ["Test Plan: unit-tests-only — pure-logic brief, CI unit-tests are the proof.", "PASS."]
+    };
+  }
+  const checkboxLines = section.split(`
+`).map((line) => line.trimStart()).filter((line) => /^[-*]\s+\[[ xX]\]/.test(line));
+  if (checkboxLines.length === 0) {
+    return {
+      verdict: "pass",
+      messages: [
+        "Test Plan section found but has no checkbox items.",
+        "PASS (advisory) — the section may be empty or expressed in prose; verification is the Principal's call."
+      ]
+    };
+  }
+  const unchecked = checkboxLines.filter((line) => /^[-*]\s+\[\s\]/.test(line));
+  const checked = checkboxLines.filter((line) => /^[-*]\s+\[[xX]\]/.test(line));
+  const messages = [`Test Plan items: ${checked.length} ticked, ${unchecked.length} unticked.`];
+  if (unchecked.length > 0) {
+    messages.push("", "FAIL — the following Test Plan items are unticked:");
+    for (const line of unchecked)
+      messages.push(`  ${line}`);
+    messages.push("", "Per aeg-root/roles/developer.md (Verification), a PR is not mergeable while any Test Plan box is unticked.", "- [agent] items: the Developer-agent posts the actual command output as evidence and ticks the box.", "- [principal] items: the Principal runs the item in a real signed-in browser and ticks the box.", "Note: editing the PR body does not retrigger most workflows. If your PR body changes do not surface here, push an empty commit to re-run.");
+    return { verdict: "fail", messages };
+  }
+  messages.push("All Test Plan items ticked — runtime verification complete.", "PASS.");
+  return { verdict: "pass", messages };
+}
+// src/lib/config.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { z } from "zod";
+var EnvEntrySchema = z.union([
+  z.literal(true),
+  z.object({ optional: z.literal(true) }),
+  z.object({ anyOf: z.array(z.string()).min(2) }),
+  z.string()
+]);
+var CheckEntrySchema = z.object({
+  run: z.string(),
+  scope: z.enum(["diff", "full"]),
+  include: z.array(z.string()).optional(),
+  args: z.array(z.string()).optional(),
+  timeoutMs: z.number().optional(),
+  env: z.record(z.string(), EnvEntrySchema).optional(),
+  requiresOpenPr: z.boolean().optional(),
+  ownWorkflow: z.boolean().optional()
+}).superRefine((entry2, ctx) => {
+  if (!entry2.env)
+    return;
+  for (const [key, value] of Object.entries(entry2.env)) {
+    if (typeof value !== "object" || value === null || !("anyOf" in value))
+      continue;
+    const members = value.anyOf;
+    if (new Set(members).size !== members.length) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: `env.${key}.anyOf has duplicate members`,
+        path: ["env", key, "anyOf"]
+      });
+    }
+    if (!members.includes(key)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: `env.${key}.anyOf must include "${key}" itself as a member`,
+        path: ["env", key, "anyOf"]
+      });
+    }
+  }
+});
+var BRIEF_BUILTINS = [
+  "tier",
+  "testPlan",
+  "testPlanExclusivity",
+  "principalPlaceholder",
+  "surfaceMap",
+  "docUpdateList",
+  "worktreeStep0",
+  "stopConditions",
+  "autonomyClause",
+  "project",
+  "for",
+  "closesN",
+  "premiseCoverage",
+  "issueRationale"
+];
+var BriefSectionSchema = z.union([
+  z.object({ builtin: z.enum(BRIEF_BUILTINS) }),
+  z.object({ heading: z.string().min(1), name: z.string().optional() }),
+  z.object({ field: z.string().min(1), name: z.string().optional() }),
+  z.object({ phrase: z.string().min(1), name: z.string().optional() })
+]);
+var BriefSchemaSchema = z.object({
+  pr: z.object({ sections: z.array(BriefSectionSchema) }).optional(),
+  issue: z.object({ sections: z.array(BriefSectionSchema) }).optional()
+});
+function isSafeRepoRelPath(p) {
+  if (p.length === 0)
+    return false;
+  if (p.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(p))
+    return false;
+  return p.split(/[\\/]/).every((seg) => seg !== ".." && seg !== "");
+}
+var SafeRepoRelPath = z.string().refine(isSafeRepoRelPath, {
+  message: "must be a repo-root-relative path with no `..` segment or absolute root"
+});
+var ManagedBlockRecordSchema = z.object({
+  path: SafeRepoRelPath,
+  marker: z.string(),
+  comment: z.enum(["hash", "html"])
+});
+var ManagedManifestSchema = z.object({
+  version: z.number().int().positive(),
+  files: z.array(SafeRepoRelPath),
+  blocks: z.array(ManagedBlockRecordSchema),
+  labels: z.array(z.string())
+});
+var VinayaConfigSchema = z.object({
+  rings: z.object({
+    ring1_forgeWriteInterception: z.boolean(),
+    ring2_asyncAudits: z.boolean()
+  }).optional(),
+  checks: z.record(z.string(), CheckEntrySchema).optional(),
+  briefSchema: BriefSchemaSchema.optional(),
+  managed: ManagedManifestSchema.optional(),
+  principals: z.array(z.string()).min(1).optional(),
+  releaseActor: z.string().min(1).optional(),
+  ci: z.object({ setup: z.string().min(1) }).optional(),
+  blastRadius: z.object({ extraDomains: z.array(z.string()).optional() }).optional()
+});
+var GLOBAL_VINAYA_HOME = join(homedir(), ".vinaya");
+var GLOBAL_CONFIG_PATH = join(GLOBAL_VINAYA_HOME, "config.json");
+var LOCAL_CONFIG_FILENAME = "vinaya.config.json";
+function resolvePrincipalAllowlist(config) {
+  return config?.principals ?? PRINCIPAL_ALLOWLIST;
+}
+function resolveReleaseActor(config) {
+  return config?.releaseActor ?? DEFAULT_RELEASE_ACTOR;
+}
+function trustAnchorRepo() {
+  const wellFormed = (slug) => /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
+  const fromRunner = process.env.GITHUB_REPOSITORY?.trim();
+  if (fromRunner) {
+    const validated = wellFormed(fromRunner);
+    if (validated)
+      return validated;
+  }
+  try {
+    const url = execFileSync2("git", ["remote", "get-url", "origin"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+    const m = url.match(/github\.com[:/]([^/]+)\/(.+?)(?:\.git)?\/?$/);
+    return m?.[1] && m[2] ? wellFormed(`${m[1]}/${m[2]}`) : null;
+  } catch {
+    return null;
+  }
+}
+function ghFetchTrustAnchorConfig() {
+  const repo = trustAnchorRepo();
+  if (!repo)
+    throw new Error("could not resolve repo identity for the trust-anchor read");
+  return execFileSync2("gh", ["api", `repos/${repo}/contents/${LOCAL_CONFIG_FILENAME}`, "--jq", ".content"], {
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+}
+function firstLine(err) {
+  return err?.message?.split(`
+`)[0] ?? "unknown error";
+}
+function isMissingFileError(err) {
+  const stderr = err?.stderr;
+  const haystack = [
+    err?.message ?? "",
+    typeof stderr === "string" ? stderr : stderr?.toString() ?? ""
+  ].join(`
+`);
+  return /\b404\b|not found/i.test(haystack);
+}
+function loadTrustAnchorConfig(fetcher = ghFetchTrustAnchorConfig) {
+  const warn = (why) => process.stdout.write(`⚠ could not read the trust-anchor config (\`principals\`/\`releaseActor\`) from the default branch (${why}) — falling back to vinaya's built-in defaults.
+`);
+  let base64;
+  try {
+    base64 = fetcher().trim();
+  } catch (err) {
+    if (!isMissingFileError(err))
+      warn(firstLine(err));
+    return null;
+  }
+  if (!base64)
+    return null;
+  try {
+    const raw = Buffer.from(base64, "base64").toString("utf-8");
+    const parsed = VinayaConfigSchema.safeParse(JSON.parse(raw));
+    if (parsed.success)
+      return parsed.data;
+    warn("it did not satisfy the config schema");
+    return null;
+  } catch {
+    warn("it was not readable as JSON");
+    return null;
+  }
+}
+
+// src/checks/contract.ts
+var CHECK_SCHEMA_VERSION = 1;
+function emitCheckError(error) {
+  process.stderr.write(`${JSON.stringify(error)}
+`);
+}
+
+// src/checks/body-bare-digits-logic.ts
+function blankRange(text, start, end) {
+  const region = text.slice(start, end);
+  return text.slice(0, start) + region.replace(/[^\n]/g, " ") + text.slice(end);
+}
+var EXEMPT_ANCHOR_FIELDS = ["CLOSES", "TIER", "PROJECT", "EVIDENCE"];
+var FIELD_SECTION_HEADING = {
+  CLOSES: null,
+  PROJECT: null,
+  TIER: /^scope$/i,
+  EVIDENCE: /^evidence$/i
+};
+var HEADING = /^#{1,6}\s/;
+var HEADING_TEXT = /^#{1,6}\s+(.*?)\s*$/;
+function headerBlockEnd(body) {
+  const lines = body.split(`
+`);
+  let offset = 0;
+  for (const line of lines) {
+    if (HEADING.test(line))
+      return offset;
+    offset += line.length + 1;
+  }
+  return body.length;
+}
+function namedSectionBounds(body, namePattern) {
+  const lines = body.split(`
+`);
+  let offset = 0;
+  let start = -1;
+  let end = body.length;
+  for (const line of lines) {
+    const headingText = HEADING_TEXT.exec(line);
+    if (start === -1 && headingText && namePattern.test(headingText[1])) {
+      start = offset;
+    } else if (start !== -1 && HEADING.test(line)) {
+      end = offset;
+      break;
+    }
+    offset += line.length + 1;
+  }
+  return start === -1 ? null : { start, end };
+}
+function isInCanonicalSection(body, field, outerStart) {
+  const pattern = FIELD_SECTION_HEADING[field];
+  if (pattern === null)
+    return outerStart < headerBlockEnd(body);
+  const bounds = namedSectionBounds(body, pattern);
+  return bounds !== null && outerStart >= bounds.start && outerStart < bounds.end;
+}
+var PROJECT_LABEL = /^\s*(?:\*\*)?Project(?:\(s\))?(?:\*\*)?\s*:\s*(?:\*\*)?/i;
+var FIELD_CONTENT_SIGNATURE = {
+  CLOSES: /Closes\s*#\d+/i,
+  PROJECT: PROJECT_LABEL,
+  TIER: TIER_FIELD,
+  EVIDENCE: /^Head:\s*\S/m
+};
+function blankAnchoredRegions(body) {
+  let masked = body;
+  for (const field of EXEMPT_ANCHOR_FIELDS) {
+    const bounds = anchoredRegionBounds(body, field);
+    if (!bounds || !isInCanonicalSection(body, field, bounds.outerStart))
+      continue;
+    const content = body.slice(bounds.innerStart, bounds.innerEnd);
+    if (!FIELD_CONTENT_SIGNATURE[field].test(content))
+      continue;
+    masked = blankRange(masked, bounds.outerStart, bounds.innerStart);
+    masked = blankRange(masked, bounds.innerEnd, bounds.outerEnd);
+    const blankedContent = content.split(`
+`).map(BOUNDED_ANCHOR_BLANK[field]).join(`
+`);
+    masked = masked.slice(0, bounds.innerStart) + blankedContent + masked.slice(bounds.innerEnd);
+  }
+  return masked;
+}
+function blankTokenReportSection(body) {
+  const lines = body.split(`
+`);
+  const HEADING2 = /^#{1,6}\s/;
+  const TOKEN_REPORT_HEADING = /^#{1,6}\s*token report\s*$/i;
+  const startIdx = lines.findIndex((l) => TOKEN_REPORT_HEADING.test(l));
+  if (startIdx === -1)
+    return body;
+  let endIdx = lines.length;
+  for (let i = startIdx + 1;i < lines.length; i++) {
+    if (HEADING2.test(lines[i])) {
+      endIdx = i;
+      break;
+    }
+  }
+  const fill = (line) => " ".repeat(line.length);
+  for (let i = startIdx;i < endIdx; i++)
+    lines[i] = fill(lines[i]);
+  return lines.join(`
+`);
+}
+function blankTierField(line) {
+  const m = TIER_FIELD.exec(line);
+  if (!m)
+    return line;
+  return line.slice(0, m.index) + " ".repeat(m[0].length) + line.slice(m.index + m[0].length);
+}
+var SEGMENT_HAS_DIGIT = /\p{Nd}/u;
+function blankProjectField(line) {
+  const label2 = PROJECT_LABEL.exec(line);
+  if (!label2)
+    return line;
+  const valueStart = label2.index + label2[0].length;
+  const segments = line.slice(valueStart).split(",");
+  const blanked = segments.map((seg) => {
+    const name = unwrapValue(seg);
+    const isRealName = PROJECT_SLUG.test(name) && !SEGMENT_HAS_DIGIT.test(name);
+    return isRealName ? " ".repeat(seg.length) : seg;
+  });
+  return line.slice(0, valueStart) + blanked.join(",");
+}
+function blankUnanchoredStructuralFields(body) {
+  return body.split(`
+`).map((l) => blankProjectField(blankTierField(l))).join(`
+`);
+}
+var CLOSES_REF = /Closes\s*#\d+/i;
+var EVIDENCE_HEADING = /^#{1,6}\s/;
+var EVIDENCE_HEAD_LINE = /^Head:\s*\S+$/i;
+function blankClosesField(line) {
+  const m = CLOSES_REF.exec(line);
+  if (!m)
+    return line;
+  return line.slice(0, m.index) + " ".repeat(m[0].length) + line.slice(m.index + m[0].length);
+}
+function blankEvidenceField(line) {
+  const trimmed = line.trim();
+  if (trimmed === "" || EVIDENCE_HEAD_LINE.test(trimmed) || EVIDENCE_HEADING.test(trimmed))
+    return " ".repeat(line.length);
+  return line;
+}
+var BOUNDED_ANCHOR_BLANK = {
+  CLOSES: blankClosesField,
+  TIER: blankTierField,
+  PROJECT: blankProjectField,
+  EVIDENCE: blankEvidenceField
+};
+function buildScanMask(body) {
+  let masked = maskDetailsBlocks(maskCode(body));
+  masked = blankAnchoredRegions(masked);
+  masked = blankTokenReportSection(masked);
+  masked = blankUnanchoredStructuralFields(masked);
+  return masked;
+}
+var TOKEN_WITH_DIGIT = /\S*\p{Nd}\S*/gu;
+var LIST_MARKER_TOKEN = /^\p{Nd}{1,9}[.)]$/u;
+var ZERO_WIDTH = /[\u200B-\u200D\u2060\uFEFF]/g;
+var HTML_ENTITIES = {
+  "&quot;": '"',
+  "&apos;": "'",
+  "&lt;": "<",
+  "&gt;": ">",
+  "&amp;": "&"
+};
+function decodeNamedEntities(body) {
+  return body.replace(/&(?:quot|apos|lt|gt|amp);/g, (m) => HTML_ENTITIES[m] ?? m);
+}
+function isLineLeadingListMarker(line, matchStart, rawToken) {
+  if (!LIST_MARKER_TOKEN.test(rawToken))
+    return false;
+  const before = line.slice(0, matchStart);
+  return /^ {0,3}$/.test(before);
+}
+function checkBareDigits(rawBody) {
+  const body = decodeNamedEntities(rawBody.replace(ZERO_WIDTH, ""));
+  const masked = buildScanMask(body);
+  const maskedLines = masked.split(`
+`);
+  const origLines = body.split(`
+`);
+  const violations = [];
+  for (let i = 0;i < maskedLines.length; i++) {
+    const maskedLine = maskedLines[i];
+    const origLine = origLines[i];
+    TOKEN_WITH_DIGIT.lastIndex = 0;
+    let m;
+    while ((m = TOKEN_WITH_DIGIT.exec(maskedLine)) !== null) {
+      const rawToken = origLine.slice(m.index, m.index + m[0].length);
+      if (isLineLeadingListMarker(maskedLine, m.index, rawToken))
+        continue;
+      violations.push({ line: i + 1, text: origLine.trim() });
+    }
+  }
+  return { violations };
+}
+
+// src/checks/bin/check-body-bare-digits.ts
+var CHECK_NAME = "body-bare-digits";
+function fetchPr(prNumber) {
+  try {
+    const out = execFileSync3("gh", ["pr", "view", String(prNumber), "--json", "number,headRefName,author"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    return JSON.parse(out);
+  } catch {
+    return null;
+  }
+}
+function isExemptChangesetsReleasePr(prNumberStr) {
+  if (!prNumberStr)
+    return false;
+  const prNumber = Number(prNumberStr);
+  if (!Number.isFinite(prNumber))
+    return false;
+  const pr = fetchPr(prNumber);
+  if (!pr || pr.headRefName !== CHANGESET_RELEASE_BRANCH)
+    return false;
+  return isChangesetsReleasePr(pr.headRefName, pr.author?.login ?? null, resolveReleaseActor(loadTrustAnchorConfig()));
+}
+function main() {
+  if (isExemptChangesetsReleasePr(process.env.PR_NUMBER)) {
+    process.exit(0);
+  }
+  const body = process.env.PR_BODY ?? "";
+  if (!body) {
+    process.exit(0);
+  }
+  const result = checkBareDigits(body);
+  if (result.violations.length === 0) {
+    process.exit(0);
+  }
+  for (const v of result.violations) {
+    emitCheckError({
+      schema: CHECK_SCHEMA_VERSION,
+      check: CHECK_NAME,
+      severity: "error",
+      message: `body-bare-digits: bare digit outside a fenced block, line ${v.line}: ${v.text}`,
+      agent_recovery_prompt: "Move this into a fenced code block, or state it as a symbol reference instead of a narrative claim (e.g. `N`), then re-run `vinaya check body-bare-digits`.",
+      line: v.line
+    });
+  }
+  process.exit(1);
+}
+main();