@attalabs/vinaya 0.16.0 → 0.17.0

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync20 } from "node:fs";
+import { readFileSync as readFileSync21 } from "node:fs";
 import { dirname as dirname8, join as join22 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
@@ -10,7 +10,10 @@ import { execFileSync as execFileSync4 } from "node:child_process";
 // ../../packages/aeg-forge-state/src/strip-code.ts
 function maskCode(body) {
   const fill = (line) => " ".repeat(line.length);
-  return maskIndentedCode(maskFencedCode(body, fill), fill).replace(/(`+)[^\n]*?\1/g, (m) => " ".repeat(m.length));
+  const blocksMasked = maskIndentedCode(maskFencedCode(body, fill), fill);
+  return blocksMasked.split(`
+`).map((line) => replaceInlineSpans(line, (span) => " ".repeat(span.length))).join(`
+`);
 }
 function stripCode(body, options = {}) {
   const normalised = body.replace(/\r\n?/g, `
@@ -19,7 +22,50 @@ function stripCode(body, options = {}) {
   const blocksStripped = maskIndentedCode(maskFencedCode(normalised, blank), blank);
   if (options.inlineSpans === "keep")
     return blocksStripped;
-  return blocksStripped.replace(/(`+)[^\n]*?\1/g, "");
+  return blocksStripped.split(`
+`).map((line) => replaceInlineSpans(line, () => "")).join(`
+`);
+}
+function replaceInlineSpans(line, replace) {
+  let result = "";
+  let i = 0;
+  const runLengthAt = (at) => {
+    let j = at;
+    while (j < line.length && line[j] === "`")
+      j++;
+    return j - at;
+  };
+  while (i < line.length) {
+    if (line[i] !== "`") {
+      result += line[i];
+      i++;
+      continue;
+    }
+    const openLen = runLengthAt(i);
+    const openEnd = i + openLen;
+    let j = openEnd;
+    let closeEnd = -1;
+    while (j < line.length) {
+      if (line[j] !== "`") {
+        j++;
+        continue;
+      }
+      const runLen = runLengthAt(j);
+      if (runLen === openLen) {
+        closeEnd = j + runLen;
+        break;
+      }
+      j += runLen;
+    }
+    if (closeEnd === -1) {
+      result += line.slice(i, openEnd);
+      i = openEnd;
+    } else {
+      result += replace(line.slice(i, closeEnd));
+      i = closeEnd;
+    }
+  }
+  return result;
 }
 var FENCE_OPEN = /^ {0,3}(`{3,}|~{3,})([^\r\n]*)\r?$/;
 var FENCE_CLOSE = /^ {0,3}(`+|~+)[ \t]*\r?$/;
@@ -53,6 +99,10 @@ function scanFencedCode(body) {
   });
   return { lines, unterminated: fenceChar !== null };
 }
+function hasUnterminatedFence(body) {
+  return scanFencedCode(body.replace(/\r\n?/g, `
+`)).unterminated;
+}
 var LIST_MARKER = /^ {0,3}(?:[-*+]|\d{1,9}[.)])(?:\s|$)/;
 function indentWidth(line) {
   let width = 0;
@@ -240,6 +290,42 @@ function matchesLabel(key, name) {
 function hasLabel(key, names) {
   return names.some((n) => matchesLabel(key, n));
 }
+
+// ../../packages/aeg-forge-state/src/list-tasks.ts
+var PROJECT_SLUG = /^[a-z0-9][a-z0-9-]*$/i;
+var PROJECT_FIELD = /^\s*(?:\*\*)?Project(?:\(s\))?(?:\*\*)?\s*:\s*(?:\*\*)?\s*(.+)$/im;
+var VALUE_EDGE_MARKUP = /^[`.;\s]+|[`.;\s]+$/g;
+function unwrapValue(raw) {
+  return raw.replace(/\*\*/g, "").replace(VALUE_EDGE_MARKUP, "");
+}
+function projectFieldFromBody(body) {
+  const m = stripCode(body, { inlineSpans: "keep" }).match(PROJECT_FIELD);
+  if (m)
+    return parseFieldValue(m[1] ?? "");
+  if (hasUnterminatedFence(body)) {
+    const raw = body.match(PROJECT_FIELD);
+    if (raw)
+      return { declared: true, names: [], unparsed: [(raw[1] ?? "").trim()], unreadable: true };
+  }
+  return { declared: false, names: [], unparsed: [], unreadable: false };
+}
+function parseFieldValue(value) {
+  const names = [];
+  const unparsed = [];
+  for (const raw of value.split(",")) {
+    const name = unwrapValue(raw);
+    if (name.length === 0)
+      continue;
+    if (PROJECT_SLUG.test(name))
+      names.push(name);
+    else
+      unparsed.push(raw.trim());
+  }
+  return { declared: true, names: [...new Set(names)], unparsed, unreadable: false };
+}
+function projectsFromBody(body) {
+  return projectFieldFromBody(body).names;
+}
 // ../../packages/aeg-forge-state/src/github-token.ts
 import { execFile as execFile2 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
@@ -613,9 +699,10 @@ function pointerToPath(p) {
 }
 var SEPARATOR = /(?:[ \t]*[—–][ \t]*|[ \t]+-[ \t]+)/.source;
 // ../../packages/aeg-core/src/pr-tier.ts
+var TIER_FIELD = /(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i;
 function readTierFromPrBody(prBody) {
   const searchIn = anchoredRegion(prBody, "TIER") ?? prBody;
-  const m = searchIn.match(/(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i);
+  const m = searchIn.match(TIER_FIELD);
   if (!m)
     return null;
   const t = Number(m[4]);
@@ -893,6 +980,82 @@ function checkIssueRationale(body) {
 function isTaskIssueLabelSet(labels) {
   return hasLabel("tranche", labels);
 }
+var PATH_TEXT = (body) => stripCode(body, { inlineSpans: "keep" });
+var DOC_EXTENSION_RE = /\.(?:md|mdx|txt)$/i;
+function namesPath(text, path) {
+  const escaped = path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const occurrences = new RegExp(`(?:^|[^\\w./-])(${escaped}(?:/[\\w.@-]+)*)(?![\\w-])`, "gm");
+  for (const m of text.matchAll(occurrences)) {
+    if (!DOC_EXTENSION_RE.test(m[1]))
+      return true;
+  }
+  return false;
+}
+var BLAST_RADIUS_ACK_RE = /(?:\*\*)?blast-radius-ack(?:\*\*)?\s*[:—–-]/i;
+function checkBlastRadiusScope(body, _labels, sharedPackages, projectPaths) {
+  if (sharedPackages.length === 0)
+    return { status: "pass", errors: [] };
+  const text = [
+    rationaleFieldText(PATH_TEXT(body), "Boundary"),
+    rationaleFieldText(PATH_TEXT(body), "Project\\(s\\)|Project(?:s)?\\s*\\+|blast radius")
+  ].join(`
+`);
+  const named = sharedPackages.filter((d) => namesPath(text, d));
+  if (named.length === 0)
+    return { status: "pass", errors: [] };
+  const registered = new Set(projectPaths.map((p) => p.name.trim()));
+  const declared = projectsFromBody(body);
+  const projects = declared.filter((p) => registered.has(p));
+  const ownedPaths = projectPaths.filter((p) => projects.includes(p.name)).map((p) => p.path.replace(/\/+$/, ""));
+  const unowned = named.filter((d) => !ownedPaths.some((owned) => d === owned || d.startsWith(`${owned}/`)));
+  if (unowned.length === 0)
+    return { status: "pass", errors: [] };
+  if (projects.length > 1)
+    return { status: "pass", errors: [] };
+  if (BLAST_RADIUS_ACK_RE.test(PATH_TEXT(body)))
+    return { status: "pass", errors: [] };
+  const unregistered = declared.filter((p) => !registered.has(p));
+  return {
+    status: "fail",
+    errors: [
+      `issue-validation blast radius: the rationale names ${unowned.join(", ")} — a shared collision domain no declared project (${projects.join(", ") || "none"}) owns — but declares a single registered project and no \`blast-radius-ack:\` line.${unregistered.length > 0 ? ` Not counted: ${unregistered.join(", ")} — no row in \`.vinaya/projects.md\`, so it adds no review lens.` : ""} Project(s) drives the review fan-out (.vinaya/projects.md); list every consumer in the blast radius, or add \`blast-radius-ack: <why one lens is enough>\`.`
+    ]
+  };
+}
+var BRIEF_MARKERS = [
+  { name: "## References", pattern: /(?:^#{1,6}\s*|\*\*)\s*References\b/im },
+  { name: "Technical surface map", pattern: /(?:^#{1,6}\s*|\*\*)\s*Technical surface map\b/im },
+  { name: "Premise", pattern: /(?:^#{1,6}\s*|\*\*)\s*Premise(?:\*\*)?\s*[:—–]/im },
+  { name: "Step 0", pattern: /(?:^#{1,6}\s*|\*\*)\s*Step 0\b/im },
+  { name: "Test Plan", pattern: /(?:^#{1,6}\s*|\*\*)\s*Test Plan\b/im }
+];
+function checkNoBriefContent(body) {
+  const text = stripCode(body);
+  const errors = BRIEF_MARKERS.filter((m) => m.pattern.test(text)).map((m) => `issue-validation brief content: the Issue body carries a brief-shaped "${m.name}" section. Brief-time content (surface pointers, skills-to-read, premise, test plan) belongs in the brief, not the Issue — it goes stale before work starts (aeg-root/skills/brief-authoring/SKILL.md). Move it to the brief.`);
+  return { status: errors.length > 0 ? "fail" : "pass", errors };
+}
+function rationaleFieldText(text, labelPattern) {
+  const re = new RegExp(`(?:\\*\\*|^#{1,4}\\s+)\\s*(?:${labelPattern})[^\\n]*\\n?([\\s\\S]*?)(?=\\n\\s*(?:\\*\\*[A-Z]|#{1,4}\\s)|(?![\\s\\S]))`, "im");
+  const m = re.exec(text);
+  return m ? m[0] : "";
+}
+var DOC_PATH_RE = /(?:(?:aeg-root|apps|packages|specs|docs|tools|\.claude|\.github)\/[\w./@-]*\.(?:md|mdx)|\.claude\/(?:skills|rules)\/[\w./-]+|\b(?:docs-index|decisions|projects|state-machine|enforcement|process|README|CLAUDE)\.md\b|\b[\w-]+-(?:spec|decisions|backlog)\.md\b)/i;
+var NO_DOC_SURFACE_RE = /(?:\*\*)?\s*no-doc-surface/i;
+function checkRationaleNamesDocs(body) {
+  const text = PATH_TEXT(body);
+  const scope = [rationaleFieldText(text, "Docs to keep coherent|§7"), rationaleFieldText(text, "Traps")].join(`
+`);
+  if (NO_DOC_SURFACE_RE.test(scope))
+    return { status: "pass", errors: [] };
+  if (DOC_PATH_RE.test(scope))
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      'issue-validation docs read: neither "Docs to keep coherent" nor "Traps to avoid" names a concrete doc path (aeg-root/…, .claude/skills/…, apps/*/CLAUDE.md, apps/*/specs/…). Naming one is the artifact of having read the surface being planned — the forge write triggers no skill-check hook, so this field is the only read-obligation signal. For a genuinely doc-less surface, write the explicit `no-doc-surface` sentinel.'
+    ]
+  };
+}
 
 // ../../packages/aeg-core/src/coherence-checks.ts
 var R1_GRANDFATHERED_ISSUES = new Set([279, 280, 281, 282]);
@@ -1077,6 +1240,7 @@ var CHECKS_WORKFLOW_PATH = ".github/workflows/vinaya-checks.yml";
 var REVIEW_WORKFLOW_PATH = ".github/workflows/vinaya-review.yml";
 var REVIEW_VERDICT_WORKFLOW_PATH = ".github/workflows/vinaya-review-verdict.yml";
 var ARCHIVIST_WORKFLOW_PATH = ".github/workflows/vinaya-archivist.yml";
+var BODY_CHECKS_WORKFLOW_PATH = ".github/workflows/vinaya-body-checks.yml";
 var MANAGED_NOTE = "Managed by Vinaya — created by `vinaya init`. `vinaya upgrade` regenerates it; `vinaya eject` removes it.";
 function starterConfig() {
   return {
@@ -1103,9 +1267,31 @@ function ownVersion() {
   return pkg.version;
 }
 var SETUP_BUN_SHA = "0c5077e51419868618aeaa5fe8019c62421857d6";
-function vinayaSetupSteps(selfHost) {
+function vinayaSetupSteps(selfHost, sourceTrust = "pull-request") {
   if (!selfHost)
     return "";
+  if (sourceTrust === "trusted") {
+    return `      # Pinned to a commit, not the mutable \`v2\` tag. A repoint of
+      # \`v2\` would execute new upstream code in every adopter on the next run,
+      # with no diff anywhere to review. Resolved from the \`v2\` tag on
+      # 2026-08-14. Bun's own version still comes from the repo's
+      # \`packageManager\` field, not from this pin.
+      - uses: oven-sh/setup-bun@${SETUP_BUN_SHA}
+      # This repo declares the \`@attalabs/vinaya\` workspace package itself, so
+      # \`npx @attalabs/vinaya\` resolves to that local member instead of the
+      # registry and dies on its unbuilt \`bin\`. Build and run the trusted
+      # default-branch copy directly.
+      #
+      # This workflow executes only a trusted checkout selected by its event:
+      # never the pull request head or merge ref. The review-authority decision
+      # therefore comes from code the pull request cannot alter. \`--ignore-scripts\`
+      # remains defense in depth against lifecycle hooks in that trusted tree.
+      - name: Build the trusted Vinaya CLI
+        run: |
+          bun install --frozen-lockfile --ignore-scripts
+          bun run --cwd ${selfHost.dir} build
+`;
+  }
   return `      # Pinned to a commit, not the mutable \`v2\` tag. This is the first
       # THIRD-PARTY action this generator writes into an adopter's repository,
       # and it runs in the same job that then builds and executes pull-request
@@ -1209,7 +1395,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 20
-${vinayaSetupSteps(selfHost)}${adopterSetupStep(ciSetup)}      - name: Run checks
+${vinayaSetupSteps(selfHost, "pull-request")}${adopterSetupStep(ciSetup)}      - name: Run checks
         env:
           GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: \${{ github.event.pull_request.number }}
@@ -1243,21 +1429,27 @@ ${vinayaSetupSteps(selfHost)}${adopterSetupStep(ciSetup)}      - name: Run check
           } >> "$GITHUB_STEP_SUMMARY"
 `;
 }
-function reviewWorkflow(selfHost, ciSetup) {
+function reviewWorkflow(selfHost) {
   return `# ${MANAGED_NOTE}
 #
-# The required review gate — pull_request events only. The verdict-comment
+# The required review gate. \`pull_request_target\` is the trust boundary:
+# GitHub loads this workflow and its default checkout from the repository's
+# default branch, never from the pull request being judged. The job does not
+# fetch, check out, install, build, or execute pull-request content.
+#
+# The verdict-comment
 # half lives in its own workflow (vinaya-review-verdict.yml): a new PR
-# comment fires a different GitHub event that this pull_request-only
+# comment fires a different GitHub event that this
 # workflow structurally cannot receive — and keeping the comment path in a
 # separate FILE means this workflow's runs never list permanently-skipped
 # comment jobs on the PR's checks panel. When a clean final verdict lands,
 # the verdict workflow re-runs this one, so the required check below goes
 # green natively with no manual rerun.
 name: Vinaya Review Gate
+run-name: "Vinaya Review Gate PR #\${{ github.event.pull_request.number }} @ \${{ github.event.pull_request.head.sha }}"
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, synchronize, reopened, labeled, unlabeled]
 
 # One run per pull request COMMIT, always. Several \`types:\` above can fire in the
@@ -1297,30 +1489,96 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          # This job executes repo content; don't leave the token in
-          # .git/config for scripts to read.
+          # Explicit trusted ref: never use the PR head/merge ref in this job.
+          ref: \${{ github.event.repository.default_branch }}
           persist-credentials: false
           fetch-depth: 0
       - uses: actions/setup-node@v4
         with:
           node-version: 20
-${vinayaSetupSteps(selfHost)}${adopterSetupStep(ciSetup)}      - name: Review gate
+${vinayaSetupSteps(selfHost, "trusted")}      - name: Review gate
         env:
           GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
           # PR_NUMBER is what makes the review-gate check EVALUATE: without
           # it the adapter reads "no PR yet — local dev" and exits 0, and
           # the gate is green regardless of review state.
           PR_NUMBER: \${{ github.event.pull_request.number }}
-          BRANCH: \${{ github.head_ref }}
         run: ${vinayaRun(selfHost, "check review-gate")}
 `;
 }
-function reviewVerdictWorkflow(selfHost, ciSetup) {
+function bodyChecksWorkflow(selfHost) {
+  return `# ${MANAGED_NOTE}
+#
+# Required, PR-content-independent checks that need a trust anchor no pull
+# request can rewrite. \`pull_request_target\` is the same boundary
+# \`vinaya-review.yml\` uses: GitHub loads this workflow and its default
+# checkout from the repository's default branch, never from the pull
+# request being judged. The job does not fetch, check out, install, build,
+# or execute pull-request content — every check registered here reads only
+# live-fetched PR metadata (\`gh pr view\`), never the diff or repo tree, the
+# same shape \`review-gate\` already requires of its own checks.
+#
+# \`body-bare-digits\` is the one check here today: its Changesets-release
+# exemption live-fetches the PR's real author, keyed on \`PR_NUMBER\` — on a
+# \`pull_request\` trigger that value is PR-editable (the PR's own workflow
+# YAML controls it), so an attacker could redirect it to any
+# already-approved PR by the configured release actor. Found live (round 5,
+# security review, PR #165), and verified no env-var or git-state signal
+# inside a \`pull_request\` job closes it — \`pull_request_target\` does,
+# because the workflow text assigning \`PR_NUMBER\` comes from THIS file on
+# the default branch, which a pull request cannot edit.
+name: Vinaya Body Checks
+run-name: "Vinaya Body Checks PR #\${{ github.event.pull_request.number }} @ \${{ github.event.pull_request.head.sha }}"
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, edited]
+
+# Same collapsing rationale as \`vinaya-review.yml\`'s concurrency group — see
+# that file's own comment for the two measured failure modes (duplicate
+# runs from simultaneous event types; an old rerun cancelling the current
+# commit's run) this group exists to prevent.
+concurrency:
+  group: vinaya-body-checks-\${{ github.event.pull_request.number || github.ref }}-\${{ github.event.pull_request.head.sha || github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  vinaya-body-checks:
+    name: vinaya check body-bare-digits
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Explicit trusted ref: never use the PR head/merge ref in this job.
+          ref: \${{ github.event.repository.default_branch }}
+          persist-credentials: false
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+${vinayaSetupSteps(selfHost, "trusted")}      - name: Body checks
+        env:
+          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+          # PR_NUMBER is what makes the Changesets-release exemption
+          # EVALUATE its live gh pr view fetch: without it the check reads
+          # "no PR yet — local dev" and falls through to the ordinary
+          # bare-digit scan.
+          PR_NUMBER: \${{ github.event.pull_request.number }}
+          # PR_BODY is what makes body-bare-digits EVALUATE at all — the bin
+          # reads \`process.env.PR_BODY\` only, never fetches it itself.
+          PR_BODY: \${{ github.event.pull_request.body }}
+        run: ${vinayaRun(selfHost, "check body-bare-digits")}
+`;
+}
+function reviewVerdictWorkflow(selfHost) {
   return `# ${MANAGED_NOTE}
 #
 # The verdict-comment half of the review gate. A reviewer's verdict arrives
 # as a PR comment (\`VERDICT: APPROVE\` / \`VERDICT: PASS\`), which fires
-# GitHub's \`issue_comment\` event — an event the required pull_request
+# GitHub's \`issue_comment\` event — an event the required PR-event
 # workflow cannot receive. This workflow evaluates the gate on that comment
 # and, when the evaluation is clean, RE-RUNS the required workflow so its
 # check goes green natively with no manual rerun. (Writing check-run
@@ -1328,11 +1586,10 @@ function reviewVerdictWorkflow(selfHost, ciSetup) {
 # restricts check-run updates to the owning workflow — re-running is the
 # supported channel.)
 #
-# Privilege split, deliberate: \`evaluate\` checks out and executes repo
-# content and therefore holds NO write permission; \`retrigger\` holds
-# \`actions: write\` but checks out and executes nothing — its only inputs
-# are the evaluator's outputs, resolved via \`gh pr view\` before any repo
-# content ran. A malicious branch can at worst fail its own evaluation.
+# Privilege split, deliberate: \`evaluate\` executes only the default branch's
+# trusted gate code and holds NO write permission; \`retrigger\` holds
+# \`actions: write\` but checks out and executes nothing. Neither job checks
+# out or executes pull-request content.
 name: Vinaya Review Gate (on verdict)
 
 on:
@@ -1349,38 +1606,36 @@ jobs:
       pull-requests: read
       issues: read
     outputs:
-      branch: \${{ steps.pr.outputs.branch }}
+      number: \${{ steps.pr.outputs.number }}
       sha: \${{ steps.pr.outputs.sha }}
     steps:
-      # issue_comment payloads carry no PR head SHA/branch — resolve them
-      # before checkout, and check out that exact commit (the event's default
-      # ref is the repo's default branch, not the PR head).
+      # issue_comment payloads carry no PR head SHA — resolve it for immutable
+      # run identity only. It never selects executable code.
       - name: Resolve PR head
         id: pr
         env:
           GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
         run: |
           NUMBER="\${{ github.event.issue.number }}"
-          BRANCH=$(gh pr view "$NUMBER" --repo "\${{ github.repository }}" --json headRefName -q .headRefName)
           SHA=$(gh pr view "$NUMBER" --repo "\${{ github.repository }}" --json headRefOid -q .headRefOid)
           echo "number=$NUMBER" >> "$GITHUB_OUTPUT"
-          echo "branch=$BRANCH" >> "$GITHUB_OUTPUT"
           echo "sha=$SHA" >> "$GITHUB_OUTPUT"
       - uses: actions/checkout@v4
         with:
-          ref: \${{ steps.pr.outputs.sha }}
+          # issue_comment already sources workflows from the default branch;
+          # make the trusted code checkout explicit too.
+          ref: \${{ github.event.repository.default_branch }}
           persist-credentials: false
           fetch-depth: 0
       - uses: actions/setup-node@v4
         with:
           node-version: 20
-${vinayaSetupSteps(selfHost)}${adopterSetupStep(ciSetup)}      - name: Review gate (verdict evaluation)
+${vinayaSetupSteps(selfHost, "trusted")}      - name: Review gate (verdict evaluation)
         env:
           GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
           # Same wiring as the required workflow: PR_NUMBER is what makes
           # the adapter evaluate instead of no-op'ing as "local dev".
           PR_NUMBER: \${{ steps.pr.outputs.number }}
-          BRANCH: \${{ steps.pr.outputs.branch }}
         run: ${vinayaRun(selfHost, "check review-gate")}
 
   # Executes nothing; consumes only the evaluator's outputs.
@@ -1401,16 +1656,11 @@ ${vinayaSetupSteps(selfHost)}${adopterSetupStep(ciSetup)}      - name: Review ga
       - name: Re-run the required review gate for this branch
         env:
           GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
-          BRANCH: \${{ needs.evaluate.outputs.branch }}
+          PR_NUMBER: \${{ needs.evaluate.outputs.number }}
           HEAD_SHA: \${{ needs.evaluate.outputs.sha }}
         run: |
-          # \`--branch ""\` is NOT a no-op: gh drops the filter and lists runs
-          # across every branch, so the rerun would land on an unrelated PR's
-          # gate. Reachable now that this job runs on a failed evaluation —
-          # \`Resolve PR head\` is the only producer of this output, and its
-          # failure used to be unreachable from here.
-          if [ -z "$BRANCH" ]; then
-            echo "No branch resolved (the evaluate job failed before resolving it) - nothing to re-run."
+          if [ -z "$PR_NUMBER" ]; then
+            echo "No PR number resolved (the evaluate job failed before resolving it) - nothing to re-run."
             exit 0
           fi
           # Same guard, same producer: an empty SHA would make the selection
@@ -1420,43 +1670,28 @@ ${vinayaSetupSteps(selfHost)}${adopterSetupStep(ciSetup)}      - name: Review ga
             echo "No head SHA resolved (the evaluate job failed before resolving it) - nothing to re-run."
             exit 0
           fi
-          # Select by HEAD SHA, never by recency. "Newest completed" looks
-          # right and is not: \`--status completed\` excludes a run that is
-          # currently re-running but INCLUDES cancelled ones, so a verdict
-          # arriving while the current head's run is still in flight can
-          # select a stale cancelled sibling, rerun it, and — because the
-          # review workflow's concurrency group is keyed per pull request —
-          # cancel the live evaluation it was supposed to refresh.
-          #
-          # The run for this head SHA is the only one whose conclusion gates
-          # the merge; runs for earlier commits are scoped to those commits
-          # and never gate the current head. Cancelled runs are excluded for
-          # the same reason, not a mechanical one — a rerun with nothing else
-          # in its group completes normally. A cancellation here means the
-          # \`opened\`+\`labeled\` collapse discarded that run in favour of a
-          # sibling on the same commit, and it is the survivor whose
-          # conclusion the merge box reads.
-          # \`--commit\` filters server-side, deliberately. gh's \`--jq\` is a
-          # single-expression flag of its own, NOT a passthrough to jq, so jq's
-          # variable-binding flag cannot be used with it: pflag swallows that
-          # flag as the expression and gh exits 1 on the stray token — which
-          # under \`bash -e\` kills the step before the empty-RUN_ID no-op can
-          # run, so every verdict reddens and nothing reruns. Filter on the
-          # server and keep the jq expression free of variables.
-          RUN_ID=$(gh run list --repo "\${{ github.repository }}" \\
-            --workflow vinaya-review.yml --branch "$BRANCH" \\
-            --commit "$HEAD_SHA" \\
-            --json databaseId,event,status,conclusion \\
-            --jq '[.[]
-                 | select(.event=="pull_request")
-                 | select(.status=="completed")
-                 | select(.conclusion!="cancelled")]
-               | .[0].databaseId // empty')
+          # pull_request_target runs execute at the DEFAULT branch SHA, so a
+          # run's head_sha cannot identify the PR commit. GitHub's nested
+          # pull_requests snapshot is also not immutable: an old rerun can
+          # expose the PR's current head. The required workflow therefore
+          # records PR number + head SHA in run-name at creation, and this
+          # query matches that immutable display_title exactly.
+          set -o pipefail
+          RUN_TITLE="Vinaya Review Gate PR #$PR_NUMBER @ $HEAD_SHA"
+          RUN_ID=$(gh api --paginate \\
+            "repos/\${{ github.repository }}/actions/workflows/vinaya-review.yml/runs?event=pull_request_target&per_page=100" \\
+            | jq -sr --arg title "$RUN_TITLE" '
+                [.[].workflow_runs[]
+                 | select(.display_title == $title)
+                 | select(.event == "pull_request_target")
+                 | select(.status == "completed")
+                 | select(.conclusion != "cancelled")
+                 | .id][0] // empty')
           if [ -z "$RUN_ID" ]; then
-            echo "No completed, non-cancelled pull_request run of vinaya-review.yml for $HEAD_SHA - nothing to re-run."
+            echo "No completed, non-cancelled pull_request_target run of vinaya-review.yml for PR #$PR_NUMBER at $HEAD_SHA - nothing to re-run."
             exit 0
           fi
-          echo "Re-running vinaya-review.yml run $RUN_ID for $HEAD_SHA"
+          echo "Re-running vinaya-review.yml run $RUN_ID for PR #$PR_NUMBER at $HEAD_SHA"
           # Two verdict comments landing together run two retriggers in
           # parallel (this workflow has no concurrency group, deliberately —
           # a queued retrigger is a delayed one). Both can select the same
@@ -1697,6 +1932,13 @@ var BRANCH_PROTECTION_NOTE = `Recommended (run yourself — vinaya never applies
     -F required_status_checks.strict=true \\
     -F 'required_status_checks.contexts[]=vinaya-checks' \\
     -F enforce_admins=true -F restrictions=`;
+var CODEOWNERS_NOTE = `Recommended: require review on vinaya's own workflow files.
+
+  echo '/.github/workflows/** @your-github-login' >> .github/CODEOWNERS
+
+Then add this flag to the branch-protection command above:
+
+  -F required_pull_request_reviews.require_code_owner_reviews=true`;
 function buildInitOps(ctx) {
   const ops = [];
   const hookMode = 493;
@@ -1709,13 +1951,13 @@ function buildInitOps(ctx) {
   ops.push({
     kind: "create-file",
     path: REVIEW_WORKFLOW_PATH,
-    content: reviewWorkflow(ctx.selfHost, ctx.ciSetup),
+    content: reviewWorkflow(ctx.selfHost),
     group: "CI workflows"
   });
   ops.push({
     kind: "create-file",
     path: REVIEW_VERDICT_WORKFLOW_PATH,
-    content: reviewVerdictWorkflow(ctx.selfHost, ctx.ciSetup),
+    content: reviewVerdictWorkflow(ctx.selfHost),
     group: "CI workflows"
   });
   ops.push({
@@ -1724,6 +1966,12 @@ function buildInitOps(ctx) {
     content: archivistWorkflow(ctx.selfHost),
     group: "CI workflows"
   });
+  ops.push({
+    kind: "create-file",
+    path: BODY_CHECKS_WORKFLOW_PATH,
+    content: bodyChecksWorkflow(ctx.selfHost),
+    group: "CI workflows"
+  });
   ops.push({
     kind: "managed-block",
     path: `${ctx.hookDir}/pre-commit`,
@@ -1774,6 +2022,7 @@ function buildInitOps(ctx) {
   });
   ops.push(...labelOps());
   ops.push({ kind: "print", message: BRANCH_PROTECTION_NOTE, group: "Branch protection (printed, never applied)" });
+  ops.push({ kind: "print", message: CODEOWNERS_NOTE, group: "Branch protection (printed, never applied)" });
   return ops;
 }
 function buildInitProductOps(name) {
@@ -1923,6 +2172,7 @@ var VinayaConfigSchema = z.object({
   briefSchema: BriefSchemaSchema.optional(),
   managed: ManagedManifestSchema.optional(),
   principals: z.array(z.string()).min(1).optional(),
+  releaseActor: z.string().min(1).optional(),
   ci: z.object({ setup: z.string().min(1) }).optional(),
   blastRadius: z.object({ extraDomains: z.array(z.string()).optional() }).optional()
 });
@@ -1957,6 +2207,9 @@ function globalChecksIgnoredWarning(path) {
 function globalPrincipalsIgnoredWarning(path) {
   return `${path}: "principals" in the global config is ignored — principals may only be declared from a repo-local vinaya.config.json.`;
 }
+function globalReleaseActorIgnoredWarning(path) {
+  return `${path}: "releaseActor" in the global config is ignored — releaseActor may only be declared from a repo-local vinaya.config.json.`;
+}
 function stripGlobalOnlyKeys(config, path) {
   if (path !== GLOBAL_CONFIG_PATH)
     return config;
@@ -1969,6 +2222,10 @@ function stripGlobalOnlyKeys(config, path) {
     console.error(`⚠ ${globalPrincipalsIgnoredWarning(path)}`);
     result = { ...result, principals: undefined };
   }
+  if (result.releaseActor) {
+    console.error(`⚠ ${globalReleaseActorIgnoredWarning(path)}`);
+    result = { ...result, releaseActor: undefined };
+  }
   return result;
 }
 function resolvePrincipalAllowlist(config) {
@@ -2016,7 +2273,7 @@ function isMissingFileError(err) {
   return /\b404\b|not found/i.test(haystack);
 }
 function loadTrustAnchorConfig(fetcher = ghFetchTrustAnchorConfig) {
-  const warn = (why) => process.stdout.write(`⚠ could not read \`principals\` from the default branch (${why}) — falling back to vinaya's built-in principal allowlist.
+  const warn = (why) => process.stdout.write(`⚠ could not read the trust-anchor config (\`principals\`/\`releaseActor\`) from the default branch (${why}) — falling back to vinaya's built-in defaults.
 `);
   let base64;
   try {
@@ -3244,6 +3501,21 @@ function coreCheckRegistry() {
         BRANCH: { optional: true }
       }
     },
+    {
+      name: "body-bare-digits",
+      run: bin("check-body-bare-digits"),
+      scope: "diff",
+      timeoutMs: 15000,
+      requiresOpenPr: true,
+      ownWorkflow: true,
+      env: {
+        PR_BODY: { optional: true },
+        PR_NUMBER: { optional: true },
+        GITHUB_REPOSITORY: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
     {
       name: "no-disk-state",
       run: bin("check-no-disk-state"),
@@ -3269,7 +3541,6 @@ function coreCheckRegistry() {
       timeoutMs: 30000,
       ownWorkflow: true,
       env: {
-        BRANCH: { optional: true },
         PR_NUMBER: { optional: true },
         GITHUB_REPOSITORY: { optional: true },
         GITHUB_TOKEN: { optional: true },
@@ -3981,12 +4252,12 @@ Test Plan: unit-tests-only
 ## Stop Conditions
 Autonomy: Do not stop to ask clarifying questions — this is a scripted demo; proceed and clean up automatically.
 
-Illustrative Step 0 (never actually run by this demo):
+Illustrative \`Step 0\` (never actually run by this demo):
 \`\`\`
 git worktree add .worktrees/demo-fixture -b demo/fixture origin/main
 \`\`\`
 
-Closes #0 (fixture value — no real Issue; discarded with the demo branch)
+Closes \`#0\` (fixture value — no real Issue; discarded with the demo branch)
 `;
 }
 function cleanup(repoRoot, originalBranch, demoBranch, statePath) {
@@ -4524,6 +4795,25 @@ async function diagnoseBranchProtection(deps, owner, repo) {
   }
   return info("branch-protection", "main branch protection could not be determined (no gh auth, no remote, or a permission gap).");
 }
+function coversWorkflowsDir(pattern) {
+  const bare = pattern.replace(/\*+$/, "").replace(/\/+$/, "");
+  return bare === ".github/workflows" || bare === "/.github/workflows";
+}
+function diagnoseCodeowners(repoRoot) {
+  const path = join9(repoRoot, ".github", "CODEOWNERS");
+  if (!existsSync8(path)) {
+    return info("codeowners", "no .github/CODEOWNERS — vinaya's workflow files have no required-review protection; see `vinaya init`'s printed recommendation.");
+  }
+  let body;
+  try {
+    body = readFileSync8(path, "utf-8");
+  } catch (err) {
+    return warn("codeowners", `.github/CODEOWNERS exists but could not be read: ${err.message}`);
+  }
+  const covered = body.split(`
+`).map((line) => line.trim()).filter((line) => line && !line.startsWith("#")).some((line) => coversWorkflowsDir(line.split(/\s+/)[0] ?? ""));
+  return covered ? info("codeowners", ".github/CODEOWNERS covers .github/workflows/**.") : warn("codeowners", ".github/CODEOWNERS exists but has no entry covering .github/workflows/** — workflow file edits can merge unreviewed.");
+}
 var TEST_INVOCATION_SUBSTRINGS = ["npm test", "npm run test", "bun test", "bunx turbo test"];
 function diagnoseTestCi(repoRoot) {
   let pkg;
@@ -4608,6 +4898,7 @@ async function runDoctor(args, deps) {
   findings.push(...diagnoseGlobalConfigChecks());
   findings.push(...await diagnoseEnvironment(deps, hasDrift));
   findings.push(await diagnoseBranchProtection(deps, repo.owner, repo.repo));
+  findings.push(diagnoseCodeowners(repo.repoRoot));
   findings.push(...diagnoseTestCi(repo.repoRoot));
   const healthy = findings.every((f) => f.severity === "ok" || f.severity === "info");
   if (jsonOutput) {
@@ -4622,8 +4913,9 @@ async function doctorCommand(args) {
 }
 
 // src/commands/doctrine.ts
-import { existsSync as existsSync9, readdirSync as readdirSync4 } from "node:fs";
+import { existsSync as existsSync9, readdirSync as readdirSync4, readFileSync as readFileSync9 } from "node:fs";
 import { dirname as dirname4, join as join10, sep as sep3 } from "node:path";
+import matter2 from "gray-matter";
 var ENTRY_SEGMENTS = ["skills", "aeg", "SKILL.md"];
 function resolveDoctrineRoot(pkg = packageRoot(import.meta.url)) {
   const candidates = [join10(pkg, "aeg-root")];
@@ -4639,7 +4931,10 @@ function listRoleNames(root) {
   const rolesDir = join10(root, "roles");
   if (!existsSync9(rolesDir))
     return [];
-  return readdirSync4(rolesDir).filter((name) => name.endsWith(".md")).map((name) => name.slice(0, -".md".length)).sort();
+  return readdirSync4(rolesDir).filter((name) => name.endsWith(".md")).map((name) => name.slice(0, -".md".length)).filter((roleName) => {
+    const { data } = matter2(readFileSync9(join10(rolesDir, `${roleName}.md`), "utf8"));
+    return data.actor !== "human";
+  }).sort();
 }
 function doctrineCommand(args) {
   const root = resolveDoctrineRoot();
@@ -4676,7 +4971,7 @@ function doctrineCommand(args) {
 }
 
 // src/commands/eject.ts
-import { existsSync as existsSync10, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync10 } from "node:fs";
 import { join as join11 } from "node:path";
 function realDeps4() {
   return {
@@ -4699,7 +4994,7 @@ function readManifest(repoRoot) {
     return { kind: "none" };
   let raw;
   try {
-    raw = JSON.parse(readFileSync9(p, "utf-8"));
+    raw = JSON.parse(readFileSync10(p, "utf-8"));
   } catch (err) {
     return { kind: "orphan", reason: `vinaya.config.json is not valid JSON: ${err.message}` };
   }
@@ -4789,11 +5084,11 @@ async function ejectCommand(args) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync12, readFileSync as readFileSync11, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync12, writeFileSync as writeFileSync5 } from "node:fs";
 import { join as join13 } from "node:path";
 
 // src/lib/registry-write.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname5, join as join12 } from "node:path";
 var PROJECTS_REGISTRY_PATH = ".vinaya/projects.md";
 function rowLine(name, path, specsPath) {
@@ -4864,7 +5159,7 @@ function planRegistryRow(repoRoot, name, path, specsPath) {
   if (!existsSync11(abs2)) {
     return { action: "create-host", rowLine: line, path: PROJECTS_REGISTRY_PATH };
   }
-  const existing = readFileSync10(abs2, "utf-8");
+  const existing = readFileSync11(abs2, "utf-8");
   const already = parseRegistry(existing).some((p) => p.name === name);
   return { action: already ? "skip-present" : "append-row", rowLine: line, path: PROJECTS_REGISTRY_PATH };
 }
@@ -4874,7 +5169,7 @@ function applyRegistryRow(repoRoot, plan, name, path, specsPath) {
     mkdirSync3(dirname5(abs2), { recursive: true });
     writeFileSync4(abs2, freshProjectsRegistry(name, path, specsPath), "utf-8");
   } else if (plan.action === "append-row") {
-    const existing = readFileSync10(abs2, "utf-8");
+    const existing = readFileSync11(abs2, "utf-8");
     writeFileSync4(abs2, appendRegistryRow(existing, name, path, specsPath), "utf-8");
   }
 }
@@ -4913,14 +5208,14 @@ function readManifest2(repoRoot) {
   if (!existsSync12(p))
     return null;
   try {
-    return VinayaConfigSchema.parse(JSON.parse(readFileSync11(p, "utf-8"))).managed ?? null;
+    return VinayaConfigSchema.parse(JSON.parse(readFileSync12(p, "utf-8"))).managed ?? null;
   } catch {
     return null;
   }
 }
 function writeManifest(repoRoot, manifest) {
   const configAbs = join13(repoRoot, CONFIG_PATH);
-  const seed = JSON.parse(readFileSync11(configAbs, "utf-8"));
+  const seed = JSON.parse(readFileSync12(configAbs, "utf-8"));
   writeFileSync5(configAbs, `${JSON.stringify({ ...seed, managed: manifest }, null, 2)}
 `, "utf-8");
 }
@@ -5082,11 +5377,12 @@ async function initProductCommand(args) {
 }
 
 // src/commands/issue.ts
-import { execFileSync as execFileSync9 } from "node:child_process";
+import { execFileSync as execFileSync10 } from "node:child_process";
 
 // src/lib/forge-write.ts
-import { mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "node:fs";
-import { readFileSync as readFileSync12 } from "node:fs";
+import { execFileSync as execFileSync9 } from "node:child_process";
+import { existsSync as existsSync13, mkdtempSync, readdirSync as readdirSync5, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { readFileSync as readFileSync13 } from "node:fs";
 import { tmpdir } from "node:os";
 import { join as join14 } from "node:path";
 class ForgeArgError extends Error {
@@ -5098,13 +5394,13 @@ function locateBody(args) {
       const p = args[i + 1];
       if (!p)
         throw new ForgeArgError("`--body-file` was given with no path.");
-      return { body: readFileSync12(p, "utf8"), source: { kind: "file", argIndex: i + 1, inlineForm: false } };
+      return { body: readFileSync13(p, "utf8"), source: { kind: "file", argIndex: i + 1, inlineForm: false } };
     }
     if (a.startsWith("--body-file=")) {
       const p = a.slice("--body-file=".length);
       if (!p)
         throw new ForgeArgError("`--body-file=` was given with no path.");
-      return { body: readFileSync12(p, "utf8"), source: { kind: "file", argIndex: i, inlineForm: true } };
+      return { body: readFileSync13(p, "utf8"), source: { kind: "file", argIndex: i, inlineForm: true } };
     }
     if (a === "--body" || a === "-b") {
       const v = args[i + 1];
@@ -5288,6 +5584,86 @@ function validateForgeWrite(input) {
   }
   return errors;
 }
+function git2(args) {
+  try {
+    return execFileSync9("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+  } catch {
+    return "";
+  }
+}
+function repoRoot() {
+  return git2(["rev-parse", "--show-toplevel"]);
+}
+function readWorkspaceGlobs(root) {
+  const fromPackageJson = () => {
+    try {
+      const pkg = JSON.parse(readFileSync13(join14(root, "package.json"), "utf8"));
+      return Array.isArray(pkg.workspaces) ? pkg.workspaces.filter((w) => typeof w === "string") : [];
+    } catch {
+      return [];
+    }
+  };
+  const fromPnpmWorkspaceYaml = () => {
+    try {
+      return parsePnpmWorkspaceYaml(readFileSync13(join14(root, "pnpm-workspace.yaml"), "utf8"));
+    } catch {
+      return [];
+    }
+  };
+  return [...fromPackageJson(), ...fromPnpmWorkspaceYaml()];
+}
+function listWorkspaceChildDirs(dir, root) {
+  try {
+    return readdirSync5(join14(root, dir), { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    return [];
+  }
+}
+function readConfigExtraDomains(root) {
+  try {
+    const parsed = VinayaConfigSchema.safeParse(JSON.parse(readFileSync13(join14(root, "vinaya.config.json"), "utf8")));
+    return parsed.success ? parsed.data.blastRadius?.extraDomains ?? [] : [];
+  } catch {
+    return [];
+  }
+}
+function readSharedPackages(root = repoRoot()) {
+  if (!root)
+    return [];
+  const derived = deriveWorkspacePackageDomains(readWorkspaceGlobs(root), (dir) => listWorkspaceChildDirs(dir, root));
+  const defaults = deriveBuiltinCrossCuttingDefaults((p) => existsSync13(join14(root, p)));
+  const configExtra = readConfigExtraDomains(root);
+  return [...new Set([...derived, ...defaults, ...configExtra])];
+}
+function readProjectPaths(root = repoRoot()) {
+  if (!root)
+    return [];
+  try {
+    return parseRegistry(readFileSync13(join14(root, ".vinaya/projects.md"), "utf8"));
+  } catch {
+    return [];
+  }
+}
+var CHECK_ISSUE_CONTENT = "issue-content";
+var ISSUE_CONTENT_RECOVERY = {
+  blastRadius: "Add a second registered `Project(s)` this task also touches, or a `blast-radius-ack: <why one lens is enough>` line, then re-run `{cmd}`.",
+  noBriefContent: "Move the brief-shaped section named above out of the Issue body and into the brief — the Issue carries the Planner's durable rationale, not the brief's just-in-time surface — then re-run `{cmd}`.",
+  rationaleNamesDocs: 'Name a concrete doc/skill path (e.g. `aeg-root/…`, `.claude/skills/…/SKILL.md`) in "Docs to keep coherent" or "Traps", or write the `no-doc-surface` sentinel if the surface genuinely has none, then re-run `{cmd}`.'
+};
+function validateIssueContent(input) {
+  const findings = [
+    [checkBlastRadiusScope(input.body, input.labels, input.sharedPackages, input.projectPaths).errors, "blastRadius"],
+    [checkNoBriefContent(input.body).errors, "noBriefContent"],
+    [checkRationaleNamesDocs(input.body).errors, "rationaleNamesDocs"]
+  ];
+  const errors = [];
+  for (const [messages, kind] of findings) {
+    const recovery = ISSUE_CONTENT_RECOVERY[kind].replace("{cmd}", input.retryCommand);
+    for (const message of messages)
+      errors.push(makeCheckError(CHECK_ISSUE_CONTENT, message, recovery));
+  }
+  return errors;
+}
 
 // src/commands/issue.ts
 var RETRY_CREATE = "vinaya issue create --validate-only …";
@@ -5305,7 +5681,7 @@ function locateBodyOrRefuse(ghArgs, retryCommand) {
 function fetchForgeLabels(issueRef) {
   let out;
   try {
-    out = execFileSync9("gh", ["issue", "view", issueRef, "--json", "labels"], {
+    out = execFileSync10("gh", ["issue", "view", issueRef, "--json", "labels"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -5333,7 +5709,7 @@ function reportPass(json, command) {
 function runGhWrite(ghCmd, ghArgs, bodyResult, json) {
   const { finalArgs, cleanup: cleanup2 } = resolveShippableArgs(ghArgs, bodyResult);
   try {
-    const out = execFileSync9("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
+    const out = execFileSync10("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
     const url = out.trim();
     if (json)
       printJson({ validated: true, written: true, url });
@@ -5344,22 +5720,31 @@ function runGhWrite(ghCmd, ghArgs, bodyResult, json) {
     cleanup2();
   }
 }
-function validateTaskIssue(body, title, retryCommand) {
+function validateTaskIssue(body, title, labels, retryCommand) {
   if (body === null) {
     refuse([
       makeCheckError("forge-args", "A task Issue (a `vinaya/tranche:*` label) requires a `--body-file <path>` so the rationale gate can validate it.", `Add \`--body-file <path>\`, then re-run \`${retryCommand}\`.`)
     ]);
   }
   const sections = resolveSections("issue", retryCommand);
-  const errors = validateForgeWrite({
+  const schemaErrors = validateForgeWrite({
     body,
     title,
     sections,
     changedFiles: [],
     retryCommand
   });
-  if (errors.length > 0)
-    refuse(errors);
+  if (schemaErrors.length > 0)
+    refuse(schemaErrors);
+  const contentErrors = validateIssueContent({
+    body,
+    labels,
+    sharedPackages: readSharedPackages(),
+    projectPaths: readProjectPaths(),
+    retryCommand
+  });
+  if (contentErrors.length > 0)
+    refuse(contentErrors);
 }
 function issueCreateCommand(args) {
   const json = args.includes("--json");
@@ -5370,7 +5755,7 @@ function issueCreateCommand(args) {
   const title = extractTitle(ghArgs);
   const labels = extractLabels(ghArgs);
   if (isTaskIssueLabelSet(labels)) {
-    validateTaskIssue(body, title, RETRY_CREATE);
+    validateTaskIssue(body, title, labels, RETRY_CREATE);
   }
   if (validateOnly) {
     reportPass(json, "issue create");
@@ -5394,7 +5779,7 @@ function issueEditCommand(args) {
   const title = extractTitle(ghArgs);
   const labels = [...new Set([...fetchForgeLabels(issueRef), ...extractLabels(ghArgs)])];
   if (isTaskIssueLabelSet(labels)) {
-    validateTaskIssue(body, title, RETRY_EDIT);
+    validateTaskIssue(body, title, labels, RETRY_EDIT);
   }
   if (validateOnly) {
     reportPass(json, "issue edit");
@@ -5404,7 +5789,7 @@ function issueEditCommand(args) {
 }
 
 // src/commands/new-check.ts
-import { chmodSync as chmodSync2, existsSync as existsSync13, mkdirSync as mkdirSync4, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "node:fs";
+import { chmodSync as chmodSync2, existsSync as existsSync14, mkdirSync as mkdirSync4, readFileSync as readFileSync14, writeFileSync as writeFileSync7 } from "node:fs";
 import { join as join15 } from "node:path";
 var TEMPLATE_PATH = join15(packageRoot(import.meta.url), "templates", "custom-check.template.ts");
 var CHECKS_DIR = join15("scripts", "vinaya-checks");
@@ -5425,15 +5810,15 @@ function newCheckCommand(args) {
     process.exit(2);
   }
   const scriptsDir = join15(process.cwd(), CHECKS_DIR);
-  if (!existsSync13(scriptsDir))
+  if (!existsSync14(scriptsDir))
     mkdirSync4(scriptsDir, { recursive: true });
   const fileStem = name.slice(name.indexOf("/") + 1);
   const targetPath = join15(scriptsDir, `${fileStem}.ts`);
-  if (existsSync13(targetPath)) {
+  if (existsSync14(targetPath)) {
     console.error(`Error: ${targetPath} already exists.`);
     process.exit(1);
   }
-  const template = readFileSync13(TEMPLATE_PATH, "utf-8");
+  const template = readFileSync14(TEMPLATE_PATH, "utf-8");
   const contents = template.split("{{CHECK_NAME}}").join(name);
   writeFileSync7(targetPath, contents, "utf-8");
   chmodSync2(targetPath, 493);
@@ -5447,21 +5832,21 @@ ${registration}
 }
 
 // src/commands/pr.ts
-import { execFileSync as execFileSync10 } from "node:child_process";
+import { execFileSync as execFileSync11 } from "node:child_process";
 var RETRY_CREATE2 = "vinaya pr create --validate-only …";
 var RETRY_EDIT2 = "vinaya pr edit <n> --validate-only …";
-function git2(args) {
+function git3(args) {
   try {
-    return execFileSync10("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync11("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return "";
   }
 }
 function localChangedFiles() {
   const base = process.env.BASE_SHA || "origin/main";
-  let out = git2(["diff", "--name-only", `${base}...HEAD`]);
+  let out = git3(["diff", "--name-only", `${base}...HEAD`]);
   if (!out)
-    out = git2(["diff", "--name-only", "main...HEAD"]);
+    out = git3(["diff", "--name-only", "main...HEAD"]);
   return out.split(`
 `).map((s) => s.trim()).filter(Boolean);
 }
@@ -5486,7 +5871,7 @@ function reportPass2(json, command) {
 function runGhWrite2(ghCmd, ghArgs, bodyResult, json) {
   const { finalArgs, cleanup: cleanup2 } = resolveShippableArgs(ghArgs, bodyResult);
   try {
-    const out = execFileSync10("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
+    const out = execFileSync11("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
     const url = out.trim();
     if (json)
       printJson({ validated: true, written: true, url });
@@ -5500,7 +5885,7 @@ function runGhWrite2(ghCmd, ghArgs, bodyResult, json) {
 function fetchPrForgeContext(prRef) {
   let viewOut;
   try {
-    viewOut = execFileSync10("gh", ["pr", "view", prRef, "--json", "headRefName,files"], {
+    viewOut = execFileSync11("gh", ["pr", "view", prRef, "--json", "headRefName,files"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -5539,8 +5924,8 @@ function prCreateCommand(args) {
   }
   const sections = resolveSections("pr", RETRY_CREATE2);
   const changedFiles2 = localChangedFiles();
-  const headCommit = git2(["rev-parse", "--verify", "--quiet", "HEAD"]);
-  const branch = headCommit === "" ? "" : git2(["symbolic-ref", "--quiet", "--short", "HEAD"]);
+  const headCommit = git3(["rev-parse", "--verify", "--quiet", "HEAD"]);
+  const branch = headCommit === "" ? "" : git3(["symbolic-ref", "--quiet", "--short", "HEAD"]);
   const errors = validateForgeWrite({
     body,
     title,
@@ -5602,14 +5987,14 @@ function prEditCommand(args) {
 }
 
 // src/commands/pr-report.ts
-import { execFileSync as execFileSync11, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync14, readFileSync as readFileSync14, writeFileSync as writeFileSync8 } from "node:fs";
+import { execFileSync as execFileSync12, spawnSync as spawnSync2 } from "node:child_process";
+import { existsSync as existsSync15, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "node:fs";
 import { join as join16 } from "node:path";
 var EVIDENCE_START = "<!-- AEG:EVIDENCE:START -->";
 var EVIDENCE_END = "<!-- AEG:EVIDENCE:END -->";
-function git3(args) {
+function git4(args) {
   try {
-    return execFileSync11("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync12("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return "";
   }
@@ -5627,7 +6012,7 @@ class GitCommandError extends Error {
 }
 function gitStrict(args) {
   try {
-    return execFileSync11("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync12("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (err) {
     const stderr = err.stderr;
     throw new GitCommandError(args, String(stderr ?? err.message).trim() || "non-zero exit");
@@ -5648,7 +6033,7 @@ function resolveMergeBase(head) {
   const primary = process.env.BASE_SHA || "origin/main";
   const tried = primary === "main" ? [primary] : [primary, "main"];
   for (const ref of tried) {
-    const base = git3(["merge-base", ref, head]);
+    const base = git4(["merge-base", ref, head]);
     if (base)
       return base;
   }
@@ -5663,7 +6048,7 @@ function computeGroupA() {
 function resolveSelfEntry() {
   const root = packageRoot(import.meta.url);
   const dist = join16(root, "dist", "index.js");
-  return existsSync14(dist) ? dist : join16(root, "src", "index.ts");
+  return existsSync15(dist) ? dist : join16(root, "src", "index.ts");
 }
 var FAILING_STATUSES = new Set(["fail", "error", "timeout"]);
 function anyGateFailed(outcomes) {
@@ -5768,7 +6153,7 @@ async function prReportCommand(args) {
     throw err;
   }
   if (writePath) {
-    const existing = existsSync14(writePath) ? readFileSync14(writePath, "utf8") : "";
+    const existing = existsSync15(writePath) ? readFileSync15(writePath, "utf8") : "";
     const updated = replaceEvidenceBlock(existing, result.blockInner);
     writeFileSync8(writePath, updated);
     process.stdout.write(`Wrote AEG:EVIDENCE block to ${writePath}
@@ -5781,12 +6166,12 @@ async function prReportCommand(args) {
 }
 
 // src/commands/quickstart.ts
-import { execFileSync as execFileSync12 } from "node:child_process";
-import { existsSync as existsSync16, readFileSync as readFileSync16 } from "node:fs";
+import { execFileSync as execFileSync13 } from "node:child_process";
+import { existsSync as existsSync17, readFileSync as readFileSync17 } from "node:fs";
 import { join as join18 } from "node:path";
 
 // src/lib/doc-owners-write.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync5, readFileSync as readFileSync15, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync5, readFileSync as readFileSync16, writeFileSync as writeFileSync9 } from "node:fs";
 import { dirname as dirname6, join as join17 } from "node:path";
 function bindingLine(glob, pointer) {
   return `${glob}  ${pointer}`;
@@ -5802,23 +6187,23 @@ function appendDocOwnersBinding(content, glob, pointer) {
   return `${content}${sep4}${bindingLine(glob, pointer)}
 `;
 }
-function planDocOwnersBinding(repoRoot, glob, pointer) {
-  const abs2 = join17(repoRoot, DOC_OWNERS_PATH);
+function planDocOwnersBinding(repoRoot2, glob, pointer) {
+  const abs2 = join17(repoRoot2, DOC_OWNERS_PATH);
   const line = bindingLine(glob, pointer);
-  if (!existsSync15(abs2)) {
+  if (!existsSync16(abs2)) {
     return { action: "create-host", line, path: DOC_OWNERS_PATH };
   }
-  const existing = readFileSync15(abs2, "utf-8");
+  const existing = readFileSync16(abs2, "utf-8");
   const already = parseDocOwners(existing).bindings.some((b) => b.glob === glob);
   return { action: already ? "skip-present" : "append-row", line, path: DOC_OWNERS_PATH };
 }
-function applyDocOwnersBinding(repoRoot, plan, glob, pointer) {
-  const abs2 = join17(repoRoot, DOC_OWNERS_PATH);
+function applyDocOwnersBinding(repoRoot2, plan, glob, pointer) {
+  const abs2 = join17(repoRoot2, DOC_OWNERS_PATH);
   if (plan.action === "create-host") {
     mkdirSync5(dirname6(abs2), { recursive: true });
     writeFileSync9(abs2, freshDocOwners(glob, pointer), "utf-8");
   } else if (plan.action === "append-row") {
-    const existing = readFileSync15(abs2, "utf-8");
+    const existing = readFileSync16(abs2, "utf-8");
     writeFileSync9(abs2, appendDocOwnersBinding(existing, glob, pointer), "utf-8");
   }
 }
@@ -5875,13 +6260,13 @@ var GLOB_INJECTION_RE = /[\s\r\n]/;
 var POINTER_INJECTION_RE = /[\r\n]/;
 var NAME_INJECTION_RE = /[\s|\r\n]/;
 var PATH_INJECTION_RE2 = /[|\r\n]/;
-function pointerIsMissingLocalFile(repoRoot, pointer) {
+function pointerIsMissingLocalFile(repoRoot2, pointer) {
   if (/^https?:\/\//i.test(pointer))
     return false;
   const path = pointer.split("#")[0] ?? pointer;
-  return !existsSync16(join18(repoRoot, path));
+  return !existsSync17(join18(repoRoot2, path));
 }
-async function bindDocOwnerLoop(deps, repoRoot) {
+async function bindDocOwnerLoop(deps, repoRoot2) {
   let any = false;
   for (;; ) {
     if (any && !await deps.confirm("Bind another doc→code pair?", false))
@@ -5896,11 +6281,11 @@ async function bindDocOwnerLoop(deps, repoRoot) {
     }
     if (GLOB_INJECTION_RE.test(glob) || POINTER_INJECTION_RE.test(pointer)) {
       console.error(red("Error: glob must not contain whitespace, and the pointer must not contain a newline."));
-    } else if (pointerIsMissingLocalFile(repoRoot, pointer)) {
+    } else if (pointerIsMissingLocalFile(repoRoot2, pointer)) {
       console.error(red(`✗ "${pointer}" does not exist in this repo (and isn't a URL).`));
     } else {
-      const plan = planDocOwnersBinding(repoRoot, glob, pointer);
-      applyDocOwnersBinding(repoRoot, plan, glob, pointer);
+      const plan = planDocOwnersBinding(repoRoot2, glob, pointer);
+      applyDocOwnersBinding(repoRoot2, plan, glob, pointer);
       process.stdout.write(`${green(renderDocOwnersBindingDiffLine(plan))}
 `);
       any = true;
@@ -5946,7 +6331,7 @@ async function registerProjectLoop(deps) {
   }
 }
 function readPackageVersion() {
-  const pkg = JSON.parse(readFileSync16(join18(packageRoot(import.meta.url), "package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync17(join18(packageRoot(import.meta.url), "package.json"), "utf-8"));
   return pkg.version;
 }
 function realDeps6() {
@@ -5976,8 +6361,8 @@ function realDeps6() {
     closeStdin
   };
 }
-function execGit(repoRoot, args) {
-  return execFileSync12("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+function execGit(repoRoot2, args) {
+  return execFileSync13("git", args, { cwd: repoRoot2, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 function errorDetail(err) {
   const stderr = err.stderr;
@@ -5985,31 +6370,31 @@ function errorDetail(err) {
     return stderr.toString().trim();
   return err instanceof Error ? err.message : String(err);
 }
-function gitStatusShort(repoRoot) {
-  return execGit(repoRoot, ["status", "--short"]);
+function gitStatusShort(repoRoot2) {
+  return execGit(repoRoot2, ["status", "--short"]);
 }
-function commitInstall(repoRoot) {
-  execGit(repoRoot, ["add", "-A"]);
-  const staged = execGit(repoRoot, ["diff", "--cached", "--stat"]);
+function commitInstall(repoRoot2) {
+  execGit(repoRoot2, ["add", "-A"]);
+  const staged = execGit(repoRoot2, ["diff", "--cached", "--stat"]);
   if (!staged)
     return { committed: false, message: "Nothing to commit — working tree already clean." };
   try {
-    execGit(repoRoot, ["commit", "-m", "Chore: install Vinaya"]);
+    execGit(repoRoot2, ["commit", "-m", "Chore: install Vinaya"]);
     return { committed: true, message: "✓ Committed `Chore: install Vinaya`." };
   } catch (err) {
     return { committed: false, message: `git commit failed: ${errorDetail(err)}` };
   }
 }
-function pushInstall(repoRoot) {
+function pushInstall(repoRoot2) {
   try {
-    const branch = execGit(repoRoot, ["symbolic-ref", "--short", "HEAD"]);
+    const branch = execGit(repoRoot2, ["symbolic-ref", "--short", "HEAD"]);
     let hasUpstream = true;
     try {
-      execGit(repoRoot, ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"]);
+      execGit(repoRoot2, ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"]);
     } catch {
       hasUpstream = false;
     }
-    execGit(repoRoot, hasUpstream ? ["push"] : ["push", "-u", "origin", branch]);
+    execGit(repoRoot2, hasUpstream ? ["push"] : ["push", "-u", "origin", branch]);
     return { pushed: true, message: "✓ Pushed." };
   } catch (err) {
     return { pushed: false, message: `git push failed: ${errorDetail(err)}` };
@@ -6094,8 +6479,8 @@ async function quickstartCommand(args) {
 }
 
 // src/commands/review-post.ts
-import { execFileSync as execFileSync13 } from "node:child_process";
-import { readFileSync as readFileSync17, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
+import { execFileSync as execFileSync14 } from "node:child_process";
+import { readFileSync as readFileSync18, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
 import { join as join19 } from "node:path";
 class FindingsParseError extends Error {
@@ -6258,7 +6643,7 @@ function readFindingsFile(path, allowedSeverities) {
     return [];
   let content;
   try {
-    content = readFileSync17(path, "utf8");
+    content = readFileSync18(path, "utf8");
   } catch {
     refuseCmd(`Could not read findings file at ${path}.`, "Check the path and re-run.");
   }
@@ -6289,7 +6674,7 @@ function normalizeSecurityVerdict(raw) {
 }
 function gh(args) {
   try {
-    return execFileSync13("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync14("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (err) {
     const stderr = err.stderr;
     throw new Error(String(stderr ?? err.message).trim() || "gh command failed");
@@ -6374,7 +6759,7 @@ async function reviewPostCommand(args) {
     let secretsEvidence = null;
     if (secretsEvidenceFile) {
       try {
-        secretsEvidence = readFileSync17(secretsEvidenceFile, "utf8");
+        secretsEvidence = readFileSync18(secretsEvidenceFile, "utf8");
       } catch {
         refuseCmd(`Could not read secrets evidence file at ${secretsEvidenceFile}.`, "Check the path and re-run.");
       }
@@ -6415,7 +6800,7 @@ Self-verification: clean — re-parsed VERDICT is bound to head ${headSha}.
 
 // src/commands/studio.ts
 import { execFile as execFile5, spawn as spawn2 } from "node:child_process";
-import { existsSync as existsSync17, readFileSync as readFileSync18, renameSync } from "node:fs";
+import { existsSync as existsSync18, readFileSync as readFileSync19, renameSync } from "node:fs";
 import net from "node:net";
 import { dirname as dirname7, join as join20 } from "node:path";
 import { promisify as promisify5 } from "node:util";
@@ -6435,15 +6820,15 @@ function resolveStudioTarget(cwd, moduleUrl = import.meta.url) {
   for (;; ) {
     const webDir = join20(dir, "apps", "vinaya-studio", "web");
     const pkgPath = join20(webDir, "package.json");
-    if (existsSync17(pkgPath)) {
+    if (existsSync18(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync18(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync19(pkgPath, "utf-8"));
         if (pkg.name === "@atta/vinaya-studio-web") {
           return { kind: "workspace", webDir };
         }
       } catch {}
     }
-    if (existsSync17(join20(dir, ".git")))
+    if (existsSync18(join20(dir, ".git")))
       break;
     const parent = dirname7(dir);
     if (parent === dir)
@@ -6451,7 +6836,7 @@ function resolveStudioTarget(cwd, moduleUrl = import.meta.url) {
     dir = parent;
   }
   const standaloneWebDir = join20(packageRoot(moduleUrl), "studio-standalone", "apps", "vinaya-studio", "web");
-  if (existsSync17(join20(standaloneWebDir, "server.js"))) {
+  if (existsSync18(join20(standaloneWebDir, "server.js"))) {
     return { kind: "package", packageDir: standaloneWebDir };
   }
   return { kind: "missing" };
@@ -6473,7 +6858,7 @@ function isPortFree(port) {
 function ensureStudioNodeModules(bundleRoot) {
   const real = join20(bundleRoot, "node_modules");
   const packed = join20(bundleRoot, STUDIO_NODE_MODULES_PACKED_DIRNAME);
-  if (!existsSync17(real) && existsSync17(packed)) {
+  if (!existsSync18(real) && existsSync18(packed)) {
     renameSync(packed, real);
   }
 }
@@ -6509,7 +6894,7 @@ async function runStudio(cwd, args, moduleUrl = import.meta.url) {
 }
 
 // src/commands/upgrade.ts
-import { existsSync as existsSync18, readFileSync as readFileSync19, rmSync as rmSync5, writeFileSync as writeFileSync11 } from "node:fs";
+import { existsSync as existsSync19, readFileSync as readFileSync20, rmSync as rmSync5, writeFileSync as writeFileSync11 } from "node:fs";
 import { join as join21 } from "node:path";
 function realDeps7() {
   return {
@@ -6527,13 +6912,13 @@ function realDeps7() {
 function flags2(args) {
   return { dryRun: args.includes("--dry-run"), yes: args.includes("--yes") };
 }
-function readManifest3(repoRoot) {
-  const p = join21(repoRoot, CONFIG_PATH);
-  if (!existsSync18(p))
+function readManifest3(repoRoot2) {
+  const p = join21(repoRoot2, CONFIG_PATH);
+  if (!existsSync19(p))
     return { kind: "missing" };
   let raw;
   try {
-    raw = JSON.parse(readFileSync19(p, "utf-8"));
+    raw = JSON.parse(readFileSync20(p, "utf-8"));
   } catch (err) {
     return { kind: "invalid", error: `invalid JSON: ${err.message}` };
   }
@@ -6548,31 +6933,31 @@ function readManifest3(repoRoot) {
     return { kind: "not-initialized" };
   return { kind: "ok", manifest: parsed.data.managed };
 }
-function writeManifestVersion(repoRoot, manifest) {
-  const configAbs = join21(repoRoot, CONFIG_PATH);
-  const seed = JSON.parse(readFileSync19(configAbs, "utf-8"));
+function writeManifestVersion(repoRoot2, manifest) {
+  const configAbs = join21(repoRoot2, CONFIG_PATH);
+  const seed = JSON.parse(readFileSync20(configAbs, "utf-8"));
   const updated = { ...manifest, version: MANAGED_MANIFEST_VERSION };
   writeFileSync11(configAbs, `${JSON.stringify({ ...seed, managed: updated }, null, 2)}
 `, "utf-8");
 }
-function stripFor(repoRoot, path, marker, comment) {
-  const abs2 = resolveManagedBlockPath(repoRoot, path);
-  if (!existsSync18(abs2))
+function stripFor(repoRoot2, path, marker, comment) {
+  const abs2 = resolveManagedBlockPath(repoRoot2, path);
+  if (!existsSync19(abs2))
     return { path, marker, comment, present: false, removesHost: false };
-  const stripped = stripBlockFromContent(readFileSync19(abs2, "utf-8"), marker, comment);
+  const stripped = stripBlockFromContent(readFileSync20(abs2, "utf-8"), marker, comment);
   if (stripped === null)
     return { path, marker, comment, present: false, removesHost: false };
   return { path, marker, comment, present: true, removesHost: blockStripLeavesEmpty(stripped) };
 }
-function planHookRouting(repoRoot, manifest, recorded, hooksPathValue) {
+function planHookRouting(repoRoot2, manifest, recorded, hooksPathValue) {
   const none = { target: recorded, strips: [], arm: false, migratesManifest: false, blockedReason: null };
   if (recorded === ".husky")
     return none;
   if (recorded === TRACKED_HOOK_DIR) {
-    const strips = manifest.blocks.filter((b) => b.path.startsWith(`${TRACKED_HOOK_DIR}/`)).map((b) => stripFor(repoRoot, `.git/hooks/${b.marker}`, b.marker, b.comment)).filter((s) => s.present);
+    const strips = manifest.blocks.filter((b) => b.path.startsWith(`${TRACKED_HOOK_DIR}/`)).map((b) => stripFor(repoRoot2, `.git/hooks/${b.marker}`, b.marker, b.comment)).filter((s) => s.present);
     if (hooksPathValue === TRACKED_HOOK_DIR)
       return { ...none, strips };
-    const foreign = foreignRawHooks(repoRoot);
+    const foreign = foreignRawHooks(repoRoot2);
     if (foreign.length > 0) {
       return {
         ...none,
@@ -6585,17 +6970,17 @@ function planHookRouting(repoRoot, manifest, recorded, hooksPathValue) {
   const legacy = manifest.blocks.filter((b) => b.path.startsWith(".git/hooks/"));
   const blocked = [];
   for (const b of legacy) {
-    const abs2 = resolveManagedBlockPath(repoRoot, b.path);
-    if (!existsSync18(abs2))
+    const abs2 = resolveManagedBlockPath(repoRoot2, b.path);
+    if (!existsSync19(abs2))
       continue;
-    const stripped = stripBlockFromContent(readFileSync19(abs2, "utf-8"), b.marker, b.comment);
+    const stripped = stripBlockFromContent(readFileSync20(abs2, "utf-8"), b.marker, b.comment);
     if (stripped === null)
       blocked.push(`${b.path} exists without vinaya's managed block`);
     else if (!blockStripLeavesEmpty(stripped))
       blocked.push(`${b.path} carries your own lines alongside the managed block`);
   }
   const legacyNames = new Set(legacy.map((b) => b.path.slice(".git/hooks/".length)));
-  for (const f of activeRawHooks(repoRoot)) {
+  for (const f of activeRawHooks(repoRoot2)) {
     if (!legacyNames.has(f))
       blocked.push(`.git/hooks/${f} is an active raw hook vinaya does not manage`);
   }
@@ -6603,7 +6988,7 @@ function planHookRouting(repoRoot, manifest, recorded, hooksPathValue) {
     return { ...none, blockedReason: blocked.join("; ") };
   return {
     target: TRACKED_HOOK_DIR,
-    strips: legacy.map((b) => stripFor(repoRoot, b.path, b.marker, b.comment)).filter((s) => s.present),
+    strips: legacy.map((b) => stripFor(repoRoot2, b.path, b.marker, b.comment)).filter((s) => s.present),
     arm: hooksPathValue !== TRACKED_HOOK_DIR,
     migratesManifest: true,
     blockedReason: null
@@ -6615,7 +7000,7 @@ function translateHookPaths(manifest) {
     blocks: manifest.blocks.map((b) => b.path.startsWith(".git/hooks/") ? { ...b, path: `${TRACKED_HOOK_DIR}/${b.path.slice(".git/hooks/".length)}` } : b)
   };
 }
-function planUpgrade(ops, repoRoot, manifest, routing) {
+function planUpgrade(ops, repoRoot2, manifest, routing) {
   const entries = [];
   let hasChanges = routing.arm || routing.migratesManifest || routing.strips.some((s) => s.present);
   const ownedFiles = new Set(manifest.files);
@@ -6623,8 +7008,8 @@ function planUpgrade(ops, repoRoot, manifest, routing) {
   const ownedBlocks = new Set(manifest.blocks.map((b) => blockKey(b.path, b.marker)));
   for (const op of ops) {
     if (op.kind === "create-file") {
-      const abs2 = join21(repoRoot, op.path);
-      const exists = existsSync18(abs2);
+      const abs2 = join21(repoRoot2, op.path);
+      const exists = existsSync19(abs2);
       const owned = ownedFiles.has(op.path);
       let action;
       if (op.path === CONFIG_PATH || op.path === DOC_OWNERS_PATH) {
@@ -6634,7 +7019,7 @@ function planUpgrade(ops, repoRoot, manifest, routing) {
       } else if (!exists) {
         action = "recreate";
         hasChanges = true;
-      } else if (readFileSync19(abs2, "utf-8") !== op.content) {
+      } else if (readFileSync20(abs2, "utf-8") !== op.content) {
         action = "regenerate";
         hasChanges = true;
       } else {
@@ -6642,16 +7027,16 @@ function planUpgrade(ops, repoRoot, manifest, routing) {
       }
       entries.push({ kind: "create-file", op, action });
     } else if (op.kind === "managed-block") {
-      const abs2 = resolveManagedBlockPath(repoRoot, op.path);
+      const abs2 = resolveManagedBlockPath(repoRoot2, op.path);
       const owned = ownedBlocks.has(blockKey(op.path, op.marker));
       let action;
       if (!owned) {
         action = "not-installed";
-      } else if (!existsSync18(abs2)) {
+      } else if (!existsSync19(abs2)) {
         action = "recreate-host";
         hasChanges = true;
       } else {
-        const content = readFileSync19(abs2, "utf-8");
+        const content = readFileSync20(abs2, "utf-8");
         const { begin, end } = markerLines(op.marker, op.comment);
         if (!(content.includes(begin) && content.includes(end))) {
           action = "recreate-append";
@@ -6749,39 +7134,39 @@ function renderUpgradeDiff(plan) {
   return lines.join(`
 `);
 }
-function regenerateBlock(repoRoot, op) {
-  const abs2 = resolveManagedBlockPath(repoRoot, op.path);
-  const content = readFileSync19(abs2, "utf-8");
+function regenerateBlock(repoRoot2, op) {
+  const abs2 = resolveManagedBlockPath(repoRoot2, op.path);
+  const content = readFileSync20(abs2, "utf-8");
   const stripped = stripBlockFromContent(content, op.marker, op.comment);
   if (stripped !== null) {
     writeFileSync11(abs2, stripped.endsWith(`
 `) ? stripped : `${stripped}
 `, "utf-8");
   }
-  appendBlock(repoRoot, op);
+  appendBlock(repoRoot2, op);
 }
-function applyUpgrade(plan, repoRoot) {
+function applyUpgrade(plan, repoRoot2) {
   for (const e of plan.entries) {
     if (e.kind === "create-file") {
       if (e.action === "regenerate" || e.action === "recreate") {
-        writeFileWithDirs(join21(repoRoot, e.op.path), e.op.content, e.op.mode);
+        writeFileWithDirs(join21(repoRoot2, e.op.path), e.op.content, e.op.mode);
       }
     } else {
       if (e.action === "recreate-host")
-        createHost(repoRoot, e.op);
+        createHost(repoRoot2, e.op);
       else if (e.action === "recreate-append")
-        appendBlock(repoRoot, e.op);
+        appendBlock(repoRoot2, e.op);
       else if (e.action === "regenerate-block")
-        regenerateBlock(repoRoot, e.op);
+        regenerateBlock(repoRoot2, e.op);
     }
   }
   for (const s of plan.routing.strips) {
     if (!s.present)
       continue;
-    const abs2 = resolveManagedBlockPath(repoRoot, s.path);
-    if (!existsSync18(abs2))
+    const abs2 = resolveManagedBlockPath(repoRoot2, s.path);
+    if (!existsSync19(abs2))
       continue;
-    const stripped = stripBlockFromContent(readFileSync19(abs2, "utf-8"), s.marker, s.comment);
+    const stripped = stripBlockFromContent(readFileSync20(abs2, "utf-8"), s.marker, s.comment);
     if (stripped === null)
       continue;
     if (blockStripLeavesEmpty(stripped))
@@ -6869,12 +7254,12 @@ async function upgradeCommand(args) {
 }
 
 // src/commands/waiver.ts
-import { execFileSync as execFileSync14 } from "node:child_process";
+import { execFileSync as execFileSync15 } from "node:child_process";
 function labelFor(kind) {
   return kind === "docs" ? WAIVER_LABEL : WAIVER_LABEL_REVIEW;
 }
 function gh2(args) {
-  return execFileSync14("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: process.env }).trim();
+  return execFileSync15("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: process.env }).trim();
 }
 function detectPrNumber() {
   try {
@@ -6974,8 +7359,8 @@ Reason: ${reason}`];
   }
   process.stdout.write(`Applying \`${label2}\` to PR #${prNumber} under your authenticated \`gh\` identity — vinaya never fabricates an actor.
 `);
-  execFileSync14("gh", editArgs, { stdio: "inherit", env: process.env });
-  execFileSync14("gh", commentArgs, { stdio: "inherit", env: process.env });
+  execFileSync15("gh", editArgs, { stdio: "inherit", env: process.env });
+  execFileSync15("gh", commentArgs, { stdio: "inherit", env: process.env });
   process.stdout.write(`
 ✓ Label applied and reason posted as a PR comment.
 `);
@@ -7324,7 +7709,7 @@ function printHelp() {
 // src/index.ts
 var PACKAGE_ROOT = join22(dirname8(fileURLToPath2(import.meta.url)), "..");
 function readVersion2() {
-  const pkg = JSON.parse(readFileSync20(join22(PACKAGE_ROOT, "package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync21(join22(PACKAGE_ROOT, "package.json"), "utf-8"));
   return pkg.version;
 }
 var [, , command, ...args] = process.argv;