@attalabs/vinaya 0.12.0 → 0.17.0

package/dist/index.js

@@ -1,16 +1,19 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync19 } from "node:fs";
-import { dirname as dirname8, join as join21 } from "node:path";
+import { readFileSync as readFileSync21 } from "node:fs";
+import { dirname as dirname8, join as join22 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/commands/archive.ts
-import { execFileSync as execFileSync3 } from "node:child_process";
+import { execFileSync as execFileSync4 } from "node:child_process";
 // ../../packages/aeg-forge-state/src/strip-code.ts
 function maskCode(body) {
   const fill = (line) => " ".repeat(line.length);
-  return maskIndentedCode(maskFencedCode(body, fill), fill).replace(/(`+)[^\n]*?\1/g, (m) => " ".repeat(m.length));
+  const blocksMasked = maskIndentedCode(maskFencedCode(body, fill), fill);
+  return blocksMasked.split(`
+`).map((line) => replaceInlineSpans(line, (span) => " ".repeat(span.length))).join(`
+`);
 }
 function stripCode(body, options = {}) {
   const normalised = body.replace(/\r\n?/g, `
@@ -19,7 +22,50 @@ function stripCode(body, options = {}) {
   const blocksStripped = maskIndentedCode(maskFencedCode(normalised, blank), blank);
   if (options.inlineSpans === "keep")
     return blocksStripped;
-  return blocksStripped.replace(/(`+)[^\n]*?\1/g, "");
+  return blocksStripped.split(`
+`).map((line) => replaceInlineSpans(line, () => "")).join(`
+`);
+}
+function replaceInlineSpans(line, replace) {
+  let result = "";
+  let i = 0;
+  const runLengthAt = (at) => {
+    let j = at;
+    while (j < line.length && line[j] === "`")
+      j++;
+    return j - at;
+  };
+  while (i < line.length) {
+    if (line[i] !== "`") {
+      result += line[i];
+      i++;
+      continue;
+    }
+    const openLen = runLengthAt(i);
+    const openEnd = i + openLen;
+    let j = openEnd;
+    let closeEnd = -1;
+    while (j < line.length) {
+      if (line[j] !== "`") {
+        j++;
+        continue;
+      }
+      const runLen = runLengthAt(j);
+      if (runLen === openLen) {
+        closeEnd = j + runLen;
+        break;
+      }
+      j += runLen;
+    }
+    if (closeEnd === -1) {
+      result += line.slice(i, openEnd);
+      i = openEnd;
+    } else {
+      result += replace(line.slice(i, closeEnd));
+      i = closeEnd;
+    }
+  }
+  return result;
 }
 var FENCE_OPEN = /^ {0,3}(`{3,}|~{3,})([^\r\n]*)\r?$/;
 var FENCE_CLOSE = /^ {0,3}(`+|~+)[ \t]*\r?$/;
@@ -53,6 +99,10 @@ function scanFencedCode(body) {
   });
   return { lines, unterminated: fenceChar !== null };
 }
+function hasUnterminatedFence(body) {
+  return scanFencedCode(body.replace(/\r\n?/g, `
+`)).unterminated;
+}
 var LIST_MARKER = /^ {0,3}(?:[-*+]|\d{1,9}[.)])(?:\s|$)/;
 function indentWidth(line) {
   let width = 0;
@@ -240,6 +290,42 @@ function matchesLabel(key, name) {
 function hasLabel(key, names) {
   return names.some((n) => matchesLabel(key, n));
 }
+
+// ../../packages/aeg-forge-state/src/list-tasks.ts
+var PROJECT_SLUG = /^[a-z0-9][a-z0-9-]*$/i;
+var PROJECT_FIELD = /^\s*(?:\*\*)?Project(?:\(s\))?(?:\*\*)?\s*:\s*(?:\*\*)?\s*(.+)$/im;
+var VALUE_EDGE_MARKUP = /^[`.;\s]+|[`.;\s]+$/g;
+function unwrapValue(raw) {
+  return raw.replace(/\*\*/g, "").replace(VALUE_EDGE_MARKUP, "");
+}
+function projectFieldFromBody(body) {
+  const m = stripCode(body, { inlineSpans: "keep" }).match(PROJECT_FIELD);
+  if (m)
+    return parseFieldValue(m[1] ?? "");
+  if (hasUnterminatedFence(body)) {
+    const raw = body.match(PROJECT_FIELD);
+    if (raw)
+      return { declared: true, names: [], unparsed: [(raw[1] ?? "").trim()], unreadable: true };
+  }
+  return { declared: false, names: [], unparsed: [], unreadable: false };
+}
+function parseFieldValue(value) {
+  const names = [];
+  const unparsed = [];
+  for (const raw of value.split(",")) {
+    const name = unwrapValue(raw);
+    if (name.length === 0)
+      continue;
+    if (PROJECT_SLUG.test(name))
+      names.push(name);
+    else
+      unparsed.push(raw.trim());
+  }
+  return { declared: true, names: [...new Set(names)], unparsed, unreadable: false };
+}
+function projectsFromBody(body) {
+  return projectFieldFromBody(body).names;
+}
 // ../../packages/aeg-forge-state/src/github-token.ts
 import { execFile as execFile2 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
@@ -392,6 +478,85 @@ function splitTableRow(row) {
     parts.pop();
   return parts.map((p) => p.split(PLACEHOLDER).join("|"));
 }
+// ../../packages/aeg-core/src/blast-radius-domains.ts
+function resolveWorkspaceEntry(entry2, listDirs) {
+  if (entry2.endsWith("/*")) {
+    const baseDir = entry2.slice(0, -2);
+    return listDirs(baseDir).map((name) => `${baseDir}/${name}`);
+  }
+  if (entry2.includes("*"))
+    return [];
+  return [entry2];
+}
+function deriveWorkspacePackageDomains(workspaces, listDirs) {
+  const positive = workspaces.filter((entry2) => !entry2.startsWith("!"));
+  const negative = workspaces.filter((entry2) => entry2.startsWith("!")).map((entry2) => entry2.slice(1));
+  const excluded = new Set;
+  for (const entry2 of negative) {
+    for (const member of resolveWorkspaceEntry(entry2, listDirs))
+      excluded.add(member);
+  }
+  const domains = new Set;
+  for (const entry2 of positive) {
+    for (const member of resolveWorkspaceEntry(entry2, listDirs)) {
+      if (excluded.has(member))
+        continue;
+      const segments = member.split("/");
+      if (segments[0] !== "packages" || segments.length < 2)
+        continue;
+      domains.add(`packages/${segments[1]}`);
+    }
+  }
+  return [...domains].sort();
+}
+function parsePnpmWorkspaceYaml(content) {
+  const unquote = (s) => {
+    const t = s.trim();
+    if (t.length >= 2 && (t[0] === "'" && t.at(-1) === "'" || t[0] === '"' && t.at(-1) === '"')) {
+      return t.slice(1, -1);
+    }
+    return t;
+  };
+  const inlineMatch = content.match(/^packages:\s*\[(.*)\]\s*$/m);
+  if (inlineMatch) {
+    return (inlineMatch[1] ?? "").split(",").map(unquote).filter((s) => s.length > 0);
+  }
+  const entries = [];
+  let inBlock = false;
+  for (const rawLine of content.split(`
+`)) {
+    const line = rawLine.replace(/#.*$/, "");
+    if (/^packages:\s*$/.test(line)) {
+      inBlock = true;
+      continue;
+    }
+    if (!inBlock)
+      continue;
+    const itemMatch = line.match(/^\s+-\s*(.+?)\s*$/);
+    if (itemMatch?.[1]) {
+      entries.push(unquote(itemMatch[1]));
+      continue;
+    }
+    if (line.trim().length === 0)
+      continue;
+    break;
+  }
+  return entries;
+}
+var CROSS_CUTTING_CANDIDATES = [
+  "bun.lock",
+  "package-lock.json",
+  "pnpm-lock.yaml",
+  "yarn.lock",
+  "turbo.json",
+  "biome.json",
+  "tsconfig.json",
+  ".github/workflows",
+  ".husky"
+];
+function deriveBuiltinCrossCuttingDefaults(exists) {
+  return CROSS_CUTTING_CANDIDATES.filter((path) => exists(path));
+}
 // ../../packages/aeg-core/src/state-machine-model.ts
 var FORGE_FACT_INPUTS = [
   {
@@ -457,12 +622,30 @@ var DERIVED_STATUSES = [
   "incoherent"
 ];
 var DERIVABLE_STATUSES = DERIVED_STATUSES.filter((s) => s !== "backlog");
+// ../../packages/aeg-core/src/file-classify.ts
+function isCodeFile(p) {
+  if (p.endsWith(".md"))
+    return false;
+  return /\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs|sql|css)$/.test(p);
+}
 // ../../packages/aeg-core/src/waiver-label.ts
 var WAIVER_LABEL = label("waiver-docs");
 var WAIVER_LABEL_REVIEW = label("waiver-review");
+var PRINCIPAL_ALLOWLIST = ["daniboomerang"];
+function isPrincipal(login, principalAllowlist) {
+  if (login === null)
+    return false;
+  const normalized = login.toLowerCase();
+  return principalAllowlist.some((p) => p.toLowerCase() === normalized);
+}
 
 // ../../packages/aeg-core/src/doc-owners.ts
 var DOC_OWNERS_PATH = ".vinaya/doc-owners";
+function classifyDocOwnersManifest(content) {
+  if (content === null)
+    return "absent";
+  return content.trim() === "" ? "empty" : "present";
+}
 function parseDocOwners(content) {
   const bindings = [];
   const errors = [];
@@ -507,11 +690,19 @@ function globToRegex(pat) {
   re += "$";
   return new RegExp(re);
 }
+function isUrlPointer(p) {
+  return /^https?:\/\//.test(p);
+}
+function pointerToPath(p) {
+  const idx = p.indexOf("#");
+  return idx === -1 ? p : p.slice(0, idx);
+}
 var SEPARATOR = /(?:[ \t]*[—–][ \t]*|[ \t]+-[ \t]+)/.source;
 // ../../packages/aeg-core/src/pr-tier.ts
+var TIER_FIELD = /(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i;
 function readTierFromPrBody(prBody) {
   const searchIn = anchoredRegion(prBody, "TIER") ?? prBody;
-  const m = searchIn.match(/(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i);
+  const m = searchIn.match(TIER_FIELD);
   if (!m)
     return null;
   const t = Number(m[4]);
@@ -789,19 +980,105 @@ function checkIssueRationale(body) {
 function isTaskIssueLabelSet(labels) {
   return hasLabel("tranche", labels);
 }
+var PATH_TEXT = (body) => stripCode(body, { inlineSpans: "keep" });
+var DOC_EXTENSION_RE = /\.(?:md|mdx|txt)$/i;
+function namesPath(text, path) {
+  const escaped = path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const occurrences = new RegExp(`(?:^|[^\\w./-])(${escaped}(?:/[\\w.@-]+)*)(?![\\w-])`, "gm");
+  for (const m of text.matchAll(occurrences)) {
+    if (!DOC_EXTENSION_RE.test(m[1]))
+      return true;
+  }
+  return false;
+}
+var BLAST_RADIUS_ACK_RE = /(?:\*\*)?blast-radius-ack(?:\*\*)?\s*[:—–-]/i;
+function checkBlastRadiusScope(body, _labels, sharedPackages, projectPaths) {
+  if (sharedPackages.length === 0)
+    return { status: "pass", errors: [] };
+  const text = [
+    rationaleFieldText(PATH_TEXT(body), "Boundary"),
+    rationaleFieldText(PATH_TEXT(body), "Project\\(s\\)|Project(?:s)?\\s*\\+|blast radius")
+  ].join(`
+`);
+  const named = sharedPackages.filter((d) => namesPath(text, d));
+  if (named.length === 0)
+    return { status: "pass", errors: [] };
+  const registered = new Set(projectPaths.map((p) => p.name.trim()));
+  const declared = projectsFromBody(body);
+  const projects = declared.filter((p) => registered.has(p));
+  const ownedPaths = projectPaths.filter((p) => projects.includes(p.name)).map((p) => p.path.replace(/\/+$/, ""));
+  const unowned = named.filter((d) => !ownedPaths.some((owned) => d === owned || d.startsWith(`${owned}/`)));
+  if (unowned.length === 0)
+    return { status: "pass", errors: [] };
+  if (projects.length > 1)
+    return { status: "pass", errors: [] };
+  if (BLAST_RADIUS_ACK_RE.test(PATH_TEXT(body)))
+    return { status: "pass", errors: [] };
+  const unregistered = declared.filter((p) => !registered.has(p));
+  return {
+    status: "fail",
+    errors: [
+      `issue-validation blast radius: the rationale names ${unowned.join(", ")} — a shared collision domain no declared project (${projects.join(", ") || "none"}) owns — but declares a single registered project and no \`blast-radius-ack:\` line.${unregistered.length > 0 ? ` Not counted: ${unregistered.join(", ")} — no row in \`.vinaya/projects.md\`, so it adds no review lens.` : ""} Project(s) drives the review fan-out (.vinaya/projects.md); list every consumer in the blast radius, or add \`blast-radius-ack: <why one lens is enough>\`.`
+    ]
+  };
+}
+var BRIEF_MARKERS = [
+  { name: "## References", pattern: /(?:^#{1,6}\s*|\*\*)\s*References\b/im },
+  { name: "Technical surface map", pattern: /(?:^#{1,6}\s*|\*\*)\s*Technical surface map\b/im },
+  { name: "Premise", pattern: /(?:^#{1,6}\s*|\*\*)\s*Premise(?:\*\*)?\s*[:—–]/im },
+  { name: "Step 0", pattern: /(?:^#{1,6}\s*|\*\*)\s*Step 0\b/im },
+  { name: "Test Plan", pattern: /(?:^#{1,6}\s*|\*\*)\s*Test Plan\b/im }
+];
+function checkNoBriefContent(body) {
+  const text = stripCode(body);
+  const errors = BRIEF_MARKERS.filter((m) => m.pattern.test(text)).map((m) => `issue-validation brief content: the Issue body carries a brief-shaped "${m.name}" section. Brief-time content (surface pointers, skills-to-read, premise, test plan) belongs in the brief, not the Issue — it goes stale before work starts (aeg-root/skills/brief-authoring/SKILL.md). Move it to the brief.`);
+  return { status: errors.length > 0 ? "fail" : "pass", errors };
+}
+function rationaleFieldText(text, labelPattern) {
+  const re = new RegExp(`(?:\\*\\*|^#{1,4}\\s+)\\s*(?:${labelPattern})[^\\n]*\\n?([\\s\\S]*?)(?=\\n\\s*(?:\\*\\*[A-Z]|#{1,4}\\s)|(?![\\s\\S]))`, "im");
+  const m = re.exec(text);
+  return m ? m[0] : "";
+}
+var DOC_PATH_RE = /(?:(?:aeg-root|apps|packages|specs|docs|tools|\.claude|\.github)\/[\w./@-]*\.(?:md|mdx)|\.claude\/(?:skills|rules)\/[\w./-]+|\b(?:docs-index|decisions|projects|state-machine|enforcement|process|README|CLAUDE)\.md\b|\b[\w-]+-(?:spec|decisions|backlog)\.md\b)/i;
+var NO_DOC_SURFACE_RE = /(?:\*\*)?\s*no-doc-surface/i;
+function checkRationaleNamesDocs(body) {
+  const text = PATH_TEXT(body);
+  const scope = [rationaleFieldText(text, "Docs to keep coherent|§7"), rationaleFieldText(text, "Traps")].join(`
+`);
+  if (NO_DOC_SURFACE_RE.test(scope))
+    return { status: "pass", errors: [] };
+  if (DOC_PATH_RE.test(scope))
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      'issue-validation docs read: neither "Docs to keep coherent" nor "Traps to avoid" names a concrete doc path (aeg-root/…, .claude/skills/…, apps/*/CLAUDE.md, apps/*/specs/…). Naming one is the artifact of having read the surface being planned — the forge write triggers no skill-check hook, so this field is the only read-obligation signal. For a genuinely doc-less surface, write the explicit `no-doc-surface` sentinel.'
+    ]
+  };
+}
 
 // ../../packages/aeg-core/src/coherence-checks.ts
 var R1_GRANDFATHERED_ISSUES = new Set([279, 280, 281, 282]);
 // ../../packages/aeg-core/src/verdict-extraction.ts
+var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
+function extractHeadSha(comment) {
+  const m = comment.match(HEAD_SHA_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
 function extractVerdict(comments, valuePattern, missingLabel) {
   const clearHits = comments.filter((c) => valuePattern.test(c));
   if (clearHits.length > 0) {
     const latest = clearHits[clearHits.length - 1];
     const m = latest.match(valuePattern);
-    return { value: m[1].toUpperCase().replace(/[_-]/g, " "), danglingNote: null };
+    return {
+      value: m[1].toUpperCase().replace(/[_-]/g, " "),
+      headSha: extractHeadSha(latest),
+      danglingNote: null
+    };
   }
   return {
     value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
+    headSha: null,
     danglingNote: `no ${missingLabel} verdict comment found on this PR`
   };
 }
@@ -963,6 +1240,7 @@ var CHECKS_WORKFLOW_PATH = ".github/workflows/vinaya-checks.yml";
 var REVIEW_WORKFLOW_PATH = ".github/workflows/vinaya-review.yml";
 var REVIEW_VERDICT_WORKFLOW_PATH = ".github/workflows/vinaya-review-verdict.yml";
 var ARCHIVIST_WORKFLOW_PATH = ".github/workflows/vinaya-archivist.yml";
+var BODY_CHECKS_WORKFLOW_PATH = ".github/workflows/vinaya-body-checks.yml";
 var MANAGED_NOTE = "Managed by Vinaya — created by `vinaya init`. `vinaya upgrade` regenerates it; `vinaya eject` removes it.";
 function starterConfig() {
   return {
@@ -989,9 +1267,31 @@ function ownVersion() {
   return pkg.version;
 }
 var SETUP_BUN_SHA = "0c5077e51419868618aeaa5fe8019c62421857d6";
-function vinayaSetupSteps(selfHost) {
+function vinayaSetupSteps(selfHost, sourceTrust = "pull-request") {
   if (!selfHost)
     return "";
+  if (sourceTrust === "trusted") {
+    return `      # Pinned to a commit, not the mutable \`v2\` tag. A repoint of
+      # \`v2\` would execute new upstream code in every adopter on the next run,
+      # with no diff anywhere to review. Resolved from the \`v2\` tag on
+      # 2026-08-14. Bun's own version still comes from the repo's
+      # \`packageManager\` field, not from this pin.
+      - uses: oven-sh/setup-bun@${SETUP_BUN_SHA}
+      # This repo declares the \`@attalabs/vinaya\` workspace package itself, so
+      # \`npx @attalabs/vinaya\` resolves to that local member instead of the
+      # registry and dies on its unbuilt \`bin\`. Build and run the trusted
+      # default-branch copy directly.
+      #
+      # This workflow executes only a trusted checkout selected by its event:
+      # never the pull request head or merge ref. The review-authority decision
+      # therefore comes from code the pull request cannot alter. \`--ignore-scripts\`
+      # remains defense in depth against lifecycle hooks in that trusted tree.
+      - name: Build the trusted Vinaya CLI
+        run: |
+          bun install --frozen-lockfile --ignore-scripts
+          bun run --cwd ${selfHost.dir} build
+`;
+  }
   return `      # Pinned to a commit, not the mutable \`v2\` tag. This is the first
       # THIRD-PARTY action this generator writes into an adopter's repository,
       # and it runs in the same job that then builds and executes pull-request
@@ -1095,7 +1395,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 20
-${vinayaSetupSteps(selfHost)}${adopterSetupStep(ciSetup)}      - name: Run checks
+${vinayaSetupSteps(selfHost, "pull-request")}${adopterSetupStep(ciSetup)}      - name: Run checks
         env:
           GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: \${{ github.event.pull_request.number }}
@@ -1129,21 +1429,27 @@ ${vinayaSetupSteps(selfHost)}${adopterSetupStep(ciSetup)}      - name: Run check
           } >> "$GITHUB_STEP_SUMMARY"
 `;
 }
-function reviewWorkflow(selfHost, ciSetup) {
+function reviewWorkflow(selfHost) {
   return `# ${MANAGED_NOTE}
 #
-# The required review gate — pull_request events only. The verdict-comment
+# The required review gate. \`pull_request_target\` is the trust boundary:
+# GitHub loads this workflow and its default checkout from the repository's
+# default branch, never from the pull request being judged. The job does not
+# fetch, check out, install, build, or execute pull-request content.
+#
+# The verdict-comment
 # half lives in its own workflow (vinaya-review-verdict.yml): a new PR
-# comment fires a different GitHub event that this pull_request-only
+# comment fires a different GitHub event that this
 # workflow structurally cannot receive — and keeping the comment path in a
 # separate FILE means this workflow's runs never list permanently-skipped
 # comment jobs on the PR's checks panel. When a clean final verdict lands,
 # the verdict workflow re-runs this one, so the required check below goes
 # green natively with no manual rerun.
 name: Vinaya Review Gate
+run-name: "Vinaya Review Gate PR #\${{ github.event.pull_request.number }} @ \${{ github.event.pull_request.head.sha }}"
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, synchronize, reopened, labeled, unlabeled]
 
 # One run per pull request COMMIT, always. Several \`types:\` above can fire in the
@@ -1183,30 +1489,96 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          # This job executes repo content; don't leave the token in
-          # .git/config for scripts to read.
+          # Explicit trusted ref: never use the PR head/merge ref in this job.
+          ref: \${{ github.event.repository.default_branch }}
           persist-credentials: false
           fetch-depth: 0
       - uses: actions/setup-node@v4
         with:
           node-version: 20
-${vinayaSetupSteps(selfHost)}${adopterSetupStep(ciSetup)}      - name: Review gate
+${vinayaSetupSteps(selfHost, "trusted")}      - name: Review gate
         env:
           GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
           # PR_NUMBER is what makes the review-gate check EVALUATE: without
           # it the adapter reads "no PR yet — local dev" and exits 0, and
           # the gate is green regardless of review state.
           PR_NUMBER: \${{ github.event.pull_request.number }}
-          BRANCH: \${{ github.head_ref }}
         run: ${vinayaRun(selfHost, "check review-gate")}
 `;
 }
-function reviewVerdictWorkflow(selfHost, ciSetup) {
+function bodyChecksWorkflow(selfHost) {
+  return `# ${MANAGED_NOTE}
+#
+# Required, PR-content-independent checks that need a trust anchor no pull
+# request can rewrite. \`pull_request_target\` is the same boundary
+# \`vinaya-review.yml\` uses: GitHub loads this workflow and its default
+# checkout from the repository's default branch, never from the pull
+# request being judged. The job does not fetch, check out, install, build,
+# or execute pull-request content — every check registered here reads only
+# live-fetched PR metadata (\`gh pr view\`), never the diff or repo tree, the
+# same shape \`review-gate\` already requires of its own checks.
+#
+# \`body-bare-digits\` is the one check here today: its Changesets-release
+# exemption live-fetches the PR's real author, keyed on \`PR_NUMBER\` — on a
+# \`pull_request\` trigger that value is PR-editable (the PR's own workflow
+# YAML controls it), so an attacker could redirect it to any
+# already-approved PR by the configured release actor. Found live (round 5,
+# security review, PR #165), and verified no env-var or git-state signal
+# inside a \`pull_request\` job closes it — \`pull_request_target\` does,
+# because the workflow text assigning \`PR_NUMBER\` comes from THIS file on
+# the default branch, which a pull request cannot edit.
+name: Vinaya Body Checks
+run-name: "Vinaya Body Checks PR #\${{ github.event.pull_request.number }} @ \${{ github.event.pull_request.head.sha }}"
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, edited]
+
+# Same collapsing rationale as \`vinaya-review.yml\`'s concurrency group — see
+# that file's own comment for the two measured failure modes (duplicate
+# runs from simultaneous event types; an old rerun cancelling the current
+# commit's run) this group exists to prevent.
+concurrency:
+  group: vinaya-body-checks-\${{ github.event.pull_request.number || github.ref }}-\${{ github.event.pull_request.head.sha || github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  vinaya-body-checks:
+    name: vinaya check body-bare-digits
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Explicit trusted ref: never use the PR head/merge ref in this job.
+          ref: \${{ github.event.repository.default_branch }}
+          persist-credentials: false
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+${vinayaSetupSteps(selfHost, "trusted")}      - name: Body checks
+        env:
+          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+          # PR_NUMBER is what makes the Changesets-release exemption
+          # EVALUATE its live gh pr view fetch: without it the check reads
+          # "no PR yet — local dev" and falls through to the ordinary
+          # bare-digit scan.
+          PR_NUMBER: \${{ github.event.pull_request.number }}
+          # PR_BODY is what makes body-bare-digits EVALUATE at all — the bin
+          # reads \`process.env.PR_BODY\` only, never fetches it itself.
+          PR_BODY: \${{ github.event.pull_request.body }}
+        run: ${vinayaRun(selfHost, "check body-bare-digits")}
+`;
+}
+function reviewVerdictWorkflow(selfHost) {
   return `# ${MANAGED_NOTE}
 #
 # The verdict-comment half of the review gate. A reviewer's verdict arrives
 # as a PR comment (\`VERDICT: APPROVE\` / \`VERDICT: PASS\`), which fires
-# GitHub's \`issue_comment\` event — an event the required pull_request
+# GitHub's \`issue_comment\` event — an event the required PR-event
 # workflow cannot receive. This workflow evaluates the gate on that comment
 # and, when the evaluation is clean, RE-RUNS the required workflow so its
 # check goes green natively with no manual rerun. (Writing check-run
@@ -1214,11 +1586,10 @@ function reviewVerdictWorkflow(selfHost, ciSetup) {
 # restricts check-run updates to the owning workflow — re-running is the
 # supported channel.)
 #
-# Privilege split, deliberate: \`evaluate\` checks out and executes repo
-# content and therefore holds NO write permission; \`retrigger\` holds
-# \`actions: write\` but checks out and executes nothing — its only inputs
-# are the evaluator's outputs, resolved via \`gh pr view\` before any repo
-# content ran. A malicious branch can at worst fail its own evaluation.
+# Privilege split, deliberate: \`evaluate\` executes only the default branch's
+# trusted gate code and holds NO write permission; \`retrigger\` holds
+# \`actions: write\` but checks out and executes nothing. Neither job checks
+# out or executes pull-request content.
 name: Vinaya Review Gate (on verdict)
 
 on:
@@ -1235,38 +1606,36 @@ jobs:
       pull-requests: read
       issues: read
     outputs:
-      branch: \${{ steps.pr.outputs.branch }}
+      number: \${{ steps.pr.outputs.number }}
       sha: \${{ steps.pr.outputs.sha }}
     steps:
-      # issue_comment payloads carry no PR head SHA/branch — resolve them
-      # before checkout, and check out that exact commit (the event's default
-      # ref is the repo's default branch, not the PR head).
+      # issue_comment payloads carry no PR head SHA — resolve it for immutable
+      # run identity only. It never selects executable code.
       - name: Resolve PR head
         id: pr
         env:
           GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
         run: |
           NUMBER="\${{ github.event.issue.number }}"
-          BRANCH=$(gh pr view "$NUMBER" --repo "\${{ github.repository }}" --json headRefName -q .headRefName)
           SHA=$(gh pr view "$NUMBER" --repo "\${{ github.repository }}" --json headRefOid -q .headRefOid)
           echo "number=$NUMBER" >> "$GITHUB_OUTPUT"
-          echo "branch=$BRANCH" >> "$GITHUB_OUTPUT"
           echo "sha=$SHA" >> "$GITHUB_OUTPUT"
       - uses: actions/checkout@v4
         with:
-          ref: \${{ steps.pr.outputs.sha }}
+          # issue_comment already sources workflows from the default branch;
+          # make the trusted code checkout explicit too.
+          ref: \${{ github.event.repository.default_branch }}
           persist-credentials: false
           fetch-depth: 0
       - uses: actions/setup-node@v4
         with:
           node-version: 20
-${vinayaSetupSteps(selfHost)}${adopterSetupStep(ciSetup)}      - name: Review gate (verdict evaluation)
+${vinayaSetupSteps(selfHost, "trusted")}      - name: Review gate (verdict evaluation)
         env:
           GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
           # Same wiring as the required workflow: PR_NUMBER is what makes
           # the adapter evaluate instead of no-op'ing as "local dev".
           PR_NUMBER: \${{ steps.pr.outputs.number }}
-          BRANCH: \${{ steps.pr.outputs.branch }}
         run: ${vinayaRun(selfHost, "check review-gate")}
 
   # Executes nothing; consumes only the evaluator's outputs.
@@ -1287,16 +1656,11 @@ ${vinayaSetupSteps(selfHost)}${adopterSetupStep(ciSetup)}      - name: Review ga
       - name: Re-run the required review gate for this branch
         env:
           GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
-          BRANCH: \${{ needs.evaluate.outputs.branch }}
+          PR_NUMBER: \${{ needs.evaluate.outputs.number }}
           HEAD_SHA: \${{ needs.evaluate.outputs.sha }}
         run: |
-          # \`--branch ""\` is NOT a no-op: gh drops the filter and lists runs
-          # across every branch, so the rerun would land on an unrelated PR's
-          # gate. Reachable now that this job runs on a failed evaluation —
-          # \`Resolve PR head\` is the only producer of this output, and its
-          # failure used to be unreachable from here.
-          if [ -z "$BRANCH" ]; then
-            echo "No branch resolved (the evaluate job failed before resolving it) - nothing to re-run."
+          if [ -z "$PR_NUMBER" ]; then
+            echo "No PR number resolved (the evaluate job failed before resolving it) - nothing to re-run."
             exit 0
           fi
           # Same guard, same producer: an empty SHA would make the selection
@@ -1306,43 +1670,28 @@ ${vinayaSetupSteps(selfHost)}${adopterSetupStep(ciSetup)}      - name: Review ga
             echo "No head SHA resolved (the evaluate job failed before resolving it) - nothing to re-run."
             exit 0
           fi
-          # Select by HEAD SHA, never by recency. "Newest completed" looks
-          # right and is not: \`--status completed\` excludes a run that is
-          # currently re-running but INCLUDES cancelled ones, so a verdict
-          # arriving while the current head's run is still in flight can
-          # select a stale cancelled sibling, rerun it, and — because the
-          # review workflow's concurrency group is keyed per pull request —
-          # cancel the live evaluation it was supposed to refresh.
-          #
-          # The run for this head SHA is the only one whose conclusion gates
-          # the merge; runs for earlier commits are scoped to those commits
-          # and never gate the current head. Cancelled runs are excluded for
-          # the same reason, not a mechanical one — a rerun with nothing else
-          # in its group completes normally. A cancellation here means the
-          # \`opened\`+\`labeled\` collapse discarded that run in favour of a
-          # sibling on the same commit, and it is the survivor whose
-          # conclusion the merge box reads.
-          # \`--commit\` filters server-side, deliberately. gh's \`--jq\` is a
-          # single-expression flag of its own, NOT a passthrough to jq, so jq's
-          # variable-binding flag cannot be used with it: pflag swallows that
-          # flag as the expression and gh exits 1 on the stray token — which
-          # under \`bash -e\` kills the step before the empty-RUN_ID no-op can
-          # run, so every verdict reddens and nothing reruns. Filter on the
-          # server and keep the jq expression free of variables.
-          RUN_ID=$(gh run list --repo "\${{ github.repository }}" \\
-            --workflow vinaya-review.yml --branch "$BRANCH" \\
-            --commit "$HEAD_SHA" \\
-            --json databaseId,event,status,conclusion \\
-            --jq '[.[]
-                 | select(.event=="pull_request")
-                 | select(.status=="completed")
-                 | select(.conclusion!="cancelled")]
-               | .[0].databaseId // empty')
+          # pull_request_target runs execute at the DEFAULT branch SHA, so a
+          # run's head_sha cannot identify the PR commit. GitHub's nested
+          # pull_requests snapshot is also not immutable: an old rerun can
+          # expose the PR's current head. The required workflow therefore
+          # records PR number + head SHA in run-name at creation, and this
+          # query matches that immutable display_title exactly.
+          set -o pipefail
+          RUN_TITLE="Vinaya Review Gate PR #$PR_NUMBER @ $HEAD_SHA"
+          RUN_ID=$(gh api --paginate \\
+            "repos/\${{ github.repository }}/actions/workflows/vinaya-review.yml/runs?event=pull_request_target&per_page=100" \\
+            | jq -sr --arg title "$RUN_TITLE" '
+                [.[].workflow_runs[]
+                 | select(.display_title == $title)
+                 | select(.event == "pull_request_target")
+                 | select(.status == "completed")
+                 | select(.conclusion != "cancelled")
+                 | .id][0] // empty')
           if [ -z "$RUN_ID" ]; then
-            echo "No completed, non-cancelled pull_request run of vinaya-review.yml for $HEAD_SHA - nothing to re-run."
+            echo "No completed, non-cancelled pull_request_target run of vinaya-review.yml for PR #$PR_NUMBER at $HEAD_SHA - nothing to re-run."
             exit 0
           fi
-          echo "Re-running vinaya-review.yml run $RUN_ID for $HEAD_SHA"
+          echo "Re-running vinaya-review.yml run $RUN_ID for PR #$PR_NUMBER at $HEAD_SHA"
           # Two verdict comments landing together run two retriggers in
           # parallel (this workflow has no concurrency group, deliberately —
           # a queued retrigger is a delayed one). Both can select the same
@@ -1536,6 +1885,14 @@ function starterDocOwners() {
 #   This file absent, OR no glob matches any changed code file → silent no-op.
 #   The gate has no opinion until you teach it one.
 #
+# \`vinaya doctor\` (never \`vinaya check\`) separately reports — it does not
+# fail the check — any binding whose code glob matches zero tracked files
+# anywhere in the repo, or whose in-repo pointer doesn't exist on disk. This
+# catches what the dormancy rule above structurally cannot: a glob matching
+# nothing trivially satisfies "no changed file matched" on every diff,
+# forever, so a binding naming deleted or renamed code reads as healthy
+# indefinitely unless something walks the whole repo, not just one diff.
+#
 # ── No-doc allow-list ───────────────────────────────────────────────────────
 # Surfaces that legitimately need no bound doc are listed below. Format:
 #   # no-doc: <glob> — <reason>
@@ -1575,6 +1932,13 @@ var BRANCH_PROTECTION_NOTE = `Recommended (run yourself — vinaya never applies
     -F required_status_checks.strict=true \\
     -F 'required_status_checks.contexts[]=vinaya-checks' \\
     -F enforce_admins=true -F restrictions=`;
+var CODEOWNERS_NOTE = `Recommended: require review on vinaya's own workflow files.
+
+  echo '/.github/workflows/** @your-github-login' >> .github/CODEOWNERS
+
+Then add this flag to the branch-protection command above:
+
+  -F required_pull_request_reviews.require_code_owner_reviews=true`;
 function buildInitOps(ctx) {
   const ops = [];
   const hookMode = 493;
@@ -1587,13 +1951,13 @@ function buildInitOps(ctx) {
   ops.push({
     kind: "create-file",
     path: REVIEW_WORKFLOW_PATH,
-    content: reviewWorkflow(ctx.selfHost, ctx.ciSetup),
+    content: reviewWorkflow(ctx.selfHost),
     group: "CI workflows"
   });
   ops.push({
     kind: "create-file",
     path: REVIEW_VERDICT_WORKFLOW_PATH,
-    content: reviewVerdictWorkflow(ctx.selfHost, ctx.ciSetup),
+    content: reviewVerdictWorkflow(ctx.selfHost),
     group: "CI workflows"
   });
   ops.push({
@@ -1602,6 +1966,12 @@ function buildInitOps(ctx) {
     content: archivistWorkflow(ctx.selfHost),
     group: "CI workflows"
   });
+  ops.push({
+    kind: "create-file",
+    path: BODY_CHECKS_WORKFLOW_PATH,
+    content: bodyChecksWorkflow(ctx.selfHost),
+    group: "CI workflows"
+  });
   ops.push({
     kind: "managed-block",
     path: `${ctx.hookDir}/pre-commit`,
@@ -1652,6 +2022,7 @@ function buildInitOps(ctx) {
   });
   ops.push(...labelOps());
   ops.push({ kind: "print", message: BRANCH_PROTECTION_NOTE, group: "Branch protection (printed, never applied)" });
+  ops.push({ kind: "print", message: CODEOWNERS_NOTE, group: "Branch protection (printed, never applied)" });
   return ops;
 }
 function buildInitProductOps(name) {
@@ -1668,11 +2039,12 @@ function buildInitProductOps(name) {
 }
 
 // src/lib/ops.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
+import { execFileSync as execFileSync3 } from "node:child_process";
 import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname3, isAbsolute, join as join4, resolve, sep } from "node:path";
 
 // src/lib/config.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname as dirname2, join as join3 } from "node:path";
@@ -1800,7 +2172,9 @@ var VinayaConfigSchema = z.object({
   briefSchema: BriefSchemaSchema.optional(),
   managed: ManagedManifestSchema.optional(),
   principals: z.array(z.string()).min(1).optional(),
-  ci: z.object({ setup: z.string().min(1) }).optional()
+  releaseActor: z.string().min(1).optional(),
+  ci: z.object({ setup: z.string().min(1) }).optional(),
+  blastRadius: z.object({ extraDomains: z.array(z.string()).optional() }).optional()
 });
 var GLOBAL_VINAYA_HOME = join3(homedir(), ".vinaya");
 var GLOBAL_CONFIG_PATH = join3(GLOBAL_VINAYA_HOME, "config.json");
@@ -1833,6 +2207,9 @@ function globalChecksIgnoredWarning(path) {
 function globalPrincipalsIgnoredWarning(path) {
   return `${path}: "principals" in the global config is ignored — principals may only be declared from a repo-local vinaya.config.json.`;
 }
+function globalReleaseActorIgnoredWarning(path) {
+  return `${path}: "releaseActor" in the global config is ignored — releaseActor may only be declared from a repo-local vinaya.config.json.`;
+}
 function stripGlobalOnlyKeys(config, path) {
   if (path !== GLOBAL_CONFIG_PATH)
     return config;
@@ -1845,8 +2222,81 @@ function stripGlobalOnlyKeys(config, path) {
     console.error(`⚠ ${globalPrincipalsIgnoredWarning(path)}`);
     result = { ...result, principals: undefined };
   }
+  if (result.releaseActor) {
+    console.error(`⚠ ${globalReleaseActorIgnoredWarning(path)}`);
+    result = { ...result, releaseActor: undefined };
+  }
   return result;
 }
+function resolvePrincipalAllowlist(config) {
+  return config?.principals ?? PRINCIPAL_ALLOWLIST;
+}
+function trustAnchorRepo() {
+  const wellFormed = (slug) => /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
+  const fromRunner = process.env.GITHUB_REPOSITORY?.trim();
+  if (fromRunner) {
+    const validated = wellFormed(fromRunner);
+    if (validated)
+      return validated;
+  }
+  try {
+    const url = execFileSync2("git", ["remote", "get-url", "origin"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+    const m = url.match(/github\.com[:/]([^/]+)\/(.+?)(?:\.git)?\/?$/);
+    return m?.[1] && m[2] ? wellFormed(`${m[1]}/${m[2]}`) : null;
+  } catch {
+    return null;
+  }
+}
+function ghFetchTrustAnchorConfig() {
+  const repo = trustAnchorRepo();
+  if (!repo)
+    throw new Error("could not resolve repo identity for the trust-anchor read");
+  return execFileSync2("gh", ["api", `repos/${repo}/contents/${LOCAL_CONFIG_FILENAME}`, "--jq", ".content"], {
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+}
+function firstLine(err) {
+  return err?.message?.split(`
+`)[0] ?? "unknown error";
+}
+function isMissingFileError(err) {
+  const stderr = err?.stderr;
+  const haystack = [
+    err?.message ?? "",
+    typeof stderr === "string" ? stderr : stderr?.toString() ?? ""
+  ].join(`
+`);
+  return /\b404\b|not found/i.test(haystack);
+}
+function loadTrustAnchorConfig(fetcher = ghFetchTrustAnchorConfig) {
+  const warn = (why) => process.stdout.write(`⚠ could not read the trust-anchor config (\`principals\`/\`releaseActor\`) from the default branch (${why}) — falling back to vinaya's built-in defaults.
+`);
+  let base64;
+  try {
+    base64 = fetcher().trim();
+  } catch (err) {
+    if (!isMissingFileError(err))
+      warn(firstLine(err));
+    return null;
+  }
+  if (!base64)
+    return null;
+  try {
+    const raw = Buffer.from(base64, "base64").toString("utf-8");
+    const parsed = VinayaConfigSchema.safeParse(JSON.parse(raw));
+    if (parsed.success)
+      return parsed.data;
+    warn("it did not satisfy the config schema");
+    return null;
+  } catch {
+    warn("it was not readable as JSON");
+    return null;
+  }
+}
 function readRepoCiSetup(repoRoot) {
   const p = join3(repoRoot, "vinaya.config.json");
   if (!existsSync2(p))
@@ -1897,7 +2347,7 @@ function resolveManagedBlockPath(repoRoot, opPath) {
   if (!opPath.startsWith(".git/"))
     return join4(repoRoot, opPath);
   try {
-    const commonDir = execFileSync2("git", ["-C", repoRoot, "rev-parse", "--git-common-dir"], {
+    const commonDir = execFileSync3("git", ["-C", repoRoot, "rev-parse", "--git-common-dir"], {
       encoding: "utf8"
     }).trim();
     const gitDir = isAbsolute(commonDir) ? commonDir : join4(repoRoot, commonDir);
@@ -2463,7 +2913,7 @@ function realDeps() {
   return { detectRepo: detectGitRepo };
 }
 function sh(args, input) {
-  return execFileSync3(args[0], args.slice(1), { encoding: "utf8", input }).trim();
+  return execFileSync4(args[0], args.slice(1), { encoding: "utf8", input }).trim();
 }
 function shJson(args) {
   return JSON.parse(sh(args));
@@ -2639,7 +3089,7 @@ async function archiveTrancheCommand(args) {
 }
 
 // src/commands/audit.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
+import { execFileSync as execFileSync5 } from "node:child_process";
 
 // src/lib/envelope.ts
 var ENVELOPE_SCHEMA_VERSION = 1;
@@ -2667,7 +3117,7 @@ var DIRECT_PUSH_MARKER = `<!-- ${DIRECT_PUSH_LABEL} -->`;
 var DIRECT_PUSH_LABEL_DESCRIPTION = "A commit landed on main with no associated merged PR (ring-2 detection)";
 function shSoft(args, input) {
   try {
-    return execFileSync4(args[0], args.slice(1), {
+    return execFileSync5(args[0], args.slice(1), {
       encoding: "utf8",
       input,
       timeout: COMMAND_TIMEOUT_MS
@@ -2691,7 +3141,7 @@ function shSoftJson(args) {
   }
 }
 function sh2(args, input) {
-  return execFileSync4(args[0], args.slice(1), { encoding: "utf8", input }).trim();
+  return execFileSync5(args[0], args.slice(1), { encoding: "utf8", input }).trim();
 }
 function listTaskBranches() {
   const out = shSoft(["git", "ls-remote", "--heads", "origin", "task/*"]);
@@ -2941,7 +3391,7 @@ async function auditCommand(args) {
 }
 
 // src/commands/check.ts
-import { execFileSync as execFileSync5 } from "node:child_process";
+import { execFileSync as execFileSync6 } from "node:child_process";
 
 // src/checks/contract.ts
 var CHECK_SCHEMA_VERSION = 1;
@@ -3051,6 +3501,21 @@ function coreCheckRegistry() {
         BRANCH: { optional: true }
       }
     },
+    {
+      name: "body-bare-digits",
+      run: bin("check-body-bare-digits"),
+      scope: "diff",
+      timeoutMs: 15000,
+      requiresOpenPr: true,
+      ownWorkflow: true,
+      env: {
+        PR_BODY: { optional: true },
+        PR_NUMBER: { optional: true },
+        GITHUB_REPOSITORY: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
     {
       name: "no-disk-state",
       run: bin("check-no-disk-state"),
@@ -3076,7 +3541,6 @@ function coreCheckRegistry() {
       timeoutMs: 30000,
       ownWorkflow: true,
       env: {
-        BRANCH: { optional: true },
         PR_NUMBER: { optional: true },
         GITHUB_REPOSITORY: { optional: true },
         GITHUB_TOKEN: { optional: true },
@@ -3478,7 +3942,7 @@ async function runChecks(specs, opts) {
 // src/commands/check.ts
 function git(args) {
   try {
-    return execFileSync5("git", args, { encoding: "utf8" }).trim();
+    return execFileSync6("git", args, { encoding: "utf8" }).trim();
   } catch {
     return "";
   }
@@ -3611,11 +4075,13 @@ async function checkCommand(args) {
       process.stdout.write(`${renderPlanTable(result)}
 `);
     }
-    process.exit(result.failures.length > 0 ? 1 : 0);
+    process.exitCode = result.failures.length > 0 ? 1 : 0;
+    return;
   }
   if (!allRequested && !requestedName) {
     console.error("Usage: vinaya check <name> | --all | --plan [--json] [--diff-only] [--local] [--parallel[=n]]");
-    process.exit(2);
+    process.exitCode = 2;
+    return;
   }
   if (refusals.length > 0) {
     const outcome = {
@@ -3636,7 +4102,8 @@ async function checkCommand(args) {
         process.stdout.write(`    ${e.severity}: ${e.message}
 `);
     }
-    process.exit(1);
+    process.exitCode = 1;
+    return;
   }
   const allSpecs = result.resolved.map((entry2) => entry2.spec);
   const notices = substitutionNotices(result.resolved);
@@ -3650,7 +4117,8 @@ async function checkCommand(args) {
   const specsToRun = allRequested ? allSpecs.filter(runsUnderAll) : allSpecs.filter((s) => s.name === requestedName);
   if (!allRequested && specsToRun.length === 0) {
     console.error(`Unknown check: ${requestedName}`);
-    process.exit(2);
+    process.exitCode = 2;
+    return;
   }
   const changed = diffOnly ? changedFiles() : null;
   const outcomes = specsToRun.length > 0 ? await runChecks(specsToRun, {
@@ -3677,18 +4145,18 @@ async function checkCommand(args) {
     }
   }
   const failed = outcomes.some((o) => o.status === "fail" || o.status === "error" || o.status === "timeout");
-  process.exit(failed ? 1 : 0);
+  process.exitCode = failed ? 1 : 0;
 }
 
 // src/commands/demo.ts
-import { execFileSync as execFileSync6, spawnSync } from "node:child_process";
+import { execFileSync as execFileSync7, spawnSync } from "node:child_process";
 import { existsSync as existsSync6, readFileSync as readFileSync5, rmSync as rmSync2, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
 import { isAbsolute as isAbsolute2, join as join7 } from "node:path";
 var DEMO_BRANCH_PREFIX = "vinaya/demo-break-";
 var FIXTURE_PATH = ".vinaya-demo-brief.md";
 var STATE_FILENAME = "vinaya-demo-state.json";
 function gitCapture(repoRoot, args) {
-  return execFileSync6("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+  return execFileSync7("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 function currentBranchName(repoRoot) {
   try {
@@ -3699,7 +4167,7 @@ function currentBranchName(repoRoot) {
 }
 function branchExists(repoRoot, name) {
   try {
-    execFileSync6("git", ["rev-parse", "--verify", "--quiet", `refs/heads/${name}`], {
+    execFileSync7("git", ["rev-parse", "--verify", "--quiet", `refs/heads/${name}`], {
       cwd: repoRoot,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -3784,12 +4252,12 @@ Test Plan: unit-tests-only
 ## Stop Conditions
 Autonomy: Do not stop to ask clarifying questions — this is a scripted demo; proceed and clean up automatically.
 
-Illustrative Step 0 (never actually run by this demo):
+Illustrative \`Step 0\` (never actually run by this demo):
 \`\`\`
 git worktree add .worktrees/demo-fixture -b demo/fixture origin/main
 \`\`\`
 
-Closes #0 (fixture value — no real Issue; discarded with the demo branch)
+Closes \`#0\` (fixture value — no real Issue; discarded with the demo branch)
 `;
 }
 function cleanup(repoRoot, originalBranch, demoBranch, statePath) {
@@ -3901,7 +4369,8 @@ async function demoBreakCommand(args) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync8, readFileSync as readFileSync8, statSync as statSync2 } from "node:fs";
+import { execFileSync as execFileSync8 } from "node:child_process";
+import { existsSync as existsSync8, readdirSync as readdirSync3, readFileSync as readFileSync8, statSync as statSync2 } from "node:fs";
 import { join as join9 } from "node:path";
 
 // src/lib/self-host.ts
@@ -4182,6 +4651,90 @@ function diagnoseCustomChecks(repoRoot, config) {
   }
   return findings;
 }
+function listTrackedFiles(repoRoot) {
+  try {
+    return execFileSync8("git", ["ls-files"], { cwd: repoRoot, encoding: "utf-8" }).split(`
+`).map((s) => s.trim()).filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+function diagnoseDocOwnersHealth(repoRoot) {
+  const path = join9(repoRoot, DOC_OWNERS_PATH);
+  const content = existsSync8(path) ? readFileSync8(path, "utf-8") : null;
+  const state = classifyDocOwnersManifest(content);
+  if (state === "absent" || state === "empty")
+    return [];
+  const { bindings } = parseDocOwners(content);
+  if (bindings.length === 0)
+    return [];
+  const codeFiles = listTrackedFiles(repoRoot).filter(isCodeFile);
+  const findings = [];
+  for (const b of bindings) {
+    let flagged = false;
+    const re = globToRegex(b.glob);
+    if (!codeFiles.some((f) => re.test(f))) {
+      flagged = true;
+      findings.push(warn("doc-owners", `${DOC_OWNERS_PATH}:${b.lineNum} binds glob '${b.glob}', which matches none of the ${codeFiles.length} ` + "tracked code file(s) in this repo — the code it names may have been deleted, renamed, or never " + "existed. Repoint the binding to the code's new location, or remove it."));
+    }
+    if (!isUrlPointer(b.pointer)) {
+      const pointerPath = join9(repoRoot, pointerToPath(b.pointer));
+      if (!existsSync8(pointerPath)) {
+        flagged = true;
+        findings.push(warn("doc-owners", `${DOC_OWNERS_PATH}:${b.lineNum} points to ${b.pointer}, which does not exist on disk. Repoint the ` + "binding, or add the missing doc."));
+      }
+    }
+    if (!flagged) {
+      findings.push(ok("doc-owners", `${DOC_OWNERS_PATH}:${b.lineNum} — '${b.glob}' → ${b.pointer} is live.`));
+    }
+  }
+  return findings;
+}
+var LEGACY_AEG_PACKAGES_PATH = ".aeg/packages";
+function readWorkspacesForDoctor(repoRoot) {
+  const fromPackageJson = () => {
+    try {
+      const pkg = JSON.parse(readFileSync8(join9(repoRoot, "package.json"), "utf-8"));
+      return Array.isArray(pkg.workspaces) ? pkg.workspaces.filter((w) => typeof w === "string") : [];
+    } catch {
+      return [];
+    }
+  };
+  const fromPnpmWorkspaceYaml = () => {
+    try {
+      return parsePnpmWorkspaceYaml(readFileSync8(join9(repoRoot, "pnpm-workspace.yaml"), "utf-8"));
+    } catch {
+      return [];
+    }
+  };
+  return [...fromPackageJson(), ...fromPnpmWorkspaceYaml()];
+}
+function listChildDirsForDoctor(dir, repoRoot) {
+  try {
+    return readdirSync3(join9(repoRoot, dir), { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    return [];
+  }
+}
+function diagnoseBlastRadiusDeprecation(repoRoot, config) {
+  const derived = deriveWorkspacePackageDomains(readWorkspacesForDoctor(repoRoot), (dir) => listChildDirsForDoctor(dir, repoRoot));
+  const defaults = deriveBuiltinCrossCuttingDefaults((p) => existsSync8(join9(repoRoot, p)));
+  const covered = new Set([...derived, ...defaults]);
+  const configExtra = new Set(config?.blastRadius?.extraDomains ?? []);
+  const legacyPath = join9(repoRoot, LEGACY_AEG_PACKAGES_PATH);
+  if (!existsSync8(legacyPath)) {
+    return [
+      info("blast-radius", `checkBlastRadiusScope is active via live derivation (${derived.length} packages/* domain(s)) + built-in defaults (${defaults.length} present) — no ${LEGACY_AEG_PACKAGES_PATH}, and the check is not dormant.`)
+    ];
+  }
+  const legacyEntries = readFileSync8(legacyPath, "utf-8").split(`
+`).map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith("#"));
+  const uncovered = legacyEntries.filter((e) => !covered.has(e) && !configExtra.has(e));
+  const migrationNote = uncovered.length === 0 ? "every entry is already covered by live derivation, the built-in defaults, or vinaya.config.json blastRadius.extraDomains — the file can be deleted." : `migrate ${uncovered.length} entr${uncovered.length === 1 ? "y" : "ies"} not yet covered before deleting it: ${uncovered.join(", ")}.`;
+  return [
+    warn("blast-radius", `${LEGACY_AEG_PACKAGES_PATH} is deprecated — checkBlastRadiusScope now derives packages/* domains live and ships built-in cross-cutting defaults. Declare anything beyond those in vinaya.config.json's blastRadius.extraDomains instead. ${migrationNote}`)
+  ];
+}
 function diagnoseEnvDeclarations(repoRoot, config) {
   const resolved = resolveChecks(coreCheckRegistry(), config?.checks).resolved;
   const specs = resolved.map((entry2) => entry2.source === "config" ? { ...entry2.spec, run: join9(repoRoot, entry2.spec.run) } : entry2.spec);
@@ -4242,6 +4795,48 @@ async function diagnoseBranchProtection(deps, owner, repo) {
   }
   return info("branch-protection", "main branch protection could not be determined (no gh auth, no remote, or a permission gap).");
 }
+function coversWorkflowsDir(pattern) {
+  const bare = pattern.replace(/\*+$/, "").replace(/\/+$/, "");
+  return bare === ".github/workflows" || bare === "/.github/workflows";
+}
+function diagnoseCodeowners(repoRoot) {
+  const path = join9(repoRoot, ".github", "CODEOWNERS");
+  if (!existsSync8(path)) {
+    return info("codeowners", "no .github/CODEOWNERS — vinaya's workflow files have no required-review protection; see `vinaya init`'s printed recommendation.");
+  }
+  let body;
+  try {
+    body = readFileSync8(path, "utf-8");
+  } catch (err) {
+    return warn("codeowners", `.github/CODEOWNERS exists but could not be read: ${err.message}`);
+  }
+  const covered = body.split(`
+`).map((line) => line.trim()).filter((line) => line && !line.startsWith("#")).some((line) => coversWorkflowsDir(line.split(/\s+/)[0] ?? ""));
+  return covered ? info("codeowners", ".github/CODEOWNERS covers .github/workflows/**.") : warn("codeowners", ".github/CODEOWNERS exists but has no entry covering .github/workflows/** — workflow file edits can merge unreviewed.");
+}
+var TEST_INVOCATION_SUBSTRINGS = ["npm test", "npm run test", "bun test", "bunx turbo test"];
+function diagnoseTestCi(repoRoot) {
+  let pkg;
+  try {
+    pkg = JSON.parse(readFileSync8(join9(repoRoot, "package.json"), "utf-8"));
+  } catch {
+    return [];
+  }
+  const testScript = pkg?.scripts?.test;
+  if (typeof testScript !== "string" || testScript.trim() === "")
+    return [];
+  const workflowsDir = join9(repoRoot, ".github/workflows");
+  const files = existsSync8(workflowsDir) ? readdirSync3(workflowsDir).filter((name) => statSync2(join9(workflowsDir, name)).isFile()) : [];
+  const invoked = files.some((name) => {
+    const content = readFileSync8(join9(workflowsDir, name), "utf-8");
+    return TEST_INVOCATION_SUBSTRINGS.some((s) => content.includes(s));
+  });
+  if (invoked)
+    return [];
+  return [
+    warn("test-ci", "no workflow under .github/workflows/ appears to invoke this repo's `package.json` test script — " + "vinaya requires a Test Plan on every PR and enforces it as a blocking gate, but nothing here verifies that tests actually run.")
+  ];
+}
 function symbolFor(severity) {
   switch (severity) {
     case "ok":
@@ -4295,12 +4890,16 @@ async function runDoctor(args, deps) {
     hasDrift = install.hasDrift;
     findings.push(...await diagnoseHookRouting(repo.repoRoot, hookDir, deps.readHooksPath));
     findings.push(...diagnoseCustomChecks(repo.repoRoot, configRead.config));
+    findings.push(...diagnoseDocOwnersHealth(repo.repoRoot));
   }
+  findings.push(...diagnoseBlastRadiusDeprecation(repo.repoRoot, configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseEnvDeclarations(repo.repoRoot, configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseCheckClassification(configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseGlobalConfigChecks());
   findings.push(...await diagnoseEnvironment(deps, hasDrift));
   findings.push(await diagnoseBranchProtection(deps, repo.owner, repo.repo));
+  findings.push(diagnoseCodeowners(repo.repoRoot));
+  findings.push(...diagnoseTestCi(repo.repoRoot));
   const healthy = findings.every((f) => f.severity === "ok" || f.severity === "info");
   if (jsonOutput) {
     printJson({ healthy, findings });
@@ -4314,8 +4913,9 @@ async function doctorCommand(args) {
 }
 
 // src/commands/doctrine.ts
-import { existsSync as existsSync9 } from "node:fs";
+import { existsSync as existsSync9, readdirSync as readdirSync4, readFileSync as readFileSync9 } from "node:fs";
 import { dirname as dirname4, join as join10, sep as sep3 } from "node:path";
+import matter2 from "gray-matter";
 var ENTRY_SEGMENTS = ["skills", "aeg", "SKILL.md"];
 function resolveDoctrineRoot(pkg = packageRoot(import.meta.url)) {
   const candidates = [join10(pkg, "aeg-root")];
@@ -4327,6 +4927,15 @@ function resolveDoctrineRoot(pkg = packageRoot(import.meta.url)) {
   }
   return null;
 }
+function listRoleNames(root) {
+  const rolesDir = join10(root, "roles");
+  if (!existsSync9(rolesDir))
+    return [];
+  return readdirSync4(rolesDir).filter((name) => name.endsWith(".md")).map((name) => name.slice(0, -".md".length)).filter((roleName) => {
+    const { data } = matter2(readFileSync9(join10(rolesDir, `${roleName}.md`), "utf8"));
+    return data.actor !== "human";
+  }).sort();
+}
 function doctrineCommand(args) {
   const root = resolveDoctrineRoot();
   if (root === null) {
@@ -4334,6 +4943,24 @@ function doctrineCommand(args) {
 `);
     process.exit(1);
   }
+  const roleFlagIndex = args.indexOf("--role");
+  if (roleFlagIndex !== -1) {
+    const roleName = args[roleFlagIndex + 1];
+    const validRoleNames = listRoleNames(root);
+    if (roleName === undefined || roleName.startsWith("--") || !validRoleNames.includes(roleName)) {
+      process.stderr.write(`vinaya doctrine --role: '${roleName ?? ""}' is not a known role. ` + `Valid role names: ${validRoleNames.join(", ")}
+`);
+      process.exit(1);
+    }
+    const entry3 = join10(root, "roles", `${roleName}.md`);
+    if (args.includes("--json")) {
+      printJson({ root, entry: entry3 });
+      return;
+    }
+    process.stdout.write(`${entry3}
+`);
+    return;
+  }
   const entry2 = join10(root, ...ENTRY_SEGMENTS);
   if (args.includes("--json")) {
     printJson({ root, entry: entry2 });
@@ -4344,7 +4971,7 @@ function doctrineCommand(args) {
 }
 
 // src/commands/eject.ts
-import { existsSync as existsSync10, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync10 } from "node:fs";
 import { join as join11 } from "node:path";
 function realDeps4() {
   return {
@@ -4367,7 +4994,7 @@ function readManifest(repoRoot) {
     return { kind: "none" };
   let raw;
   try {
-    raw = JSON.parse(readFileSync9(p, "utf-8"));
+    raw = JSON.parse(readFileSync10(p, "utf-8"));
   } catch (err) {
     return { kind: "orphan", reason: `vinaya.config.json is not valid JSON: ${err.message}` };
   }
@@ -4457,11 +5084,11 @@ async function ejectCommand(args) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync12, readFileSync as readFileSync11, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync12, writeFileSync as writeFileSync5 } from "node:fs";
 import { join as join13 } from "node:path";
 
 // src/lib/registry-write.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname5, join as join12 } from "node:path";
 var PROJECTS_REGISTRY_PATH = ".vinaya/projects.md";
 function rowLine(name, path, specsPath) {
@@ -4532,7 +5159,7 @@ function planRegistryRow(repoRoot, name, path, specsPath) {
   if (!existsSync11(abs2)) {
     return { action: "create-host", rowLine: line, path: PROJECTS_REGISTRY_PATH };
   }
-  const existing = readFileSync10(abs2, "utf-8");
+  const existing = readFileSync11(abs2, "utf-8");
   const already = parseRegistry(existing).some((p) => p.name === name);
   return { action: already ? "skip-present" : "append-row", rowLine: line, path: PROJECTS_REGISTRY_PATH };
 }
@@ -4542,7 +5169,7 @@ function applyRegistryRow(repoRoot, plan, name, path, specsPath) {
     mkdirSync3(dirname5(abs2), { recursive: true });
     writeFileSync4(abs2, freshProjectsRegistry(name, path, specsPath), "utf-8");
   } else if (plan.action === "append-row") {
-    const existing = readFileSync10(abs2, "utf-8");
+    const existing = readFileSync11(abs2, "utf-8");
     writeFileSync4(abs2, appendRegistryRow(existing, name, path, specsPath), "utf-8");
   }
 }
@@ -4581,14 +5208,14 @@ function readManifest2(repoRoot) {
   if (!existsSync12(p))
     return null;
   try {
-    return VinayaConfigSchema.parse(JSON.parse(readFileSync11(p, "utf-8"))).managed ?? null;
+    return VinayaConfigSchema.parse(JSON.parse(readFileSync12(p, "utf-8"))).managed ?? null;
   } catch {
     return null;
   }
 }
 function writeManifest(repoRoot, manifest) {
   const configAbs = join13(repoRoot, CONFIG_PATH);
-  const seed = JSON.parse(readFileSync11(configAbs, "utf-8"));
+  const seed = JSON.parse(readFileSync12(configAbs, "utf-8"));
   writeFileSync5(configAbs, `${JSON.stringify({ ...seed, managed: manifest }, null, 2)}
 `, "utf-8");
 }
@@ -4750,11 +5377,12 @@ async function initProductCommand(args) {
 }
 
 // src/commands/issue.ts
-import { execFileSync as execFileSync7 } from "node:child_process";
+import { execFileSync as execFileSync10 } from "node:child_process";
 
 // src/lib/forge-write.ts
-import { mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "node:fs";
-import { readFileSync as readFileSync12 } from "node:fs";
+import { execFileSync as execFileSync9 } from "node:child_process";
+import { existsSync as existsSync13, mkdtempSync, readdirSync as readdirSync5, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { readFileSync as readFileSync13 } from "node:fs";
 import { tmpdir } from "node:os";
 import { join as join14 } from "node:path";
 class ForgeArgError extends Error {
@@ -4766,13 +5394,13 @@ function locateBody(args) {
       const p = args[i + 1];
       if (!p)
         throw new ForgeArgError("`--body-file` was given with no path.");
-      return { body: readFileSync12(p, "utf8"), source: { kind: "file", argIndex: i + 1, inlineForm: false } };
+      return { body: readFileSync13(p, "utf8"), source: { kind: "file", argIndex: i + 1, inlineForm: false } };
     }
     if (a.startsWith("--body-file=")) {
       const p = a.slice("--body-file=".length);
       if (!p)
         throw new ForgeArgError("`--body-file=` was given with no path.");
-      return { body: readFileSync12(p, "utf8"), source: { kind: "file", argIndex: i, inlineForm: true } };
+      return { body: readFileSync13(p, "utf8"), source: { kind: "file", argIndex: i, inlineForm: true } };
     }
     if (a === "--body" || a === "-b") {
       const v = args[i + 1];
@@ -4956,6 +5584,86 @@ function validateForgeWrite(input) {
   }
   return errors;
 }
+function git2(args) {
+  try {
+    return execFileSync9("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+  } catch {
+    return "";
+  }
+}
+function repoRoot() {
+  return git2(["rev-parse", "--show-toplevel"]);
+}
+function readWorkspaceGlobs(root) {
+  const fromPackageJson = () => {
+    try {
+      const pkg = JSON.parse(readFileSync13(join14(root, "package.json"), "utf8"));
+      return Array.isArray(pkg.workspaces) ? pkg.workspaces.filter((w) => typeof w === "string") : [];
+    } catch {
+      return [];
+    }
+  };
+  const fromPnpmWorkspaceYaml = () => {
+    try {
+      return parsePnpmWorkspaceYaml(readFileSync13(join14(root, "pnpm-workspace.yaml"), "utf8"));
+    } catch {
+      return [];
+    }
+  };
+  return [...fromPackageJson(), ...fromPnpmWorkspaceYaml()];
+}
+function listWorkspaceChildDirs(dir, root) {
+  try {
+    return readdirSync5(join14(root, dir), { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    return [];
+  }
+}
+function readConfigExtraDomains(root) {
+  try {
+    const parsed = VinayaConfigSchema.safeParse(JSON.parse(readFileSync13(join14(root, "vinaya.config.json"), "utf8")));
+    return parsed.success ? parsed.data.blastRadius?.extraDomains ?? [] : [];
+  } catch {
+    return [];
+  }
+}
+function readSharedPackages(root = repoRoot()) {
+  if (!root)
+    return [];
+  const derived = deriveWorkspacePackageDomains(readWorkspaceGlobs(root), (dir) => listWorkspaceChildDirs(dir, root));
+  const defaults = deriveBuiltinCrossCuttingDefaults((p) => existsSync13(join14(root, p)));
+  const configExtra = readConfigExtraDomains(root);
+  return [...new Set([...derived, ...defaults, ...configExtra])];
+}
+function readProjectPaths(root = repoRoot()) {
+  if (!root)
+    return [];
+  try {
+    return parseRegistry(readFileSync13(join14(root, ".vinaya/projects.md"), "utf8"));
+  } catch {
+    return [];
+  }
+}
+var CHECK_ISSUE_CONTENT = "issue-content";
+var ISSUE_CONTENT_RECOVERY = {
+  blastRadius: "Add a second registered `Project(s)` this task also touches, or a `blast-radius-ack: <why one lens is enough>` line, then re-run `{cmd}`.",
+  noBriefContent: "Move the brief-shaped section named above out of the Issue body and into the brief — the Issue carries the Planner's durable rationale, not the brief's just-in-time surface — then re-run `{cmd}`.",
+  rationaleNamesDocs: 'Name a concrete doc/skill path (e.g. `aeg-root/…`, `.claude/skills/…/SKILL.md`) in "Docs to keep coherent" or "Traps", or write the `no-doc-surface` sentinel if the surface genuinely has none, then re-run `{cmd}`.'
+};
+function validateIssueContent(input) {
+  const findings = [
+    [checkBlastRadiusScope(input.body, input.labels, input.sharedPackages, input.projectPaths).errors, "blastRadius"],
+    [checkNoBriefContent(input.body).errors, "noBriefContent"],
+    [checkRationaleNamesDocs(input.body).errors, "rationaleNamesDocs"]
+  ];
+  const errors = [];
+  for (const [messages, kind] of findings) {
+    const recovery = ISSUE_CONTENT_RECOVERY[kind].replace("{cmd}", input.retryCommand);
+    for (const message of messages)
+      errors.push(makeCheckError(CHECK_ISSUE_CONTENT, message, recovery));
+  }
+  return errors;
+}
 
 // src/commands/issue.ts
 var RETRY_CREATE = "vinaya issue create --validate-only …";
@@ -4973,7 +5681,7 @@ function locateBodyOrRefuse(ghArgs, retryCommand) {
 function fetchForgeLabels(issueRef) {
   let out;
   try {
-    out = execFileSync7("gh", ["issue", "view", issueRef, "--json", "labels"], {
+    out = execFileSync10("gh", ["issue", "view", issueRef, "--json", "labels"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -5001,7 +5709,7 @@ function reportPass(json, command) {
 function runGhWrite(ghCmd, ghArgs, bodyResult, json) {
   const { finalArgs, cleanup: cleanup2 } = resolveShippableArgs(ghArgs, bodyResult);
   try {
-    const out = execFileSync7("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
+    const out = execFileSync10("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
     const url = out.trim();
     if (json)
       printJson({ validated: true, written: true, url });
@@ -5012,22 +5720,31 @@ function runGhWrite(ghCmd, ghArgs, bodyResult, json) {
     cleanup2();
   }
 }
-function validateTaskIssue(body, title, retryCommand) {
+function validateTaskIssue(body, title, labels, retryCommand) {
   if (body === null) {
     refuse([
       makeCheckError("forge-args", "A task Issue (a `vinaya/tranche:*` label) requires a `--body-file <path>` so the rationale gate can validate it.", `Add \`--body-file <path>\`, then re-run \`${retryCommand}\`.`)
     ]);
   }
   const sections = resolveSections("issue", retryCommand);
-  const errors = validateForgeWrite({
+  const schemaErrors = validateForgeWrite({
     body,
     title,
     sections,
     changedFiles: [],
     retryCommand
   });
-  if (errors.length > 0)
-    refuse(errors);
+  if (schemaErrors.length > 0)
+    refuse(schemaErrors);
+  const contentErrors = validateIssueContent({
+    body,
+    labels,
+    sharedPackages: readSharedPackages(),
+    projectPaths: readProjectPaths(),
+    retryCommand
+  });
+  if (contentErrors.length > 0)
+    refuse(contentErrors);
 }
 function issueCreateCommand(args) {
   const json = args.includes("--json");
@@ -5038,7 +5755,7 @@ function issueCreateCommand(args) {
   const title = extractTitle(ghArgs);
   const labels = extractLabels(ghArgs);
   if (isTaskIssueLabelSet(labels)) {
-    validateTaskIssue(body, title, RETRY_CREATE);
+    validateTaskIssue(body, title, labels, RETRY_CREATE);
   }
   if (validateOnly) {
     reportPass(json, "issue create");
@@ -5062,7 +5779,7 @@ function issueEditCommand(args) {
   const title = extractTitle(ghArgs);
   const labels = [...new Set([...fetchForgeLabels(issueRef), ...extractLabels(ghArgs)])];
   if (isTaskIssueLabelSet(labels)) {
-    validateTaskIssue(body, title, RETRY_EDIT);
+    validateTaskIssue(body, title, labels, RETRY_EDIT);
   }
   if (validateOnly) {
     reportPass(json, "issue edit");
@@ -5072,7 +5789,7 @@ function issueEditCommand(args) {
 }
 
 // src/commands/new-check.ts
-import { chmodSync as chmodSync2, existsSync as existsSync13, mkdirSync as mkdirSync4, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "node:fs";
+import { chmodSync as chmodSync2, existsSync as existsSync14, mkdirSync as mkdirSync4, readFileSync as readFileSync14, writeFileSync as writeFileSync7 } from "node:fs";
 import { join as join15 } from "node:path";
 var TEMPLATE_PATH = join15(packageRoot(import.meta.url), "templates", "custom-check.template.ts");
 var CHECKS_DIR = join15("scripts", "vinaya-checks");
@@ -5093,15 +5810,15 @@ function newCheckCommand(args) {
     process.exit(2);
   }
   const scriptsDir = join15(process.cwd(), CHECKS_DIR);
-  if (!existsSync13(scriptsDir))
+  if (!existsSync14(scriptsDir))
     mkdirSync4(scriptsDir, { recursive: true });
   const fileStem = name.slice(name.indexOf("/") + 1);
   const targetPath = join15(scriptsDir, `${fileStem}.ts`);
-  if (existsSync13(targetPath)) {
+  if (existsSync14(targetPath)) {
     console.error(`Error: ${targetPath} already exists.`);
     process.exit(1);
   }
-  const template = readFileSync13(TEMPLATE_PATH, "utf-8");
+  const template = readFileSync14(TEMPLATE_PATH, "utf-8");
   const contents = template.split("{{CHECK_NAME}}").join(name);
   writeFileSync7(targetPath, contents, "utf-8");
   chmodSync2(targetPath, 493);
@@ -5115,21 +5832,21 @@ ${registration}
 }
 
 // src/commands/pr.ts
-import { execFileSync as execFileSync8 } from "node:child_process";
+import { execFileSync as execFileSync11 } from "node:child_process";
 var RETRY_CREATE2 = "vinaya pr create --validate-only …";
 var RETRY_EDIT2 = "vinaya pr edit <n> --validate-only …";
-function git2(args) {
+function git3(args) {
   try {
-    return execFileSync8("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync11("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return "";
   }
 }
 function localChangedFiles() {
   const base = process.env.BASE_SHA || "origin/main";
-  let out = git2(["diff", "--name-only", `${base}...HEAD`]);
+  let out = git3(["diff", "--name-only", `${base}...HEAD`]);
   if (!out)
-    out = git2(["diff", "--name-only", "main...HEAD"]);
+    out = git3(["diff", "--name-only", "main...HEAD"]);
   return out.split(`
 `).map((s) => s.trim()).filter(Boolean);
 }
@@ -5154,7 +5871,7 @@ function reportPass2(json, command) {
 function runGhWrite2(ghCmd, ghArgs, bodyResult, json) {
   const { finalArgs, cleanup: cleanup2 } = resolveShippableArgs(ghArgs, bodyResult);
   try {
-    const out = execFileSync8("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
+    const out = execFileSync11("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
     const url = out.trim();
     if (json)
       printJson({ validated: true, written: true, url });
@@ -5168,7 +5885,7 @@ function runGhWrite2(ghCmd, ghArgs, bodyResult, json) {
 function fetchPrForgeContext(prRef) {
   let viewOut;
   try {
-    viewOut = execFileSync8("gh", ["pr", "view", prRef, "--json", "headRefName,files"], {
+    viewOut = execFileSync11("gh", ["pr", "view", prRef, "--json", "headRefName,files"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -5207,8 +5924,8 @@ function prCreateCommand(args) {
   }
   const sections = resolveSections("pr", RETRY_CREATE2);
   const changedFiles2 = localChangedFiles();
-  const headCommit = git2(["rev-parse", "--verify", "--quiet", "HEAD"]);
-  const branch = headCommit === "" ? "" : git2(["symbolic-ref", "--quiet", "--short", "HEAD"]);
+  const headCommit = git3(["rev-parse", "--verify", "--quiet", "HEAD"]);
+  const branch = headCommit === "" ? "" : git3(["symbolic-ref", "--quiet", "--short", "HEAD"]);
   const errors = validateForgeWrite({
     body,
     title,
@@ -5270,14 +5987,14 @@ function prEditCommand(args) {
 }
 
 // src/commands/pr-report.ts
-import { execFileSync as execFileSync9, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync14, readFileSync as readFileSync14, writeFileSync as writeFileSync8 } from "node:fs";
+import { execFileSync as execFileSync12, spawnSync as spawnSync2 } from "node:child_process";
+import { existsSync as existsSync15, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "node:fs";
 import { join as join16 } from "node:path";
 var EVIDENCE_START = "<!-- AEG:EVIDENCE:START -->";
 var EVIDENCE_END = "<!-- AEG:EVIDENCE:END -->";
-function git3(args) {
+function git4(args) {
   try {
-    return execFileSync9("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync12("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return "";
   }
@@ -5295,7 +6012,7 @@ class GitCommandError extends Error {
 }
 function gitStrict(args) {
   try {
-    return execFileSync9("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync12("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (err) {
     const stderr = err.stderr;
     throw new GitCommandError(args, String(stderr ?? err.message).trim() || "non-zero exit");
@@ -5316,7 +6033,7 @@ function resolveMergeBase(head) {
   const primary = process.env.BASE_SHA || "origin/main";
   const tried = primary === "main" ? [primary] : [primary, "main"];
   for (const ref of tried) {
-    const base = git3(["merge-base", ref, head]);
+    const base = git4(["merge-base", ref, head]);
     if (base)
       return base;
   }
@@ -5331,7 +6048,7 @@ function computeGroupA() {
 function resolveSelfEntry() {
   const root = packageRoot(import.meta.url);
   const dist = join16(root, "dist", "index.js");
-  return existsSync14(dist) ? dist : join16(root, "src", "index.ts");
+  return existsSync15(dist) ? dist : join16(root, "src", "index.ts");
 }
 var FAILING_STATUSES = new Set(["fail", "error", "timeout"]);
 function anyGateFailed(outcomes) {
@@ -5436,7 +6153,7 @@ async function prReportCommand(args) {
     throw err;
   }
   if (writePath) {
-    const existing = existsSync14(writePath) ? readFileSync14(writePath, "utf8") : "";
+    const existing = existsSync15(writePath) ? readFileSync15(writePath, "utf8") : "";
     const updated = replaceEvidenceBlock(existing, result.blockInner);
     writeFileSync8(writePath, updated);
     process.stdout.write(`Wrote AEG:EVIDENCE block to ${writePath}
@@ -5449,12 +6166,12 @@ async function prReportCommand(args) {
 }
 
 // src/commands/quickstart.ts
-import { execFileSync as execFileSync10 } from "node:child_process";
-import { existsSync as existsSync16, readFileSync as readFileSync16 } from "node:fs";
+import { execFileSync as execFileSync13 } from "node:child_process";
+import { existsSync as existsSync17, readFileSync as readFileSync17 } from "node:fs";
 import { join as join18 } from "node:path";
 
 // src/lib/doc-owners-write.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync5, readFileSync as readFileSync15, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync5, readFileSync as readFileSync16, writeFileSync as writeFileSync9 } from "node:fs";
 import { dirname as dirname6, join as join17 } from "node:path";
 function bindingLine(glob, pointer) {
   return `${glob}  ${pointer}`;
@@ -5470,23 +6187,23 @@ function appendDocOwnersBinding(content, glob, pointer) {
   return `${content}${sep4}${bindingLine(glob, pointer)}
 `;
 }
-function planDocOwnersBinding(repoRoot, glob, pointer) {
-  const abs2 = join17(repoRoot, DOC_OWNERS_PATH);
+function planDocOwnersBinding(repoRoot2, glob, pointer) {
+  const abs2 = join17(repoRoot2, DOC_OWNERS_PATH);
   const line = bindingLine(glob, pointer);
-  if (!existsSync15(abs2)) {
+  if (!existsSync16(abs2)) {
     return { action: "create-host", line, path: DOC_OWNERS_PATH };
   }
-  const existing = readFileSync15(abs2, "utf-8");
+  const existing = readFileSync16(abs2, "utf-8");
   const already = parseDocOwners(existing).bindings.some((b) => b.glob === glob);
   return { action: already ? "skip-present" : "append-row", line, path: DOC_OWNERS_PATH };
 }
-function applyDocOwnersBinding(repoRoot, plan, glob, pointer) {
-  const abs2 = join17(repoRoot, DOC_OWNERS_PATH);
+function applyDocOwnersBinding(repoRoot2, plan, glob, pointer) {
+  const abs2 = join17(repoRoot2, DOC_OWNERS_PATH);
   if (plan.action === "create-host") {
     mkdirSync5(dirname6(abs2), { recursive: true });
     writeFileSync9(abs2, freshDocOwners(glob, pointer), "utf-8");
   } else if (plan.action === "append-row") {
-    const existing = readFileSync15(abs2, "utf-8");
+    const existing = readFileSync16(abs2, "utf-8");
     writeFileSync9(abs2, appendDocOwnersBinding(existing, glob, pointer), "utf-8");
   }
 }
@@ -5543,13 +6260,13 @@ var GLOB_INJECTION_RE = /[\s\r\n]/;
 var POINTER_INJECTION_RE = /[\r\n]/;
 var NAME_INJECTION_RE = /[\s|\r\n]/;
 var PATH_INJECTION_RE2 = /[|\r\n]/;
-function pointerIsMissingLocalFile(repoRoot, pointer) {
+function pointerIsMissingLocalFile(repoRoot2, pointer) {
   if (/^https?:\/\//i.test(pointer))
     return false;
   const path = pointer.split("#")[0] ?? pointer;
-  return !existsSync16(join18(repoRoot, path));
+  return !existsSync17(join18(repoRoot2, path));
 }
-async function bindDocOwnerLoop(deps, repoRoot) {
+async function bindDocOwnerLoop(deps, repoRoot2) {
   let any = false;
   for (;; ) {
     if (any && !await deps.confirm("Bind another doc→code pair?", false))
@@ -5564,11 +6281,11 @@ async function bindDocOwnerLoop(deps, repoRoot) {
     }
     if (GLOB_INJECTION_RE.test(glob) || POINTER_INJECTION_RE.test(pointer)) {
       console.error(red("Error: glob must not contain whitespace, and the pointer must not contain a newline."));
-    } else if (pointerIsMissingLocalFile(repoRoot, pointer)) {
+    } else if (pointerIsMissingLocalFile(repoRoot2, pointer)) {
       console.error(red(`✗ "${pointer}" does not exist in this repo (and isn't a URL).`));
     } else {
-      const plan = planDocOwnersBinding(repoRoot, glob, pointer);
-      applyDocOwnersBinding(repoRoot, plan, glob, pointer);
+      const plan = planDocOwnersBinding(repoRoot2, glob, pointer);
+      applyDocOwnersBinding(repoRoot2, plan, glob, pointer);
       process.stdout.write(`${green(renderDocOwnersBindingDiffLine(plan))}
 `);
       any = true;
@@ -5614,7 +6331,7 @@ async function registerProjectLoop(deps) {
   }
 }
 function readPackageVersion() {
-  const pkg = JSON.parse(readFileSync16(join18(packageRoot(import.meta.url), "package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync17(join18(packageRoot(import.meta.url), "package.json"), "utf-8"));
   return pkg.version;
 }
 function realDeps6() {
@@ -5644,8 +6361,8 @@ function realDeps6() {
     closeStdin
   };
 }
-function execGit(repoRoot, args) {
-  return execFileSync10("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+function execGit(repoRoot2, args) {
+  return execFileSync13("git", args, { cwd: repoRoot2, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 function errorDetail(err) {
   const stderr = err.stderr;
@@ -5653,31 +6370,31 @@ function errorDetail(err) {
     return stderr.toString().trim();
   return err instanceof Error ? err.message : String(err);
 }
-function gitStatusShort(repoRoot) {
-  return execGit(repoRoot, ["status", "--short"]);
+function gitStatusShort(repoRoot2) {
+  return execGit(repoRoot2, ["status", "--short"]);
 }
-function commitInstall(repoRoot) {
-  execGit(repoRoot, ["add", "-A"]);
-  const staged = execGit(repoRoot, ["diff", "--cached", "--stat"]);
+function commitInstall(repoRoot2) {
+  execGit(repoRoot2, ["add", "-A"]);
+  const staged = execGit(repoRoot2, ["diff", "--cached", "--stat"]);
   if (!staged)
     return { committed: false, message: "Nothing to commit — working tree already clean." };
   try {
-    execGit(repoRoot, ["commit", "-m", "Chore: install Vinaya"]);
+    execGit(repoRoot2, ["commit", "-m", "Chore: install Vinaya"]);
     return { committed: true, message: "✓ Committed `Chore: install Vinaya`." };
   } catch (err) {
     return { committed: false, message: `git commit failed: ${errorDetail(err)}` };
   }
 }
-function pushInstall(repoRoot) {
+function pushInstall(repoRoot2) {
   try {
-    const branch = execGit(repoRoot, ["symbolic-ref", "--short", "HEAD"]);
+    const branch = execGit(repoRoot2, ["symbolic-ref", "--short", "HEAD"]);
     let hasUpstream = true;
     try {
-      execGit(repoRoot, ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"]);
+      execGit(repoRoot2, ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"]);
     } catch {
       hasUpstream = false;
     }
-    execGit(repoRoot, hasUpstream ? ["push"] : ["push", "-u", "origin", branch]);
+    execGit(repoRoot2, hasUpstream ? ["push"] : ["push", "-u", "origin", branch]);
     return { pushed: true, message: "✓ Pushed." };
   } catch (err) {
     return { pushed: false, message: `git push failed: ${errorDetail(err)}` };
@@ -5761,11 +6478,331 @@ async function quickstartCommand(args) {
   process.exit(await runQuickstart(args, realDeps6()));
 }
 
+// src/commands/review-post.ts
+import { execFileSync as execFileSync14 } from "node:child_process";
+import { readFileSync as readFileSync18, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join19 } from "node:path";
+class FindingsParseError extends Error {
+}
+var CODE_REVIEW_SEVERITIES = ["BLOCKER", "MAJOR", "MINOR"];
+var SECURITY_SEVERITIES = ["CRITICAL", "HIGH", "MEDIUM", "LOW"];
+function parseFindingsFile(content, allowedSeverities) {
+  const lines = content.split(`
+`).map((l) => l.trim()).filter((l) => l.length > 0);
+  return lines.map((line, idx) => {
+    const parts = line.split("|");
+    if (parts.length !== 3) {
+      throw new FindingsParseError(`findings file line ${idx + 1}: expected exactly 3 \`|\`-delimited fields (SEVERITY|file:line|description), found ${parts.length}: ${line}`);
+    }
+    const severity = parts[0].trim().toUpperCase();
+    const location = parts[1].trim();
+    const description = parts[2].trim();
+    if (!allowedSeverities.includes(severity)) {
+      throw new FindingsParseError(`findings file line ${idx + 1}: severity "${parts[0]}" is not one of ${allowedSeverities.join("|")}: ${line}`);
+    }
+    if (!location || !description) {
+      throw new FindingsParseError(`findings file line ${idx + 1}: file:line and description must both be non-empty: ${line}`);
+    }
+    return { severity, location, description };
+  });
+}
+function sortBySeverity(findings, order) {
+  return findings.map((f, i) => ({ f, i })).sort((a, b) => order.indexOf(a.f.severity) - order.indexOf(b.f.severity) || a.i - b.i).map(({ f }) => f);
+}
+function renderFindingsSection(findings) {
+  if (findings.length === 0)
+    return "None.";
+  return findings.map((f, i) => `${i + 1}. [${f.severity}] ${f.location} — ${f.description}`).join(`
+`);
+}
+function renderTokensLine(role, roleLabel, input) {
+  return `Tokens: ${input.taskId}: ${role} — ${roleLabel} — ${input.model} — ${input.tokensIn}/${input.tokensOut}/${input.cost}`;
+}
+var CODE_REVIEW_VERDICT_TEXT = {
+  APPROVE: "APPROVE",
+  REQUEST_CHANGES: "REQUEST CHANGES"
+};
+function renderCodeReviewComment(input) {
+  const sorted = sortBySeverity(input.findings, CODE_REVIEW_SEVERITIES);
+  return [
+    `VERDICT: ${CODE_REVIEW_VERDICT_TEXT[input.verdict]}`,
+    "",
+    `Judged head: ${input.headSha}`,
+    "",
+    `BRIEF CONFORMANCE: ${input.briefConformance}`,
+    `SPEC CONFORMANCE: ${input.specConformance}`,
+    "",
+    "FINDINGS (ordered by severity):",
+    renderFindingsSection(sorted),
+    "",
+    `SCOPE: ${input.scope}`,
+    `TESTS: ${input.tests}`,
+    `DOCS: ${input.docs}`,
+    "",
+    renderTokensLine("review", "Reviewer", input)
+  ].join(`
+`);
+}
+function isNoneFoundClaim(value) {
+  return value.trim().toLowerCase().replace(/[-_]+/g, " ").replace(/\s+/g, " ") === "none found";
+}
+function renderSecurityComment(input) {
+  const sorted = sortBySeverity(input.findings, SECURITY_SEVERITIES);
+  const lines = [
+    `VERDICT: ${input.verdict}`,
+    "",
+    `Judged head: ${input.headSha}`,
+    "",
+    "FINDINGS (ordered by severity):",
+    renderFindingsSection(sorted),
+    "",
+    `CONFIG SCAN: ${input.configScan}`,
+    ""
+  ];
+  if (input.secretsEvidence !== null) {
+    lines.push("```", input.secretsEvidence, "```", "");
+  }
+  lines.push(`SECRETS: ${input.secrets}`, "", renderTokensLine("security", "Security", input));
+  return lines.join(`
+`);
+}
+function isBoundToHead(extraction, headSha) {
+  if (!extraction.headSha)
+    return false;
+  return headSha.toLowerCase().startsWith(extraction.headSha.toLowerCase());
+}
+function checkExtraction(extraction, expectedValue, headSha) {
+  if (extraction.danglingNote) {
+    return {
+      ok: false,
+      reason: `no clean VERDICT was found on re-fetch (${extraction.danglingNote}) — the posted comment does not match the gate's line-anchored \`VERDICT:\` pattern.`
+    };
+  }
+  if (extraction.value !== expectedValue) {
+    return {
+      ok: false,
+      reason: `re-extraction found VERDICT "${extraction.value}", expected "${expectedValue}" — the posted comment's VERDICT line does not match what this command rendered.`
+    };
+  }
+  if (!extraction.headSha) {
+    return { ok: false, reason: "the winning VERDICT comment carries no `Judged head:` line on re-fetch." };
+  }
+  if (!isBoundToHead(extraction, headSha)) {
+    return {
+      ok: false,
+      reason: `re-extraction found \`Judged head: ${extraction.headSha}\`, which does not cover the resolved head ${headSha}.`
+    };
+  }
+  return { ok: true, reason: "clean" };
+}
+function principalBodies(comments, principalAllowlist) {
+  return comments.filter((c) => isPrincipal(c.author, principalAllowlist)).map((c) => c.body);
+}
+function verifyPostedCodeReview(comments, verdict, headSha, principalAllowlist) {
+  return checkExtraction(extractCodeReviewVerdict(principalBodies(comments, principalAllowlist)), CODE_REVIEW_VERDICT_TEXT[verdict], headSha);
+}
+function verifyPostedSecurity(comments, verdict, headSha, principalAllowlist) {
+  return checkExtraction(extractSecurityReviewVerdict(principalBodies(comments, principalAllowlist)), verdict, headSha);
+}
+function parseFlags(args) {
+  const map = new Map;
+  for (let i = 0;i < args.length; i++) {
+    const a = args[i];
+    if (a.startsWith("--")) {
+      const value = args[i + 1];
+      if (value === undefined || value.startsWith("--")) {
+        map.set(a, "");
+        continue;
+      }
+      map.set(a, value);
+      i++;
+    }
+  }
+  return map;
+}
+function refuseCmd(message, recovery) {
+  refuse([makeCheckError("review-post", message, recovery)]);
+}
+function requireFlag(flags2, name) {
+  const v = flags2.get(name);
+  if (v === undefined || v === "") {
+    refuseCmd(`Missing required \`${name}\` flag.`, `Pass \`${name} <value>\`, then re-run \`vinaya review post ...\`.`);
+  }
+  return v;
+}
+function requireTokenField(flags2, name) {
+  const v = requireFlag(flags2, name);
+  if (v !== "-" && !/^\d+$/.test(v)) {
+    refuseCmd(`\`${name} ${v}\` is neither a non-negative integer nor \`-\` (unknown).`, `Pass a whole number or \`-\` for ${name}.`);
+  }
+  return v;
+}
+function readFindingsFile(path, allowedSeverities) {
+  if (!path)
+    return [];
+  let content;
+  try {
+    content = readFileSync18(path, "utf8");
+  } catch {
+    refuseCmd(`Could not read findings file at ${path}.`, "Check the path and re-run.");
+  }
+  try {
+    return parseFindingsFile(content, allowedSeverities);
+  } catch (err) {
+    if (err instanceof FindingsParseError) {
+      refuseCmd(err.message, "Fix the malformed line in the findings file, then re-run.");
+    }
+    throw err;
+  }
+}
+function normalizeCodeReviewVerdict(raw) {
+  const v = raw.trim().toUpperCase().replace(/[-\s]+/g, "_");
+  if (v === "APPROVE")
+    return "APPROVE";
+  if (v === "REQUEST_CHANGES")
+    return "REQUEST_CHANGES";
+  refuseCmd(`\`--verdict ${raw}\` is not APPROVE or REQUEST_CHANGES.`, "Pass `--verdict APPROVE` or `--verdict REQUEST_CHANGES`.");
+}
+function normalizeSecurityVerdict(raw) {
+  const v = raw.trim().toUpperCase();
+  if (v === "PASS")
+    return "PASS";
+  if (v === "FAIL")
+    return "FAIL";
+  refuseCmd(`\`--verdict ${raw}\` is not PASS or FAIL.`, "Pass `--verdict PASS` or `--verdict FAIL`.");
+}
+function gh(args) {
+  try {
+    return execFileSync14("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+  } catch (err) {
+    const stderr = err.stderr;
+    throw new Error(String(stderr ?? err.message).trim() || "gh command failed");
+  }
+}
+function resolveHeadSha(pr) {
+  let out;
+  try {
+    out = gh(["pr", "view", pr, "--json", "headRefOid", "-q", ".headRefOid"]);
+  } catch (err) {
+    refuseCmd(`Could not resolve PR ${pr}'s head via \`gh pr view --json headRefOid\`: ${err instanceof Error ? err.message : String(err)}`, "Confirm `gh auth status` passes and the PR number is correct, then re-run.");
+  }
+  if (!out) {
+    refuseCmd(`\`gh pr view ${pr} --json headRefOid\` returned no head sha.`, "Confirm PR exists, then re-run.");
+  }
+  return out;
+}
+function postComment(pr, body) {
+  const tmp = join19(tmpdir2(), `vinaya-review-post-${process.pid}-${Date.now()}.md`);
+  writeFileSync10(tmp, body);
+  try {
+    return gh(["pr", "comment", pr, "--body-file", tmp]).trim();
+  } catch (err) {
+    refuseCmd(`Rendered comment failed to post via \`gh pr comment\`: ${err instanceof Error ? err.message : String(err)}`, "Check `gh auth status`/network, then re-run — nothing was posted.");
+  } finally {
+    rmSync4(tmp, { force: true });
+  }
+}
+function fetchComments(pr) {
+  const out = gh(["pr", "view", pr, "--json", "comments"]);
+  const parsed = JSON.parse(out);
+  return parsed.comments.map((c) => ({ body: c.body, author: c.author?.login ?? null }));
+}
+async function reviewPostCommand(args) {
+  const json = args.includes("--json");
+  const flags2 = parseFlags(args.filter((a) => a !== "--json"));
+  const role = flags2.get("--role");
+  if (role !== "code-reviewer" && role !== "security") {
+    refuseCmd(`\`--role ${role ?? "(missing)"}\` is not \`code-reviewer\` or \`security\`.`, "Pass `--role code-reviewer` or `--role security`.");
+  }
+  const pr = requireFlag(flags2, "--pr");
+  const taskId = requireFlag(flags2, "--task-id");
+  const model = requireFlag(flags2, "--model");
+  const tokensIn = requireTokenField(flags2, "--tokens-in");
+  const tokensOut = requireTokenField(flags2, "--tokens-out");
+  const cost = requireFlag(flags2, "--cost");
+  const tokens = { taskId, model, tokensIn, tokensOut, cost };
+  const headSha = resolveHeadSha(pr);
+  const principalAllowlist = resolvePrincipalAllowlist(loadTrustAnchorConfig());
+  let body;
+  let verify;
+  if (role === "code-reviewer") {
+    const verdict = normalizeCodeReviewVerdict(requireFlag(flags2, "--verdict"));
+    const findings = readFindingsFile(flags2.get("--findings-file"), CODE_REVIEW_SEVERITIES);
+    if (findings.some((f) => f.severity === "BLOCKER") && verdict === "APPROVE") {
+      refuseCmd("Findings include a BLOCKER but `--verdict APPROVE` — reviewer.md requires REQUEST CHANGES whenever any BLOCKER finding exists.", "Pass `--verdict REQUEST_CHANGES`, or fix the finding severity if BLOCKER was a miscategorization.");
+    }
+    const input = {
+      ...tokens,
+      headSha,
+      verdict,
+      briefConformance: requireFlag(flags2, "--brief-conformance"),
+      specConformance: requireFlag(flags2, "--spec-conformance"),
+      findings,
+      scope: requireFlag(flags2, "--scope"),
+      tests: requireFlag(flags2, "--tests"),
+      docs: requireFlag(flags2, "--docs")
+    };
+    body = renderCodeReviewComment(input);
+    verify = (comments2) => verifyPostedCodeReview(comments2, verdict, headSha, principalAllowlist);
+  } else {
+    const verdict = normalizeSecurityVerdict(requireFlag(flags2, "--verdict"));
+    const findings = readFindingsFile(flags2.get("--findings-file"), SECURITY_SEVERITIES);
+    if (findings.some((f) => f.severity === "CRITICAL" || f.severity === "HIGH") && verdict === "PASS") {
+      refuseCmd("Findings include a CRITICAL/HIGH finding but `--verdict PASS` — security.md requires FAIL whenever any CRITICAL or HIGH finding exists.", "Pass `--verdict FAIL`, or fix the finding severity if it was a miscategorization.");
+    }
+    const secrets = requireFlag(flags2, "--secrets");
+    const secretsEvidenceFile = flags2.get("--secrets-evidence-file");
+    if (isNoneFoundClaim(secrets) && !secretsEvidenceFile) {
+      refuseCmd('`--secrets` normalizes to "none found" but no `--secrets-evidence-file` was given — security.md: "SECRETS: none found" with no scan output pasted is an unbacked self-attestation.', "Pass `--secrets-evidence-file <path>` containing the actual scanner output, or change `--secrets` to describe what was found instead.");
+    }
+    let secretsEvidence = null;
+    if (secretsEvidenceFile) {
+      try {
+        secretsEvidence = readFileSync18(secretsEvidenceFile, "utf8");
+      } catch {
+        refuseCmd(`Could not read secrets evidence file at ${secretsEvidenceFile}.`, "Check the path and re-run.");
+      }
+    }
+    const input = {
+      ...tokens,
+      headSha,
+      verdict,
+      findings,
+      configScan: requireFlag(flags2, "--config-scan"),
+      secrets,
+      secretsEvidence
+    };
+    body = renderSecurityComment(input);
+    verify = (comments2) => verifyPostedSecurity(comments2, verdict, headSha, principalAllowlist);
+  }
+  const url = postComment(pr, body);
+  let comments;
+  try {
+    comments = fetchComments(pr);
+  } catch (err) {
+    refuseCmd(`Posted the comment (${url}) but could not re-fetch PR ${pr}'s comments to self-verify: ${err instanceof Error ? err.message : String(err)}`, "Check `gh auth status`/network and manually confirm the posted comment parses cleanly — this command could not verify it.");
+  }
+  const result = verify(comments);
+  if (!result.ok) {
+    refuseCmd(`Posted comment ${url}, but self-verification FAILED on re-parse: ${result.reason}`, "The posted comment does not re-parse clean through the same extractCodeReviewVerdict/extractSecurityReviewVerdict functions the merge gate calls. Do not treat the post as valid — inspect the comment and this command for drift, fix, and re-run.");
+  }
+  if (json) {
+    printJson({ posted: true, url, role, headSha, selfVerified: true });
+  } else {
+    process.stdout.write(`${body}
+
+Posted: ${url}
+Self-verification: clean — re-parsed VERDICT is bound to head ${headSha}.
+`);
+  }
+}
+
 // src/commands/studio.ts
 import { execFile as execFile5, spawn as spawn2 } from "node:child_process";
-import { existsSync as existsSync17, readFileSync as readFileSync17, renameSync } from "node:fs";
+import { existsSync as existsSync18, readFileSync as readFileSync19, renameSync } from "node:fs";
 import net from "node:net";
-import { dirname as dirname7, join as join19 } from "node:path";
+import { dirname as dirname7, join as join20 } from "node:path";
 import { promisify as promisify5 } from "node:util";
 
 // src/lib/studio-bundle.ts
@@ -5781,25 +6818,25 @@ var FALLBACK_PORT = 3108;
 function resolveStudioTarget(cwd, moduleUrl = import.meta.url) {
   let dir = cwd;
   for (;; ) {
-    const webDir = join19(dir, "apps", "vinaya-studio", "web");
-    const pkgPath = join19(webDir, "package.json");
-    if (existsSync17(pkgPath)) {
+    const webDir = join20(dir, "apps", "vinaya-studio", "web");
+    const pkgPath = join20(webDir, "package.json");
+    if (existsSync18(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync17(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync19(pkgPath, "utf-8"));
         if (pkg.name === "@atta/vinaya-studio-web") {
           return { kind: "workspace", webDir };
         }
       } catch {}
     }
-    if (existsSync17(join19(dir, ".git")))
+    if (existsSync18(join20(dir, ".git")))
       break;
     const parent = dirname7(dir);
     if (parent === dir)
       break;
     dir = parent;
   }
-  const standaloneWebDir = join19(packageRoot(moduleUrl), "studio-standalone", "apps", "vinaya-studio", "web");
-  if (existsSync17(join19(standaloneWebDir, "server.js"))) {
+  const standaloneWebDir = join20(packageRoot(moduleUrl), "studio-standalone", "apps", "vinaya-studio", "web");
+  if (existsSync18(join20(standaloneWebDir, "server.js"))) {
     return { kind: "package", packageDir: standaloneWebDir };
   }
   return { kind: "missing" };
@@ -5819,9 +6856,9 @@ function isPortFree(port) {
   });
 }
 function ensureStudioNodeModules(bundleRoot) {
-  const real = join19(bundleRoot, "node_modules");
-  const packed = join19(bundleRoot, STUDIO_NODE_MODULES_PACKED_DIRNAME);
-  if (!existsSync17(real) && existsSync17(packed)) {
+  const real = join20(bundleRoot, "node_modules");
+  const packed = join20(bundleRoot, STUDIO_NODE_MODULES_PACKED_DIRNAME);
+  if (!existsSync18(real) && existsSync18(packed)) {
     renameSync(packed, real);
   }
 }
@@ -5847,8 +6884,8 @@ async function runStudio(cwd, args, moduleUrl = import.meta.url) {
     case "workspace":
       return spawnDev(target.webDir, args);
     case "package": {
-      const bundleRoot = join19(target.packageDir, "..", "..", "..");
-      return spawnStandalone(cwd, join19(target.packageDir, "server.js"), bundleRoot);
+      const bundleRoot = join20(target.packageDir, "..", "..", "..");
+      return spawnStandalone(cwd, join20(target.packageDir, "server.js"), bundleRoot);
     }
     case "missing":
       console.error("Vinaya Studio isn't available in this install — no published @attalabs/vinaya build bundles the Studio app yet. Inside a checkout that contains Studio's source (apps/vinaya-studio/web), `vinaya studio` runs it directly.");
@@ -5857,8 +6894,8 @@ async function runStudio(cwd, args, moduleUrl = import.meta.url) {
 }
 
 // src/commands/upgrade.ts
-import { existsSync as existsSync18, readFileSync as readFileSync18, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join20 } from "node:path";
+import { existsSync as existsSync19, readFileSync as readFileSync20, rmSync as rmSync5, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join21 } from "node:path";
 function realDeps7() {
   return {
     detectRepo: detectGitRepo,
@@ -5875,13 +6912,13 @@ function realDeps7() {
 function flags2(args) {
   return { dryRun: args.includes("--dry-run"), yes: args.includes("--yes") };
 }
-function readManifest3(repoRoot) {
-  const p = join20(repoRoot, CONFIG_PATH);
-  if (!existsSync18(p))
+function readManifest3(repoRoot2) {
+  const p = join21(repoRoot2, CONFIG_PATH);
+  if (!existsSync19(p))
     return { kind: "missing" };
   let raw;
   try {
-    raw = JSON.parse(readFileSync18(p, "utf-8"));
+    raw = JSON.parse(readFileSync20(p, "utf-8"));
   } catch (err) {
     return { kind: "invalid", error: `invalid JSON: ${err.message}` };
   }
@@ -5896,31 +6933,31 @@ function readManifest3(repoRoot) {
     return { kind: "not-initialized" };
   return { kind: "ok", manifest: parsed.data.managed };
 }
-function writeManifestVersion(repoRoot, manifest) {
-  const configAbs = join20(repoRoot, CONFIG_PATH);
-  const seed = JSON.parse(readFileSync18(configAbs, "utf-8"));
+function writeManifestVersion(repoRoot2, manifest) {
+  const configAbs = join21(repoRoot2, CONFIG_PATH);
+  const seed = JSON.parse(readFileSync20(configAbs, "utf-8"));
   const updated = { ...manifest, version: MANAGED_MANIFEST_VERSION };
-  writeFileSync10(configAbs, `${JSON.stringify({ ...seed, managed: updated }, null, 2)}
+  writeFileSync11(configAbs, `${JSON.stringify({ ...seed, managed: updated }, null, 2)}
 `, "utf-8");
 }
-function stripFor(repoRoot, path, marker, comment) {
-  const abs2 = resolveManagedBlockPath(repoRoot, path);
-  if (!existsSync18(abs2))
+function stripFor(repoRoot2, path, marker, comment) {
+  const abs2 = resolveManagedBlockPath(repoRoot2, path);
+  if (!existsSync19(abs2))
     return { path, marker, comment, present: false, removesHost: false };
-  const stripped = stripBlockFromContent(readFileSync18(abs2, "utf-8"), marker, comment);
+  const stripped = stripBlockFromContent(readFileSync20(abs2, "utf-8"), marker, comment);
   if (stripped === null)
     return { path, marker, comment, present: false, removesHost: false };
   return { path, marker, comment, present: true, removesHost: blockStripLeavesEmpty(stripped) };
 }
-function planHookRouting(repoRoot, manifest, recorded, hooksPathValue) {
+function planHookRouting(repoRoot2, manifest, recorded, hooksPathValue) {
   const none = { target: recorded, strips: [], arm: false, migratesManifest: false, blockedReason: null };
   if (recorded === ".husky")
     return none;
   if (recorded === TRACKED_HOOK_DIR) {
-    const strips = manifest.blocks.filter((b) => b.path.startsWith(`${TRACKED_HOOK_DIR}/`)).map((b) => stripFor(repoRoot, `.git/hooks/${b.marker}`, b.marker, b.comment)).filter((s) => s.present);
+    const strips = manifest.blocks.filter((b) => b.path.startsWith(`${TRACKED_HOOK_DIR}/`)).map((b) => stripFor(repoRoot2, `.git/hooks/${b.marker}`, b.marker, b.comment)).filter((s) => s.present);
     if (hooksPathValue === TRACKED_HOOK_DIR)
       return { ...none, strips };
-    const foreign = foreignRawHooks(repoRoot);
+    const foreign = foreignRawHooks(repoRoot2);
     if (foreign.length > 0) {
       return {
         ...none,
@@ -5933,17 +6970,17 @@ function planHookRouting(repoRoot, manifest, recorded, hooksPathValue) {
   const legacy = manifest.blocks.filter((b) => b.path.startsWith(".git/hooks/"));
   const blocked = [];
   for (const b of legacy) {
-    const abs2 = resolveManagedBlockPath(repoRoot, b.path);
-    if (!existsSync18(abs2))
+    const abs2 = resolveManagedBlockPath(repoRoot2, b.path);
+    if (!existsSync19(abs2))
       continue;
-    const stripped = stripBlockFromContent(readFileSync18(abs2, "utf-8"), b.marker, b.comment);
+    const stripped = stripBlockFromContent(readFileSync20(abs2, "utf-8"), b.marker, b.comment);
     if (stripped === null)
       blocked.push(`${b.path} exists without vinaya's managed block`);
     else if (!blockStripLeavesEmpty(stripped))
       blocked.push(`${b.path} carries your own lines alongside the managed block`);
   }
   const legacyNames = new Set(legacy.map((b) => b.path.slice(".git/hooks/".length)));
-  for (const f of activeRawHooks(repoRoot)) {
+  for (const f of activeRawHooks(repoRoot2)) {
     if (!legacyNames.has(f))
       blocked.push(`.git/hooks/${f} is an active raw hook vinaya does not manage`);
   }
@@ -5951,7 +6988,7 @@ function planHookRouting(repoRoot, manifest, recorded, hooksPathValue) {
     return { ...none, blockedReason: blocked.join("; ") };
   return {
     target: TRACKED_HOOK_DIR,
-    strips: legacy.map((b) => stripFor(repoRoot, b.path, b.marker, b.comment)).filter((s) => s.present),
+    strips: legacy.map((b) => stripFor(repoRoot2, b.path, b.marker, b.comment)).filter((s) => s.present),
     arm: hooksPathValue !== TRACKED_HOOK_DIR,
     migratesManifest: true,
     blockedReason: null
@@ -5963,7 +7000,7 @@ function translateHookPaths(manifest) {
     blocks: manifest.blocks.map((b) => b.path.startsWith(".git/hooks/") ? { ...b, path: `${TRACKED_HOOK_DIR}/${b.path.slice(".git/hooks/".length)}` } : b)
   };
 }
-function planUpgrade(ops, repoRoot, manifest, routing) {
+function planUpgrade(ops, repoRoot2, manifest, routing) {
   const entries = [];
   let hasChanges = routing.arm || routing.migratesManifest || routing.strips.some((s) => s.present);
   const ownedFiles = new Set(manifest.files);
@@ -5971,8 +7008,8 @@ function planUpgrade(ops, repoRoot, manifest, routing) {
   const ownedBlocks = new Set(manifest.blocks.map((b) => blockKey(b.path, b.marker)));
   for (const op of ops) {
     if (op.kind === "create-file") {
-      const abs2 = join20(repoRoot, op.path);
-      const exists = existsSync18(abs2);
+      const abs2 = join21(repoRoot2, op.path);
+      const exists = existsSync19(abs2);
       const owned = ownedFiles.has(op.path);
       let action;
       if (op.path === CONFIG_PATH || op.path === DOC_OWNERS_PATH) {
@@ -5982,7 +7019,7 @@ function planUpgrade(ops, repoRoot, manifest, routing) {
       } else if (!exists) {
         action = "recreate";
         hasChanges = true;
-      } else if (readFileSync18(abs2, "utf-8") !== op.content) {
+      } else if (readFileSync20(abs2, "utf-8") !== op.content) {
         action = "regenerate";
         hasChanges = true;
       } else {
@@ -5990,16 +7027,16 @@ function planUpgrade(ops, repoRoot, manifest, routing) {
       }
       entries.push({ kind: "create-file", op, action });
     } else if (op.kind === "managed-block") {
-      const abs2 = resolveManagedBlockPath(repoRoot, op.path);
+      const abs2 = resolveManagedBlockPath(repoRoot2, op.path);
       const owned = ownedBlocks.has(blockKey(op.path, op.marker));
       let action;
       if (!owned) {
         action = "not-installed";
-      } else if (!existsSync18(abs2)) {
+      } else if (!existsSync19(abs2)) {
         action = "recreate-host";
         hasChanges = true;
       } else {
-        const content = readFileSync18(abs2, "utf-8");
+        const content = readFileSync20(abs2, "utf-8");
         const { begin, end } = markerLines(op.marker, op.comment);
         if (!(content.includes(begin) && content.includes(end))) {
           action = "recreate-append";
@@ -6097,45 +7134,45 @@ function renderUpgradeDiff(plan) {
   return lines.join(`
 `);
 }
-function regenerateBlock(repoRoot, op) {
-  const abs2 = resolveManagedBlockPath(repoRoot, op.path);
-  const content = readFileSync18(abs2, "utf-8");
+function regenerateBlock(repoRoot2, op) {
+  const abs2 = resolveManagedBlockPath(repoRoot2, op.path);
+  const content = readFileSync20(abs2, "utf-8");
   const stripped = stripBlockFromContent(content, op.marker, op.comment);
   if (stripped !== null) {
-    writeFileSync10(abs2, stripped.endsWith(`
+    writeFileSync11(abs2, stripped.endsWith(`
 `) ? stripped : `${stripped}
 `, "utf-8");
   }
-  appendBlock(repoRoot, op);
+  appendBlock(repoRoot2, op);
 }
-function applyUpgrade(plan, repoRoot) {
+function applyUpgrade(plan, repoRoot2) {
   for (const e of plan.entries) {
     if (e.kind === "create-file") {
       if (e.action === "regenerate" || e.action === "recreate") {
-        writeFileWithDirs(join20(repoRoot, e.op.path), e.op.content, e.op.mode);
+        writeFileWithDirs(join21(repoRoot2, e.op.path), e.op.content, e.op.mode);
       }
     } else {
       if (e.action === "recreate-host")
-        createHost(repoRoot, e.op);
+        createHost(repoRoot2, e.op);
       else if (e.action === "recreate-append")
-        appendBlock(repoRoot, e.op);
+        appendBlock(repoRoot2, e.op);
       else if (e.action === "regenerate-block")
-        regenerateBlock(repoRoot, e.op);
+        regenerateBlock(repoRoot2, e.op);
     }
   }
   for (const s of plan.routing.strips) {
     if (!s.present)
       continue;
-    const abs2 = resolveManagedBlockPath(repoRoot, s.path);
-    if (!existsSync18(abs2))
+    const abs2 = resolveManagedBlockPath(repoRoot2, s.path);
+    if (!existsSync19(abs2))
       continue;
-    const stripped = stripBlockFromContent(readFileSync18(abs2, "utf-8"), s.marker, s.comment);
+    const stripped = stripBlockFromContent(readFileSync20(abs2, "utf-8"), s.marker, s.comment);
     if (stripped === null)
       continue;
     if (blockStripLeavesEmpty(stripped))
-      rmSync4(abs2, { force: true });
+      rmSync5(abs2, { force: true });
     else
-      writeFileSync10(abs2, stripped.endsWith(`
+      writeFileSync11(abs2, stripped.endsWith(`
 `) ? stripped : `${stripped}
 `, "utf-8");
   }
@@ -6217,16 +7254,16 @@ async function upgradeCommand(args) {
 }
 
 // src/commands/waiver.ts
-import { execFileSync as execFileSync11 } from "node:child_process";
+import { execFileSync as execFileSync15 } from "node:child_process";
 function labelFor(kind) {
   return kind === "docs" ? WAIVER_LABEL : WAIVER_LABEL_REVIEW;
 }
-function gh(args) {
-  return execFileSync11("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: process.env }).trim();
+function gh2(args) {
+  return execFileSync15("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: process.env }).trim();
 }
 function detectPrNumber() {
   try {
-    const out = gh(["pr", "view", "--json", "number", "-q", ".number"]);
+    const out = gh2(["pr", "view", "--json", "number", "-q", ".number"]);
     return /^\d+$/.test(out) ? out : null;
   } catch {
     return null;
@@ -6322,8 +7359,8 @@ Reason: ${reason}`];
   }
   process.stdout.write(`Applying \`${label2}\` to PR #${prNumber} under your authenticated \`gh\` identity — vinaya never fabricates an actor.
 `);
-  execFileSync11("gh", editArgs, { stdio: "inherit", env: process.env });
-  execFileSync11("gh", commentArgs, { stdio: "inherit", env: process.env });
+  execFileSync15("gh", editArgs, { stdio: "inherit", env: process.env });
+  execFileSync15("gh", commentArgs, { stdio: "inherit", env: process.env });
   process.stdout.write(`
 ✓ Label applied and reason posted as a PR comment.
 `);
@@ -6483,6 +7520,48 @@ var COMMANDS = [
     ],
     status: "shipped"
   },
+  {
+    name: "review post",
+    description: "Render, post, and self-verify a code-reviewer or security-review verdict comment on a PR",
+    flags: [
+      { flag: "--role", description: "`code-reviewer` or `security` — selects which role template is rendered" },
+      {
+        flag: "--pr",
+        description: "Target PR number — its real head is resolved via `gh pr view`, never caller-supplied"
+      },
+      {
+        flag: "--verdict",
+        description: "code-reviewer: `APPROVE` | `REQUEST_CHANGES`. security: `PASS` | `FAIL`"
+      },
+      {
+        flag: "--findings-file",
+        description: "One finding per line: `SEVERITY|file:line|description` (`|`-delimited). Omit for zero findings."
+      },
+      { flag: "--brief-conformance", description: "code-reviewer only: the BRIEF CONFORMANCE line" },
+      { flag: "--spec-conformance", description: "code-reviewer only: the SPEC CONFORMANCE line" },
+      { flag: "--scope", description: "code-reviewer only: the SCOPE line" },
+      { flag: "--tests", description: "code-reviewer only: the TESTS line" },
+      { flag: "--docs", description: "code-reviewer only: the DOCS line" },
+      { flag: "--config-scan", description: "security only: the CONFIG SCAN line" },
+      { flag: "--secrets", description: "security only: the SECRETS line" },
+      {
+        flag: "--secrets-evidence-file",
+        description: 'security only: required whenever `--secrets` claims "none found" — the pasted scanner output backing that claim'
+      },
+      { flag: "--task-id", description: "the closing `Tokens:` line's task id" },
+      { flag: "--model", description: "the closing `Tokens:` line's model name" },
+      { flag: "--tokens-in", description: "a non-negative integer, or `-` if unknown" },
+      { flag: "--tokens-out", description: "a non-negative integer, or `-` if unknown" },
+      { flag: "--cost", description: "free text, or `-` if unknown" },
+      { flag: "--json", description: "Enveloped JSON output (schema: 1)" }
+    ],
+    details: [
+      "Every structural line (`VERDICT:`, `Judged head:`) is rendered from this command's own validated enum/sha inputs — never from a caller-supplied string — so a Reviewer's free-typed prose can no longer produce a shape the merge gate's line-anchored regex fails to see.",
+      "Refuses a contradictory verdict before posting anything: a BLOCKER finding with `--verdict APPROVE`, or a CRITICAL/HIGH finding with `--verdict PASS`, is rejected outright, mirroring each role doc's own consistency rule.",
+      "After posting, re-fetches the PR's comments and runs them through the exact `extractCodeReviewVerdict`/`extractSecurityReviewVerdict` functions `checkReviewGate` calls — the same functions, not a second implementation — and exits non-zero naming precisely what failed to re-parse if the post does not come back clean and bound to the resolved head. There is no `--skip-verify` escape."
+    ],
+    status: "shipped"
+  },
   {
     name: "doctor",
     description: "Diagnose hook, workflow, and config health — report only, never mutates",
@@ -6628,9 +7707,9 @@ function printHelp() {
 }
 
 // src/index.ts
-var PACKAGE_ROOT = join21(dirname8(fileURLToPath2(import.meta.url)), "..");
+var PACKAGE_ROOT = join22(dirname8(fileURLToPath2(import.meta.url)), "..");
 function readVersion2() {
-  const pkg = JSON.parse(readFileSync19(join21(PACKAGE_ROOT, "package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync21(join22(PACKAGE_ROOT, "package.json"), "utf-8"));
   return pkg.version;
 }
 var [, , command, ...args] = process.argv;
@@ -6733,6 +7812,16 @@ try {
       }
       break;
     }
+    case "review": {
+      const [subcommand, ...rest] = args;
+      if (subcommand === "post") {
+        await reviewPostCommand(rest);
+      } else {
+        console.error(`Unknown 'review' subcommand: ${subcommand ?? "(none)"} (expected 'post')`);
+        process.exit(2);
+      }
+      break;
+    }
     case "demo": {
       const [subcommand, ...rest] = args;
       if (subcommand === "break") {