@attalabs/vinaya 0.12.0 → 0.17.0

package/dist/checks/bin/check-reader-resolvable-prose.js

@@ -7,7 +7,27 @@ import { fileURLToPath } from "node:url";
 // ../../packages/aeg-forge-state/src/strip-code.ts
 function maskCode(body) {
   const fill = (line) => " ".repeat(line.length);
-  return maskIndentedCode(maskFencedCode(body, fill), fill).replace(/(`+)[^\n]*?\1/g, (m) => " ".repeat(m.length));
+  const blocksMasked = maskIndentedCode(maskFencedCode(body, fill), fill);
+  return blocksMasked.split(`
+`).map((line) => replaceInlineSpans(line, (span) => " ".repeat(span.length))).join(`
+`);
+}
+var DETAILS_OPEN = /<details\b[^>]*>/gi;
+var DETAILS_CLOSE = /<\/details\s*>/gi;
+function maskDetailsBlocks(body) {
+  const fill = (line) => " ".repeat(line.length);
+  const lines = body.split(`
+`);
+  let depth = 0;
+  const out = lines.map((line) => {
+    const opens = line.match(DETAILS_OPEN)?.length ?? 0;
+    const closes = line.match(DETAILS_CLOSE)?.length ?? 0;
+    const maskThisLine = depth > 0 || opens > 0;
+    depth = Math.max(0, depth + opens - closes);
+    return maskThisLine ? fill(line) : line;
+  });
+  return out.join(`
+`);
 }
 function stripCode(body, options = {}) {
   const normalised = body.replace(/\r\n?/g, `
@@ -16,7 +36,50 @@ function stripCode(body, options = {}) {
   const blocksStripped = maskIndentedCode(maskFencedCode(normalised, blank), blank);
   if (options.inlineSpans === "keep")
     return blocksStripped;
-  return blocksStripped.replace(/(`+)[^\n]*?\1/g, "");
+  return blocksStripped.split(`
+`).map((line) => replaceInlineSpans(line, () => "")).join(`
+`);
+}
+function replaceInlineSpans(line, replace) {
+  let result = "";
+  let i = 0;
+  const runLengthAt = (at) => {
+    let j = at;
+    while (j < line.length && line[j] === "`")
+      j++;
+    return j - at;
+  };
+  while (i < line.length) {
+    if (line[i] !== "`") {
+      result += line[i];
+      i++;
+      continue;
+    }
+    const openLen = runLengthAt(i);
+    const openEnd = i + openLen;
+    let j = openEnd;
+    let closeEnd = -1;
+    while (j < line.length) {
+      if (line[j] !== "`") {
+        j++;
+        continue;
+      }
+      const runLen = runLengthAt(j);
+      if (runLen === openLen) {
+        closeEnd = j + runLen;
+        break;
+      }
+      j += runLen;
+    }
+    if (closeEnd === -1) {
+      result += line.slice(i, openEnd);
+      i = openEnd;
+    } else {
+      result += replace(line.slice(i, closeEnd));
+      i = closeEnd;
+    }
+  }
+  return result;
 }
 var FENCE_OPEN = /^ {0,3}(`{3,}|~{3,})([^\r\n]*)\r?$/;
 var FENCE_CLOSE = /^ {0,3}(`+|~+)[ \t]*\r?$/;
@@ -1755,9 +1818,10 @@ function evaluateC5(changed, docOwnersContent, prBody, fileExists, waiverActive,
   return out;
 }
 // ../../packages/aeg-core/src/pr-tier.ts
+var TIER_FIELD = /(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i;
 function readTierFromPrBody(prBody) {
   const searchIn = anchoredRegion(prBody, "TIER") ?? prBody;
-  const m = searchIn.match(/(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i);
+  const m = searchIn.match(TIER_FIELD);
   if (!m)
     return null;
   const t = Number(m[4]);
@@ -2370,15 +2434,25 @@ function checkClosesN2(branch, prBody, trancheFiles, taskIssueRefs) {
   return { ok: true, expectedIssue };
 }
 // ../../packages/aeg-core/src/verdict-extraction.ts
+var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
+function extractHeadSha(comment) {
+  const m = comment.match(HEAD_SHA_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
 function extractVerdict(comments, valuePattern, missingLabel) {
   const clearHits = comments.filter((c) => valuePattern.test(c));
   if (clearHits.length > 0) {
     const latest = clearHits[clearHits.length - 1];
     const m = latest.match(valuePattern);
-    return { value: m[1].toUpperCase().replace(/[_-]/g, " "), danglingNote: null };
+    return {
+      value: m[1].toUpperCase().replace(/[_-]/g, " "),
+      headSha: extractHeadSha(latest),
+      danglingNote: null
+    };
   }
   return {
     value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
+    headSha: null,
     danglingNote: `no ${missingLabel} verdict comment found on this PR`
   };
 }
@@ -2389,8 +2463,10 @@ function extractSecurityReviewVerdict(comments) {
   return extractVerdict(comments, /^[ \t]*(?:\*{1,3}|_{1,3})?VERDICT:\s*(PASS|FAIL)(?![A-Za-z0-9])/im, "security-review");
 }
 // ../../packages/aeg-core/src/review-gate.ts
-function isReviewGateExemptBranch(branch) {
-  return branch.startsWith("plan/");
+function isBoundToHead(extraction, headSha) {
+  if (!extraction.headSha)
+    return false;
+  return headSha.toLowerCase().startsWith(extraction.headSha.toLowerCase());
 }
 function checkReviewGate(input) {
   const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
@@ -2414,18 +2490,26 @@ function checkReviewGate(input) {
   const security = extractSecurityReviewVerdict(verifiedBodies);
   const codeReviewClean = codeReview.value === "APPROVE";
   const securityClean = security.value === "PASS";
-  if (codeReviewClean && securityClean) {
+  const codeReviewBound = isBoundToHead(codeReview, input.headSha);
+  const securityBound = isBoundToHead(security, input.headSha);
+  if (codeReviewClean && codeReviewBound && securityClean && securityBound) {
     return {
       verdict: "pass",
-      reason: "code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS.",
+      reason: `code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS, both covering head ${input.headSha}.`,
       waived: false
     };
   }
   const problems = [];
-  if (!codeReviewClean)
+  if (!codeReviewClean) {
     problems.push(`code-reviewer verdict is not a clean APPROVE (found: ${codeReview.value})`);
-  if (!securityClean)
+  } else if (!codeReviewBound) {
+    problems.push(`the newest code-review verdict covers ${codeReview.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
+  if (!securityClean) {
     problems.push(`security-review verdict is not a clean PASS (found: ${security.value})`);
+  } else if (!securityBound) {
+    problems.push(`the newest security-review verdict covers ${security.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
   const ignoredNote = ignoredCount > 0 ? ` ${ignoredCount} verdict-shaped comment(s) from authors outside the principal allowlist were ignored.` : "";
   return {
     verdict: "fail",
@@ -2433,6 +2517,11 @@ function checkReviewGate(input) {
     waived: false
   };
 }
+var CHANGESET_RELEASE_BRANCH = "changeset-release/main";
+var DEFAULT_RELEASE_ACTOR = "github-actions[bot]";
+function isChangesetsReleasePr(branch, author, expectedAuthor) {
+  return branch === CHANGESET_RELEASE_BRANCH && author === expectedAuthor;
+}
 // ../../packages/aeg-core/src/markdown-table.ts
 function splitRow(line) {
   const trimmed = line.trim().replace(/^\|/, "").replace(/\|$/, "");

package/dist/checks/bin/check-registry-gates.js

@@ -7,7 +7,27 @@ import matter2 from "gray-matter";
 // ../../packages/aeg-forge-state/src/strip-code.ts
 function maskCode(body) {
   const fill = (line) => " ".repeat(line.length);
-  return maskIndentedCode(maskFencedCode(body, fill), fill).replace(/(`+)[^\n]*?\1/g, (m) => " ".repeat(m.length));
+  const blocksMasked = maskIndentedCode(maskFencedCode(body, fill), fill);
+  return blocksMasked.split(`
+`).map((line) => replaceInlineSpans(line, (span) => " ".repeat(span.length))).join(`
+`);
+}
+var DETAILS_OPEN = /<details\b[^>]*>/gi;
+var DETAILS_CLOSE = /<\/details\s*>/gi;
+function maskDetailsBlocks(body) {
+  const fill = (line) => " ".repeat(line.length);
+  const lines = body.split(`
+`);
+  let depth = 0;
+  const out = lines.map((line) => {
+    const opens = line.match(DETAILS_OPEN)?.length ?? 0;
+    const closes = line.match(DETAILS_CLOSE)?.length ?? 0;
+    const maskThisLine = depth > 0 || opens > 0;
+    depth = Math.max(0, depth + opens - closes);
+    return maskThisLine ? fill(line) : line;
+  });
+  return out.join(`
+`);
 }
 function stripCode(body, options = {}) {
   const normalised = body.replace(/\r\n?/g, `
@@ -16,7 +36,50 @@ function stripCode(body, options = {}) {
   const blocksStripped = maskIndentedCode(maskFencedCode(normalised, blank), blank);
   if (options.inlineSpans === "keep")
     return blocksStripped;
-  return blocksStripped.replace(/(`+)[^\n]*?\1/g, "");
+  return blocksStripped.split(`
+`).map((line) => replaceInlineSpans(line, () => "")).join(`
+`);
+}
+function replaceInlineSpans(line, replace) {
+  let result = "";
+  let i = 0;
+  const runLengthAt = (at) => {
+    let j = at;
+    while (j < line.length && line[j] === "`")
+      j++;
+    return j - at;
+  };
+  while (i < line.length) {
+    if (line[i] !== "`") {
+      result += line[i];
+      i++;
+      continue;
+    }
+    const openLen = runLengthAt(i);
+    const openEnd = i + openLen;
+    let j = openEnd;
+    let closeEnd = -1;
+    while (j < line.length) {
+      if (line[j] !== "`") {
+        j++;
+        continue;
+      }
+      const runLen = runLengthAt(j);
+      if (runLen === openLen) {
+        closeEnd = j + runLen;
+        break;
+      }
+      j += runLen;
+    }
+    if (closeEnd === -1) {
+      result += line.slice(i, openEnd);
+      i = openEnd;
+    } else {
+      result += replace(line.slice(i, closeEnd));
+      i = closeEnd;
+    }
+  }
+  return result;
 }
 var FENCE_OPEN = /^ {0,3}(`{3,}|~{3,})([^\r\n]*)\r?$/;
 var FENCE_CLOSE = /^ {0,3}(`+|~+)[ \t]*\r?$/;
@@ -1755,9 +1818,10 @@ function evaluateC5(changed, docOwnersContent, prBody, fileExists, waiverActive,
   return out;
 }
 // ../../packages/aeg-core/src/pr-tier.ts
+var TIER_FIELD = /(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i;
 function readTierFromPrBody(prBody) {
   const searchIn = anchoredRegion(prBody, "TIER") ?? prBody;
-  const m = searchIn.match(/(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i);
+  const m = searchIn.match(TIER_FIELD);
   if (!m)
     return null;
   const t = Number(m[4]);
@@ -2370,15 +2434,25 @@ function checkClosesN2(branch, prBody, trancheFiles, taskIssueRefs) {
   return { ok: true, expectedIssue };
 }
 // ../../packages/aeg-core/src/verdict-extraction.ts
+var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
+function extractHeadSha(comment) {
+  const m = comment.match(HEAD_SHA_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
 function extractVerdict(comments, valuePattern, missingLabel) {
   const clearHits = comments.filter((c) => valuePattern.test(c));
   if (clearHits.length > 0) {
     const latest = clearHits[clearHits.length - 1];
     const m = latest.match(valuePattern);
-    return { value: m[1].toUpperCase().replace(/[_-]/g, " "), danglingNote: null };
+    return {
+      value: m[1].toUpperCase().replace(/[_-]/g, " "),
+      headSha: extractHeadSha(latest),
+      danglingNote: null
+    };
   }
   return {
     value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
+    headSha: null,
     danglingNote: `no ${missingLabel} verdict comment found on this PR`
   };
 }
@@ -2389,8 +2463,10 @@ function extractSecurityReviewVerdict(comments) {
   return extractVerdict(comments, /^[ \t]*(?:\*{1,3}|_{1,3})?VERDICT:\s*(PASS|FAIL)(?![A-Za-z0-9])/im, "security-review");
 }
 // ../../packages/aeg-core/src/review-gate.ts
-function isReviewGateExemptBranch(branch) {
-  return branch.startsWith("plan/");
+function isBoundToHead(extraction, headSha) {
+  if (!extraction.headSha)
+    return false;
+  return headSha.toLowerCase().startsWith(extraction.headSha.toLowerCase());
 }
 function checkReviewGate(input) {
   const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
@@ -2414,18 +2490,26 @@ function checkReviewGate(input) {
   const security = extractSecurityReviewVerdict(verifiedBodies);
   const codeReviewClean = codeReview.value === "APPROVE";
   const securityClean = security.value === "PASS";
-  if (codeReviewClean && securityClean) {
+  const codeReviewBound = isBoundToHead(codeReview, input.headSha);
+  const securityBound = isBoundToHead(security, input.headSha);
+  if (codeReviewClean && codeReviewBound && securityClean && securityBound) {
     return {
       verdict: "pass",
-      reason: "code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS.",
+      reason: `code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS, both covering head ${input.headSha}.`,
       waived: false
     };
   }
   const problems = [];
-  if (!codeReviewClean)
+  if (!codeReviewClean) {
     problems.push(`code-reviewer verdict is not a clean APPROVE (found: ${codeReview.value})`);
-  if (!securityClean)
+  } else if (!codeReviewBound) {
+    problems.push(`the newest code-review verdict covers ${codeReview.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
+  if (!securityClean) {
     problems.push(`security-review verdict is not a clean PASS (found: ${security.value})`);
+  } else if (!securityBound) {
+    problems.push(`the newest security-review verdict covers ${security.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
   const ignoredNote = ignoredCount > 0 ? ` ${ignoredCount} verdict-shaped comment(s) from authors outside the principal allowlist were ignored.` : "";
   return {
     verdict: "fail",
@@ -2433,6 +2517,11 @@ function checkReviewGate(input) {
     waived: false
   };
 }
+var CHANGESET_RELEASE_BRANCH = "changeset-release/main";
+var DEFAULT_RELEASE_ACTOR = "github-actions[bot]";
+function isChangesetsReleasePr(branch, author, expectedAuthor) {
+  return branch === CHANGESET_RELEASE_BRANCH && author === expectedAuthor;
+}
 // ../../packages/aeg-core/src/markdown-table.ts
 function splitRow(line) {
   const trimmed = line.trim().replace(/^\|/, "").replace(/\|$/, "");

package/dist/checks/bin/check-review-gate.js

@@ -5,7 +5,27 @@ import { execFileSync as execFileSync3 } from "node:child_process";
 // ../../packages/aeg-forge-state/src/strip-code.ts
 function maskCode(body) {
   const fill = (line) => " ".repeat(line.length);
-  return maskIndentedCode(maskFencedCode(body, fill), fill).replace(/(`+)[^\n]*?\1/g, (m) => " ".repeat(m.length));
+  const blocksMasked = maskIndentedCode(maskFencedCode(body, fill), fill);
+  return blocksMasked.split(`
+`).map((line) => replaceInlineSpans(line, (span) => " ".repeat(span.length))).join(`
+`);
+}
+var DETAILS_OPEN = /<details\b[^>]*>/gi;
+var DETAILS_CLOSE = /<\/details\s*>/gi;
+function maskDetailsBlocks(body) {
+  const fill = (line) => " ".repeat(line.length);
+  const lines = body.split(`
+`);
+  let depth = 0;
+  const out = lines.map((line) => {
+    const opens = line.match(DETAILS_OPEN)?.length ?? 0;
+    const closes = line.match(DETAILS_CLOSE)?.length ?? 0;
+    const maskThisLine = depth > 0 || opens > 0;
+    depth = Math.max(0, depth + opens - closes);
+    return maskThisLine ? fill(line) : line;
+  });
+  return out.join(`
+`);
 }
 function stripCode(body, options = {}) {
   const normalised = body.replace(/\r\n?/g, `
@@ -14,7 +34,50 @@ function stripCode(body, options = {}) {
   const blocksStripped = maskIndentedCode(maskFencedCode(normalised, blank), blank);
   if (options.inlineSpans === "keep")
     return blocksStripped;
-  return blocksStripped.replace(/(`+)[^\n]*?\1/g, "");
+  return blocksStripped.split(`
+`).map((line) => replaceInlineSpans(line, () => "")).join(`
+`);
+}
+function replaceInlineSpans(line, replace) {
+  let result = "";
+  let i = 0;
+  const runLengthAt = (at) => {
+    let j = at;
+    while (j < line.length && line[j] === "`")
+      j++;
+    return j - at;
+  };
+  while (i < line.length) {
+    if (line[i] !== "`") {
+      result += line[i];
+      i++;
+      continue;
+    }
+    const openLen = runLengthAt(i);
+    const openEnd = i + openLen;
+    let j = openEnd;
+    let closeEnd = -1;
+    while (j < line.length) {
+      if (line[j] !== "`") {
+        j++;
+        continue;
+      }
+      const runLen = runLengthAt(j);
+      if (runLen === openLen) {
+        closeEnd = j + runLen;
+        break;
+      }
+      j += runLen;
+    }
+    if (closeEnd === -1) {
+      result += line.slice(i, openEnd);
+      i = openEnd;
+    } else {
+      result += replace(line.slice(i, closeEnd));
+      i = closeEnd;
+    }
+  }
+  return result;
 }
 var FENCE_OPEN = /^ {0,3}(`{3,}|~{3,})([^\r\n]*)\r?$/;
 var FENCE_CLOSE = /^ {0,3}(`+|~+)[ \t]*\r?$/;
@@ -1753,9 +1816,10 @@ function evaluateC5(changed, docOwnersContent, prBody, fileExists, waiverActive,
   return out;
 }
 // ../../packages/aeg-core/src/pr-tier.ts
+var TIER_FIELD = /(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i;
 function readTierFromPrBody(prBody) {
   const searchIn = anchoredRegion(prBody, "TIER") ?? prBody;
-  const m = searchIn.match(/(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i);
+  const m = searchIn.match(TIER_FIELD);
   if (!m)
     return null;
   const t = Number(m[4]);
@@ -2368,15 +2432,25 @@ function checkClosesN2(branch, prBody, trancheFiles, taskIssueRefs) {
   return { ok: true, expectedIssue };
 }
 // ../../packages/aeg-core/src/verdict-extraction.ts
+var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
+function extractHeadSha(comment) {
+  const m = comment.match(HEAD_SHA_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
 function extractVerdict(comments, valuePattern, missingLabel) {
   const clearHits = comments.filter((c) => valuePattern.test(c));
   if (clearHits.length > 0) {
     const latest = clearHits[clearHits.length - 1];
     const m = latest.match(valuePattern);
-    return { value: m[1].toUpperCase().replace(/[_-]/g, " "), danglingNote: null };
+    return {
+      value: m[1].toUpperCase().replace(/[_-]/g, " "),
+      headSha: extractHeadSha(latest),
+      danglingNote: null
+    };
   }
   return {
     value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
+    headSha: null,
     danglingNote: `no ${missingLabel} verdict comment found on this PR`
   };
 }
@@ -2387,8 +2461,10 @@ function extractSecurityReviewVerdict(comments) {
   return extractVerdict(comments, /^[ \t]*(?:\*{1,3}|_{1,3})?VERDICT:\s*(PASS|FAIL)(?![A-Za-z0-9])/im, "security-review");
 }
 // ../../packages/aeg-core/src/review-gate.ts
-function isReviewGateExemptBranch(branch) {
-  return branch.startsWith("plan/");
+function isBoundToHead(extraction, headSha) {
+  if (!extraction.headSha)
+    return false;
+  return headSha.toLowerCase().startsWith(extraction.headSha.toLowerCase());
 }
 function checkReviewGate(input) {
   const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
@@ -2412,18 +2488,26 @@ function checkReviewGate(input) {
   const security = extractSecurityReviewVerdict(verifiedBodies);
   const codeReviewClean = codeReview.value === "APPROVE";
   const securityClean = security.value === "PASS";
-  if (codeReviewClean && securityClean) {
+  const codeReviewBound = isBoundToHead(codeReview, input.headSha);
+  const securityBound = isBoundToHead(security, input.headSha);
+  if (codeReviewClean && codeReviewBound && securityClean && securityBound) {
     return {
       verdict: "pass",
-      reason: "code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS.",
+      reason: `code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS, both covering head ${input.headSha}.`,
       waived: false
     };
   }
   const problems = [];
-  if (!codeReviewClean)
+  if (!codeReviewClean) {
     problems.push(`code-reviewer verdict is not a clean APPROVE (found: ${codeReview.value})`);
-  if (!securityClean)
+  } else if (!codeReviewBound) {
+    problems.push(`the newest code-review verdict covers ${codeReview.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
+  if (!securityClean) {
     problems.push(`security-review verdict is not a clean PASS (found: ${security.value})`);
+  } else if (!securityBound) {
+    problems.push(`the newest security-review verdict covers ${security.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  }
   const ignoredNote = ignoredCount > 0 ? ` ${ignoredCount} verdict-shaped comment(s) from authors outside the principal allowlist were ignored.` : "";
   return {
     verdict: "fail",
@@ -2431,6 +2515,11 @@ function checkReviewGate(input) {
     waived: false
   };
 }
+var CHANGESET_RELEASE_BRANCH = "changeset-release/main";
+var DEFAULT_RELEASE_ACTOR = "github-actions[bot]";
+function isChangesetsReleasePr(branch, author, expectedAuthor) {
+  return branch === CHANGESET_RELEASE_BRANCH && author === expectedAuthor;
+}
 // ../../packages/aeg-core/src/markdown-table.ts
 function splitRow(line) {
   const trimmed = line.trim().replace(/^\|/, "").replace(/\|$/, "");
@@ -3133,7 +3222,9 @@ var VinayaConfigSchema = z.object({
   briefSchema: BriefSchemaSchema.optional(),
   managed: ManagedManifestSchema.optional(),
   principals: z.array(z.string()).min(1).optional(),
-  ci: z.object({ setup: z.string().min(1) }).optional()
+  releaseActor: z.string().min(1).optional(),
+  ci: z.object({ setup: z.string().min(1) }).optional(),
+  blastRadius: z.object({ extraDomains: z.array(z.string()).optional() }).optional()
 });
 var GLOBAL_VINAYA_HOME = join(homedir(), ".vinaya");
 var GLOBAL_CONFIG_PATH = join(GLOBAL_VINAYA_HOME, "config.json");
@@ -3141,6 +3232,9 @@ var LOCAL_CONFIG_FILENAME = "vinaya.config.json";
 function resolvePrincipalAllowlist(config) {
   return config?.principals ?? PRINCIPAL_ALLOWLIST;
 }
+function resolveReleaseActor(config) {
+  return config?.releaseActor ?? DEFAULT_RELEASE_ACTOR;
+}
 function trustAnchorRepo() {
   const wellFormed = (slug) => /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
   const fromRunner = process.env.GITHUB_REPOSITORY?.trim();
@@ -3183,7 +3277,7 @@ function isMissingFileError(err) {
   return /\b404\b|not found/i.test(haystack);
 }
 function loadTrustAnchorConfig(fetcher = ghFetchTrustAnchorConfig) {
-  const warn = (why) => process.stdout.write(`⚠ could not read \`principals\` from the default branch (${why}) — falling back to vinaya's built-in principal allowlist.
+  const warn = (why) => process.stdout.write(`⚠ could not read the trust-anchor config (\`principals\`/\`releaseActor\`) from the default branch (${why}) — falling back to vinaya's built-in defaults.
 `);
   let base64;
   try {
@@ -3210,16 +3304,9 @@ function loadTrustAnchorConfig(fetcher = ghFetchTrustAnchorConfig) {
 
 // src/checks/bin/check-review-gate.ts
 var CHECK_NAME = "review-gate";
-function git(args) {
-  try {
-    return execFileSync3("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
-  } catch {
-    return "";
-  }
-}
 function fetchPr(prNumber) {
   try {
-    const out = execFileSync3("gh", ["pr", "view", String(prNumber), "--json", "number,comments,labels"], {
+    const out = execFileSync3("gh", ["pr", "view", String(prNumber), "--json", "number,comments,labels,headRefOid"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -3243,10 +3330,6 @@ function fetchWaiverLabelActor(prNumber, label2) {
   }
 }
 function main() {
-  const branch = process.env.BRANCH || git(["rev-parse", "--abbrev-ref", "HEAD"]);
-  if (isReviewGateExemptBranch(branch)) {
-    process.exit(0);
-  }
   const prNumberStr = process.env.PR_NUMBER;
   if (!prNumberStr) {
     process.exit(0);
@@ -3269,7 +3352,8 @@ function main() {
     comments: pr.comments.map((c) => ({ body: c.body, author: c.author?.login ?? null })),
     labels,
     waiverLabelActor,
-    principalAllowlist: resolvePrincipalAllowlist(loadTrustAnchorConfig())
+    principalAllowlist: resolvePrincipalAllowlist(loadTrustAnchorConfig()),
+    headSha: pr.headRefOid
   });
   if (result.verdict === "fail") {
     emitCheckError({