@attalabs/vinaya 0.16.0 → 0.17.0

package/dist/checks/bin/check-dispatch-readiness.js

@@ -6,7 +6,27 @@ import { promisify as promisify4 } from "node:util";
 // ../../packages/aeg-forge-state/src/strip-code.ts
 function maskCode(body) {
   const fill = (line) => " ".repeat(line.length);
-  return maskIndentedCode(maskFencedCode(body, fill), fill).replace(/(`+)[^\n]*?\1/g, (m) => " ".repeat(m.length));
+  const blocksMasked = maskIndentedCode(maskFencedCode(body, fill), fill);
+  return blocksMasked.split(`
+`).map((line) => replaceInlineSpans(line, (span) => " ".repeat(span.length))).join(`
+`);
+}
+var DETAILS_OPEN = /<details\b[^>]*>/gi;
+var DETAILS_CLOSE = /<\/details\s*>/gi;
+function maskDetailsBlocks(body) {
+  const fill = (line) => " ".repeat(line.length);
+  const lines = body.split(`
+`);
+  let depth = 0;
+  const out = lines.map((line) => {
+    const opens = line.match(DETAILS_OPEN)?.length ?? 0;
+    const closes = line.match(DETAILS_CLOSE)?.length ?? 0;
+    const maskThisLine = depth > 0 || opens > 0;
+    depth = Math.max(0, depth + opens - closes);
+    return maskThisLine ? fill(line) : line;
+  });
+  return out.join(`
+`);
 }
 function stripCode(body, options = {}) {
   const normalised = body.replace(/\r\n?/g, `
@@ -15,7 +35,50 @@ function stripCode(body, options = {}) {
   const blocksStripped = maskIndentedCode(maskFencedCode(normalised, blank), blank);
   if (options.inlineSpans === "keep")
     return blocksStripped;
-  return blocksStripped.replace(/(`+)[^\n]*?\1/g, "");
+  return blocksStripped.split(`
+`).map((line) => replaceInlineSpans(line, () => "")).join(`
+`);
+}
+function replaceInlineSpans(line, replace) {
+  let result = "";
+  let i = 0;
+  const runLengthAt = (at) => {
+    let j = at;
+    while (j < line.length && line[j] === "`")
+      j++;
+    return j - at;
+  };
+  while (i < line.length) {
+    if (line[i] !== "`") {
+      result += line[i];
+      i++;
+      continue;
+    }
+    const openLen = runLengthAt(i);
+    const openEnd = i + openLen;
+    let j = openEnd;
+    let closeEnd = -1;
+    while (j < line.length) {
+      if (line[j] !== "`") {
+        j++;
+        continue;
+      }
+      const runLen = runLengthAt(j);
+      if (runLen === openLen) {
+        closeEnd = j + runLen;
+        break;
+      }
+      j += runLen;
+    }
+    if (closeEnd === -1) {
+      result += line.slice(i, openEnd);
+      i = openEnd;
+    } else {
+      result += replace(line.slice(i, closeEnd));
+      i = closeEnd;
+    }
+  }
+  return result;
 }
 var FENCE_OPEN = /^ {0,3}(`{3,}|~{3,})([^\r\n]*)\r?$/;
 var FENCE_CLOSE = /^ {0,3}(`+|~+)[ \t]*\r?$/;
@@ -1754,9 +1817,10 @@ function evaluateC5(changed, docOwnersContent, prBody, fileExists, waiverActive,
   return out;
 }
 // ../../packages/aeg-core/src/pr-tier.ts
+var TIER_FIELD = /(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i;
 function readTierFromPrBody(prBody) {
   const searchIn = anchoredRegion(prBody, "TIER") ?? prBody;
-  const m = searchIn.match(/(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i);
+  const m = searchIn.match(TIER_FIELD);
   if (!m)
     return null;
   const t = Number(m[4]);
@@ -2398,9 +2462,6 @@ function extractSecurityReviewVerdict(comments) {
   return extractVerdict(comments, /^[ \t]*(?:\*{1,3}|_{1,3})?VERDICT:\s*(PASS|FAIL)(?![A-Za-z0-9])/im, "security-review");
 }
 // ../../packages/aeg-core/src/review-gate.ts
-function isReviewGateExemptBranch(branch) {
-  return branch.startsWith("plan/");
-}
 function isBoundToHead(extraction, headSha) {
   if (!extraction.headSha)
     return false;
@@ -2455,6 +2516,11 @@ function checkReviewGate(input) {
     waived: false
   };
 }
+var CHANGESET_RELEASE_BRANCH = "changeset-release/main";
+var DEFAULT_RELEASE_ACTOR = "github-actions[bot]";
+function isChangesetsReleasePr(branch, author, expectedAuthor) {
+  return branch === CHANGESET_RELEASE_BRANCH && author === expectedAuthor;
+}
 // ../../packages/aeg-core/src/markdown-table.ts
 function splitRow(line) {
   const trimmed = line.trim().replace(/^\|/, "").replace(/\|$/, "");
@@ -3171,6 +3237,7 @@ var VinayaConfigSchema = z2.object({
   briefSchema: BriefSchemaSchema.optional(),
   managed: ManagedManifestSchema.optional(),
   principals: z2.array(z2.string()).min(1).optional(),
+  releaseActor: z2.string().min(1).optional(),
   ci: z2.object({ setup: z2.string().min(1) }).optional(),
   blastRadius: z2.object({ extraDomains: z2.array(z2.string()).optional() }).optional()
 });
@@ -3180,6 +3247,9 @@ var LOCAL_CONFIG_FILENAME = "vinaya.config.json";
 function resolvePrincipalAllowlist(config) {
   return config?.principals ?? PRINCIPAL_ALLOWLIST;
 }
+function resolveReleaseActor(config) {
+  return config?.releaseActor ?? DEFAULT_RELEASE_ACTOR;
+}
 function trustAnchorRepo() {
   const wellFormed = (slug) => /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
   const fromRunner = process.env.GITHUB_REPOSITORY?.trim();
@@ -3222,7 +3292,7 @@ function isMissingFileError(err) {
   return /\b404\b|not found/i.test(haystack);
 }
 function loadTrustAnchorConfig(fetcher = ghFetchTrustAnchorConfig) {
-  const warn = (why) => process.stdout.write(`⚠ could not read \`principals\` from the default branch (${why}) — falling back to vinaya's built-in principal allowlist.
+  const warn = (why) => process.stdout.write(`⚠ could not read the trust-anchor config (\`principals\`/\`releaseActor\`) from the default branch (${why}) — falling back to vinaya's built-in defaults.
 `);
   let base64;
   try {

package/dist/checks/bin/check-doc-coverage-push.js

@@ -6,7 +6,27 @@ import { existsSync, readFileSync } from "node:fs";
 // ../../packages/aeg-forge-state/src/strip-code.ts
 function maskCode(body) {
   const fill = (line) => " ".repeat(line.length);
-  return maskIndentedCode(maskFencedCode(body, fill), fill).replace(/(`+)[^\n]*?\1/g, (m) => " ".repeat(m.length));
+  const blocksMasked = maskIndentedCode(maskFencedCode(body, fill), fill);
+  return blocksMasked.split(`
+`).map((line) => replaceInlineSpans(line, (span) => " ".repeat(span.length))).join(`
+`);
+}
+var DETAILS_OPEN = /<details\b[^>]*>/gi;
+var DETAILS_CLOSE = /<\/details\s*>/gi;
+function maskDetailsBlocks(body) {
+  const fill = (line) => " ".repeat(line.length);
+  const lines = body.split(`
+`);
+  let depth = 0;
+  const out = lines.map((line) => {
+    const opens = line.match(DETAILS_OPEN)?.length ?? 0;
+    const closes = line.match(DETAILS_CLOSE)?.length ?? 0;
+    const maskThisLine = depth > 0 || opens > 0;
+    depth = Math.max(0, depth + opens - closes);
+    return maskThisLine ? fill(line) : line;
+  });
+  return out.join(`
+`);
 }
 function stripCode(body, options = {}) {
   const normalised = body.replace(/\r\n?/g, `
@@ -15,7 +35,50 @@ function stripCode(body, options = {}) {
   const blocksStripped = maskIndentedCode(maskFencedCode(normalised, blank), blank);
   if (options.inlineSpans === "keep")
     return blocksStripped;
-  return blocksStripped.replace(/(`+)[^\n]*?\1/g, "");
+  return blocksStripped.split(`
+`).map((line) => replaceInlineSpans(line, () => "")).join(`
+`);
+}
+function replaceInlineSpans(line, replace) {
+  let result = "";
+  let i = 0;
+  const runLengthAt = (at) => {
+    let j = at;
+    while (j < line.length && line[j] === "`")
+      j++;
+    return j - at;
+  };
+  while (i < line.length) {
+    if (line[i] !== "`") {
+      result += line[i];
+      i++;
+      continue;
+    }
+    const openLen = runLengthAt(i);
+    const openEnd = i + openLen;
+    let j = openEnd;
+    let closeEnd = -1;
+    while (j < line.length) {
+      if (line[j] !== "`") {
+        j++;
+        continue;
+      }
+      const runLen = runLengthAt(j);
+      if (runLen === openLen) {
+        closeEnd = j + runLen;
+        break;
+      }
+      j += runLen;
+    }
+    if (closeEnd === -1) {
+      result += line.slice(i, openEnd);
+      i = openEnd;
+    } else {
+      result += replace(line.slice(i, closeEnd));
+      i = closeEnd;
+    }
+  }
+  return result;
 }
 var FENCE_OPEN = /^ {0,3}(`{3,}|~{3,})([^\r\n]*)\r?$/;
 var FENCE_CLOSE = /^ {0,3}(`+|~+)[ \t]*\r?$/;
@@ -1754,9 +1817,10 @@ function evaluateC5(changed, docOwnersContent, prBody, fileExists, waiverActive,
   return out;
 }
 // ../../packages/aeg-core/src/pr-tier.ts
+var TIER_FIELD = /(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i;
 function readTierFromPrBody(prBody) {
   const searchIn = anchoredRegion(prBody, "TIER") ?? prBody;
-  const m = searchIn.match(/(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i);
+  const m = searchIn.match(TIER_FIELD);
   if (!m)
     return null;
   const t = Number(m[4]);
@@ -2398,9 +2462,6 @@ function extractSecurityReviewVerdict(comments) {
   return extractVerdict(comments, /^[ \t]*(?:\*{1,3}|_{1,3})?VERDICT:\s*(PASS|FAIL)(?![A-Za-z0-9])/im, "security-review");
 }
 // ../../packages/aeg-core/src/review-gate.ts
-function isReviewGateExemptBranch(branch) {
-  return branch.startsWith("plan/");
-}
 function isBoundToHead(extraction, headSha) {
   if (!extraction.headSha)
     return false;
@@ -2455,6 +2516,11 @@ function checkReviewGate(input) {
     waived: false
   };
 }
+var CHANGESET_RELEASE_BRANCH = "changeset-release/main";
+var DEFAULT_RELEASE_ACTOR = "github-actions[bot]";
+function isChangesetsReleasePr(branch, author, expectedAuthor) {
+  return branch === CHANGESET_RELEASE_BRANCH && author === expectedAuthor;
+}
 // ../../packages/aeg-core/src/markdown-table.ts
 function splitRow(line) {
   const trimmed = line.trim().replace(/^\|/, "").replace(/\|$/, "");
@@ -3172,6 +3238,7 @@ var VinayaConfigSchema = z.object({
   briefSchema: BriefSchemaSchema.optional(),
   managed: ManagedManifestSchema.optional(),
   principals: z.array(z.string()).min(1).optional(),
+  releaseActor: z.string().min(1).optional(),
   ci: z.object({ setup: z.string().min(1) }).optional(),
   blastRadius: z.object({ extraDomains: z.array(z.string()).optional() }).optional()
 });
@@ -3181,6 +3248,9 @@ var LOCAL_CONFIG_FILENAME = "vinaya.config.json";
 function resolvePrincipalAllowlist(config) {
   return config?.principals ?? PRINCIPAL_ALLOWLIST;
 }
+function resolveReleaseActor(config) {
+  return config?.releaseActor ?? DEFAULT_RELEASE_ACTOR;
+}
 function trustAnchorRepo() {
   const wellFormed = (slug) => /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
   const fromRunner = process.env.GITHUB_REPOSITORY?.trim();
@@ -3223,7 +3293,7 @@ function isMissingFileError(err) {
   return /\b404\b|not found/i.test(haystack);
 }
 function loadTrustAnchorConfig(fetcher = ghFetchTrustAnchorConfig) {
-  const warn = (why) => process.stdout.write(`⚠ could not read \`principals\` from the default branch (${why}) — falling back to vinaya's built-in principal allowlist.
+  const warn = (why) => process.stdout.write(`⚠ could not read the trust-anchor config (\`principals\`/\`releaseActor\`) from the default branch (${why}) — falling back to vinaya's built-in defaults.
 `);
   let base64;
   try {

package/dist/checks/bin/check-doc-coverage.js

@@ -1,13 +1,32 @@
 #!/usr/bin/env node
-// @bun
 
 // src/checks/bin/check-doc-coverage.ts
-import { execFileSync as execFileSync4 } from "child_process";
-import { existsSync, readFileSync } from "fs";
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
 // ../../packages/aeg-forge-state/src/strip-code.ts
 function maskCode(body) {
   const fill = (line) => " ".repeat(line.length);
-  return maskIndentedCode(maskFencedCode(body, fill), fill).replace(/(`+)[^\n]*?\1/g, (m) => " ".repeat(m.length));
+  const blocksMasked = maskIndentedCode(maskFencedCode(body, fill), fill);
+  return blocksMasked.split(`
+`).map((line) => replaceInlineSpans(line, (span) => " ".repeat(span.length))).join(`
+`);
+}
+var DETAILS_OPEN = /<details\b[^>]*>/gi;
+var DETAILS_CLOSE = /<\/details\s*>/gi;
+function maskDetailsBlocks(body) {
+  const fill = (line) => " ".repeat(line.length);
+  const lines = body.split(`
+`);
+  let depth = 0;
+  const out = lines.map((line) => {
+    const opens = line.match(DETAILS_OPEN)?.length ?? 0;
+    const closes = line.match(DETAILS_CLOSE)?.length ?? 0;
+    const maskThisLine = depth > 0 || opens > 0;
+    depth = Math.max(0, depth + opens - closes);
+    return maskThisLine ? fill(line) : line;
+  });
+  return out.join(`
+`);
 }
 function stripCode(body, options = {}) {
   const normalised = body.replace(/\r\n?/g, `
@@ -16,7 +35,50 @@ function stripCode(body, options = {}) {
   const blocksStripped = maskIndentedCode(maskFencedCode(normalised, blank), blank);
   if (options.inlineSpans === "keep")
     return blocksStripped;
-  return blocksStripped.replace(/(`+)[^\n]*?\1/g, "");
+  return blocksStripped.split(`
+`).map((line) => replaceInlineSpans(line, () => "")).join(`
+`);
+}
+function replaceInlineSpans(line, replace) {
+  let result = "";
+  let i = 0;
+  const runLengthAt = (at) => {
+    let j = at;
+    while (j < line.length && line[j] === "`")
+      j++;
+    return j - at;
+  };
+  while (i < line.length) {
+    if (line[i] !== "`") {
+      result += line[i];
+      i++;
+      continue;
+    }
+    const openLen = runLengthAt(i);
+    const openEnd = i + openLen;
+    let j = openEnd;
+    let closeEnd = -1;
+    while (j < line.length) {
+      if (line[j] !== "`") {
+        j++;
+        continue;
+      }
+      const runLen = runLengthAt(j);
+      if (runLen === openLen) {
+        closeEnd = j + runLen;
+        break;
+      }
+      j += runLen;
+    }
+    if (closeEnd === -1) {
+      result += line.slice(i, openEnd);
+      i = openEnd;
+    } else {
+      result += replace(line.slice(i, closeEnd));
+      i = closeEnd;
+    }
+  }
+  return result;
 }
 var FENCE_OPEN = /^ {0,3}(`{3,}|~{3,})([^\r\n]*)\r?$/;
 var FENCE_CLOSE = /^ {0,3}(`+|~+)[ \t]*\r?$/;
@@ -1755,9 +1817,10 @@ function evaluateC5(changed, docOwnersContent, prBody, fileExists, waiverActive,
   return out;
 }
 // ../../packages/aeg-core/src/pr-tier.ts
+var TIER_FIELD = /(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i;
 function readTierFromPrBody(prBody) {
   const searchIn = anchoredRegion(prBody, "TIER") ?? prBody;
-  const m = searchIn.match(/(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i);
+  const m = searchIn.match(TIER_FIELD);
   if (!m)
     return null;
   const t = Number(m[4]);
@@ -2399,9 +2462,6 @@ function extractSecurityReviewVerdict(comments) {
   return extractVerdict(comments, /^[ \t]*(?:\*{1,3}|_{1,3})?VERDICT:\s*(PASS|FAIL)(?![A-Za-z0-9])/im, "security-review");
 }
 // ../../packages/aeg-core/src/review-gate.ts
-function isReviewGateExemptBranch(branch) {
-  return branch.startsWith("plan/");
-}
 function isBoundToHead(extraction, headSha) {
   if (!extraction.headSha)
     return false;
@@ -2456,6 +2516,11 @@ function checkReviewGate(input) {
     waived: false
   };
 }
+var CHANGESET_RELEASE_BRANCH = "changeset-release/main";
+var DEFAULT_RELEASE_ACTOR = "github-actions[bot]";
+function isChangesetsReleasePr(branch, author, expectedAuthor) {
+  return branch === CHANGESET_RELEASE_BRANCH && author === expectedAuthor;
+}
 // ../../packages/aeg-core/src/markdown-table.ts
 function splitRow(line) {
   const trimmed = line.trim().replace(/^\|/, "").replace(/\|$/, "");
@@ -3173,6 +3238,7 @@ var VinayaConfigSchema = z.object({
   briefSchema: BriefSchemaSchema.optional(),
   managed: ManagedManifestSchema.optional(),
   principals: z.array(z.string()).min(1).optional(),
+  releaseActor: z.string().min(1).optional(),
   ci: z.object({ setup: z.string().min(1) }).optional(),
   blastRadius: z.object({ extraDomains: z.array(z.string()).optional() }).optional()
 });
@@ -3182,6 +3248,9 @@ var LOCAL_CONFIG_FILENAME = "vinaya.config.json";
 function resolvePrincipalAllowlist(config) {
   return config?.principals ?? PRINCIPAL_ALLOWLIST;
 }
+function resolveReleaseActor(config) {
+  return config?.releaseActor ?? DEFAULT_RELEASE_ACTOR;
+}
 function trustAnchorRepo() {
   const wellFormed = (slug) => /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
   const fromRunner = process.env.GITHUB_REPOSITORY?.trim();
@@ -3224,7 +3293,7 @@ function isMissingFileError(err) {
   return /\b404\b|not found/i.test(haystack);
 }
 function loadTrustAnchorConfig(fetcher = ghFetchTrustAnchorConfig) {
-  const warn = (why) => process.stdout.write(`⚠ could not read \`principals\` from the default branch (${why}) — falling back to vinaya's built-in principal allowlist.
+  const warn = (why) => process.stdout.write(`⚠ could not read the trust-anchor config (\`principals\`/\`releaseActor\`) from the default branch (${why}) — falling back to vinaya's built-in defaults.
 `);
   let base64;
   try {
@@ -3334,7 +3403,7 @@ function main() {
         check: CHECK_NAME,
         severity: "error",
         message,
-        agent_recovery_prompt: "Read the doc pointer named in the finding above, apply the change your code edit implies, and commit both " + "files in this PR. If the doc genuinely does not need updating, ask a principal to apply the `vinaya/waiver:docs` " + "label rather than editing around this finding \u2014 you cannot self-serve that waiver."
+        agent_recovery_prompt: "Read the doc pointer named in the finding above, apply the change your code edit implies, and commit both " + "files in this PR. If the doc genuinely does not need updating, ask a principal to apply the `vinaya/waiver:docs` " + "label rather than editing around this finding — you cannot self-serve that waiver."
       });
     }
     process.exit(1);

package/dist/checks/bin/check-evidence-fresh.js

@@ -5,7 +5,27 @@ import { execFileSync as execFileSync2 } from "node:child_process";
 // ../../packages/aeg-forge-state/src/strip-code.ts
 function maskCode(body) {
   const fill = (line) => " ".repeat(line.length);
-  return maskIndentedCode(maskFencedCode(body, fill), fill).replace(/(`+)[^\n]*?\1/g, (m) => " ".repeat(m.length));
+  const blocksMasked = maskIndentedCode(maskFencedCode(body, fill), fill);
+  return blocksMasked.split(`
+`).map((line) => replaceInlineSpans(line, (span) => " ".repeat(span.length))).join(`
+`);
+}
+var DETAILS_OPEN = /<details\b[^>]*>/gi;
+var DETAILS_CLOSE = /<\/details\s*>/gi;
+function maskDetailsBlocks(body) {
+  const fill = (line) => " ".repeat(line.length);
+  const lines = body.split(`
+`);
+  let depth = 0;
+  const out = lines.map((line) => {
+    const opens = line.match(DETAILS_OPEN)?.length ?? 0;
+    const closes = line.match(DETAILS_CLOSE)?.length ?? 0;
+    const maskThisLine = depth > 0 || opens > 0;
+    depth = Math.max(0, depth + opens - closes);
+    return maskThisLine ? fill(line) : line;
+  });
+  return out.join(`
+`);
 }
 function stripCode(body, options = {}) {
   const normalised = body.replace(/\r\n?/g, `
@@ -14,7 +34,50 @@ function stripCode(body, options = {}) {
   const blocksStripped = maskIndentedCode(maskFencedCode(normalised, blank), blank);
   if (options.inlineSpans === "keep")
     return blocksStripped;
-  return blocksStripped.replace(/(`+)[^\n]*?\1/g, "");
+  return blocksStripped.split(`
+`).map((line) => replaceInlineSpans(line, () => "")).join(`
+`);
+}
+function replaceInlineSpans(line, replace) {
+  let result = "";
+  let i = 0;
+  const runLengthAt = (at) => {
+    let j = at;
+    while (j < line.length && line[j] === "`")
+      j++;
+    return j - at;
+  };
+  while (i < line.length) {
+    if (line[i] !== "`") {
+      result += line[i];
+      i++;
+      continue;
+    }
+    const openLen = runLengthAt(i);
+    const openEnd = i + openLen;
+    let j = openEnd;
+    let closeEnd = -1;
+    while (j < line.length) {
+      if (line[j] !== "`") {
+        j++;
+        continue;
+      }
+      const runLen = runLengthAt(j);
+      if (runLen === openLen) {
+        closeEnd = j + runLen;
+        break;
+      }
+      j += runLen;
+    }
+    if (closeEnd === -1) {
+      result += line.slice(i, openEnd);
+      i = openEnd;
+    } else {
+      result += replace(line.slice(i, closeEnd));
+      i = closeEnd;
+    }
+  }
+  return result;
 }
 var FENCE_OPEN = /^ {0,3}(`{3,}|~{3,})([^\r\n]*)\r?$/;
 var FENCE_CLOSE = /^ {0,3}(`+|~+)[ \t]*\r?$/;
@@ -1753,9 +1816,10 @@ function evaluateC5(changed, docOwnersContent, prBody, fileExists, waiverActive,
   return out;
 }
 // ../../packages/aeg-core/src/pr-tier.ts
+var TIER_FIELD = /(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i;
 function readTierFromPrBody(prBody) {
   const searchIn = anchoredRegion(prBody, "TIER") ?? prBody;
-  const m = searchIn.match(/(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i);
+  const m = searchIn.match(TIER_FIELD);
   if (!m)
     return null;
   const t = Number(m[4]);
@@ -2397,9 +2461,6 @@ function extractSecurityReviewVerdict(comments) {
   return extractVerdict(comments, /^[ \t]*(?:\*{1,3}|_{1,3})?VERDICT:\s*(PASS|FAIL)(?![A-Za-z0-9])/im, "security-review");
 }
 // ../../packages/aeg-core/src/review-gate.ts
-function isReviewGateExemptBranch(branch) {
-  return branch.startsWith("plan/");
-}
 function isBoundToHead(extraction, headSha) {
   if (!extraction.headSha)
     return false;
@@ -2454,6 +2515,11 @@ function checkReviewGate(input) {
     waived: false
   };
 }
+var CHANGESET_RELEASE_BRANCH = "changeset-release/main";
+var DEFAULT_RELEASE_ACTOR = "github-actions[bot]";
+function isChangesetsReleasePr(branch, author, expectedAuthor) {
+  return branch === CHANGESET_RELEASE_BRANCH && author === expectedAuthor;
+}
 // ../../packages/aeg-core/src/markdown-table.ts
 function splitRow(line) {
   const trimmed = line.trim().replace(/^\|/, "").replace(/\|$/, "");

package/dist/checks/bin/check-first-push-dispatch.js

@@ -5,7 +5,27 @@ import { execFileSync as execFileSync3 } from "node:child_process";
 // ../../packages/aeg-forge-state/src/strip-code.ts
 function maskCode(body) {
   const fill = (line) => " ".repeat(line.length);
-  return maskIndentedCode(maskFencedCode(body, fill), fill).replace(/(`+)[^\n]*?\1/g, (m) => " ".repeat(m.length));
+  const blocksMasked = maskIndentedCode(maskFencedCode(body, fill), fill);
+  return blocksMasked.split(`
+`).map((line) => replaceInlineSpans(line, (span) => " ".repeat(span.length))).join(`
+`);
+}
+var DETAILS_OPEN = /<details\b[^>]*>/gi;
+var DETAILS_CLOSE = /<\/details\s*>/gi;
+function maskDetailsBlocks(body) {
+  const fill = (line) => " ".repeat(line.length);
+  const lines = body.split(`
+`);
+  let depth = 0;
+  const out = lines.map((line) => {
+    const opens = line.match(DETAILS_OPEN)?.length ?? 0;
+    const closes = line.match(DETAILS_CLOSE)?.length ?? 0;
+    const maskThisLine = depth > 0 || opens > 0;
+    depth = Math.max(0, depth + opens - closes);
+    return maskThisLine ? fill(line) : line;
+  });
+  return out.join(`
+`);
 }
 function stripCode(body, options = {}) {
   const normalised = body.replace(/\r\n?/g, `
@@ -14,7 +34,50 @@ function stripCode(body, options = {}) {
   const blocksStripped = maskIndentedCode(maskFencedCode(normalised, blank), blank);
   if (options.inlineSpans === "keep")
     return blocksStripped;
-  return blocksStripped.replace(/(`+)[^\n]*?\1/g, "");
+  return blocksStripped.split(`
+`).map((line) => replaceInlineSpans(line, () => "")).join(`
+`);
+}
+function replaceInlineSpans(line, replace) {
+  let result = "";
+  let i = 0;
+  const runLengthAt = (at) => {
+    let j = at;
+    while (j < line.length && line[j] === "`")
+      j++;
+    return j - at;
+  };
+  while (i < line.length) {
+    if (line[i] !== "`") {
+      result += line[i];
+      i++;
+      continue;
+    }
+    const openLen = runLengthAt(i);
+    const openEnd = i + openLen;
+    let j = openEnd;
+    let closeEnd = -1;
+    while (j < line.length) {
+      if (line[j] !== "`") {
+        j++;
+        continue;
+      }
+      const runLen = runLengthAt(j);
+      if (runLen === openLen) {
+        closeEnd = j + runLen;
+        break;
+      }
+      j += runLen;
+    }
+    if (closeEnd === -1) {
+      result += line.slice(i, openEnd);
+      i = openEnd;
+    } else {
+      result += replace(line.slice(i, closeEnd));
+      i = closeEnd;
+    }
+  }
+  return result;
 }
 var FENCE_OPEN = /^ {0,3}(`{3,}|~{3,})([^\r\n]*)\r?$/;
 var FENCE_CLOSE = /^ {0,3}(`+|~+)[ \t]*\r?$/;
@@ -1753,9 +1816,10 @@ function evaluateC5(changed, docOwnersContent, prBody, fileExists, waiverActive,
   return out;
 }
 // ../../packages/aeg-core/src/pr-tier.ts
+var TIER_FIELD = /(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i;
 function readTierFromPrBody(prBody) {
   const searchIn = anchoredRegion(prBody, "TIER") ?? prBody;
-  const m = searchIn.match(/(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i);
+  const m = searchIn.match(TIER_FIELD);
   if (!m)
     return null;
   const t = Number(m[4]);
@@ -2397,9 +2461,6 @@ function extractSecurityReviewVerdict(comments) {
   return extractVerdict(comments, /^[ \t]*(?:\*{1,3}|_{1,3})?VERDICT:\s*(PASS|FAIL)(?![A-Za-z0-9])/im, "security-review");
 }
 // ../../packages/aeg-core/src/review-gate.ts
-function isReviewGateExemptBranch(branch) {
-  return branch.startsWith("plan/");
-}
 function isBoundToHead(extraction, headSha) {
   if (!extraction.headSha)
     return false;
@@ -2454,6 +2515,11 @@ function checkReviewGate(input) {
     waived: false
   };
 }
+var CHANGESET_RELEASE_BRANCH = "changeset-release/main";
+var DEFAULT_RELEASE_ACTOR = "github-actions[bot]";
+function isChangesetsReleasePr(branch, author, expectedAuthor) {
+  return branch === CHANGESET_RELEASE_BRANCH && author === expectedAuthor;
+}
 // ../../packages/aeg-core/src/markdown-table.ts
 function splitRow(line) {
   const trimmed = line.trim().replace(/^\|/, "").replace(/\|$/, "");
@@ -3170,6 +3236,7 @@ var VinayaConfigSchema = z2.object({
   briefSchema: BriefSchemaSchema.optional(),
   managed: ManagedManifestSchema.optional(),
   principals: z2.array(z2.string()).min(1).optional(),
+  releaseActor: z2.string().min(1).optional(),
   ci: z2.object({ setup: z2.string().min(1) }).optional(),
   blastRadius: z2.object({ extraDomains: z2.array(z2.string()).optional() }).optional()
 });
@@ -3179,6 +3246,9 @@ var LOCAL_CONFIG_FILENAME = "vinaya.config.json";
 function resolvePrincipalAllowlist(config) {
   return config?.principals ?? PRINCIPAL_ALLOWLIST;
 }
+function resolveReleaseActor(config) {
+  return config?.releaseActor ?? DEFAULT_RELEASE_ACTOR;
+}
 function trustAnchorRepo() {
   const wellFormed = (slug) => /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
   const fromRunner = process.env.GITHUB_REPOSITORY?.trim();
@@ -3221,7 +3291,7 @@ function isMissingFileError(err) {
   return /\b404\b|not found/i.test(haystack);
 }
 function loadTrustAnchorConfig(fetcher = ghFetchTrustAnchorConfig) {
-  const warn = (why) => process.stdout.write(`⚠ could not read \`principals\` from the default branch (${why}) — falling back to vinaya's built-in principal allowlist.
+  const warn = (why) => process.stdout.write(`⚠ could not read the trust-anchor config (\`principals\`/\`releaseActor\`) from the default branch (${why}) — falling back to vinaya's built-in defaults.
 `);
   let base64;
   try {