@attalabs/vinaya 0.18.0 → 0.19.1

package/dist/checks/bin/check-first-push-dispatch.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/checks/bin/check-first-push-dispatch.ts
-import { execFileSync as execFileSync3 } from "node:child_process";
+import { execFileSync as execFileSync4 } from "node:child_process";
 // ../../packages/aeg-forge-state/src/strip-code.ts
 function maskCode(body) {
   const fill = (line) => " ".repeat(line.length);
@@ -273,6 +273,9 @@ function issueListByLabelArgs(owner, repo, label) {
     "200"
   ];
 }
+function ghIssueListByLabel(owner, repo, label) {
+  return JSON.parse(run(issueListByLabelArgs(owner, repo, label)));
+}
 async function ghIssueListByLabelAsync(owner, repo, label) {
   return JSON.parse(await runAsync(issueListByLabelArgs(owner, repo, label)));
 }
@@ -288,18 +291,6 @@ async function ghIssueListByAnyLabelAsync(owner, repo, labels) {
   return dedupeByNumber(perLabel.flat());
 }
 
-// ../../packages/aeg-forge-state/src/fetch-milestone.ts
-function findMilestoneForSlug(owner, repo, slug) {
-  const milestones = ghApiGet(`repos/${owner}/${repo}/milestones?state=all&per_page=100`);
-  const match = milestones.find((m) => m.title === slug);
-  if (!match)
-    return null;
-  return {
-    goal: match.description ?? "",
-    lifecycle: match.state === "closed" ? "complete" : "active"
-  };
-}
-
 // ../../packages/aeg-forge-state/src/labels.ts
 var LABELS = [
   {
@@ -542,6 +533,66 @@ function resolveTaskIssueRef(title, labels) {
   return { trancheSlug, taskId };
 }
 
+// ../../packages/aeg-forge-state/src/fetch-milestone.ts
+var INTENTS_HEADING = /^#{1,6}\s*Tranche intents\s*$/im;
+var NEXT_HEADING = /^#{1,6}\s+\S/m;
+var INTENT_BULLET = /^-\s+([a-z0-9][a-z0-9-]*)\s*:\s*(.+)$/i;
+function intentGoalForSlug(description, slug) {
+  const text = stripCode(description, { inlineSpans: "keep" });
+  const start = text.match(INTENTS_HEADING);
+  if (!start || start.index === undefined)
+    return "";
+  const rest = text.slice(start.index + start[0].length);
+  const next = rest.match(NEXT_HEADING);
+  const section = rest.slice(0, next && next.index !== undefined ? next.index : rest.length);
+  for (const line of section.split(`
+`)) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0)
+      continue;
+    const m = trimmed.match(INTENT_BULLET);
+    if (m && (m[1] ?? "").toLowerCase() === slug.toLowerCase())
+      return (m[2] ?? "").trim();
+  }
+  return "";
+}
+function matchesLegacyMilestone(milestones, slug) {
+  return milestones.find((m) => m.title === slug) ?? null;
+}
+function factsFromLegacyMilestone(milestone) {
+  return {
+    goal: milestone.description ?? "",
+    lifecycle: milestone.state === "closed" ? "complete" : "active"
+  };
+}
+function resolveLegacyFacts(milestone, labelIssues) {
+  if (milestone.state === "closed" && labelIssues.length > 0) {
+    return { goal: milestone.description ?? "", lifecycle: lifecycleFromIssues(labelIssues) };
+  }
+  return factsFromLegacyMilestone(milestone);
+}
+function lifecycleFromIssues(issues) {
+  if (issues.length === 0)
+    return "planned";
+  return issues.some((i) => i.state === "OPEN") ? "active" : "complete";
+}
+function goalFromMilestones(milestones, slug) {
+  for (const m of milestones) {
+    const goal = intentGoalForSlug(m.description ?? "", slug);
+    if (goal)
+      return goal;
+  }
+  return "";
+}
+function findMilestoneForSlug(owner, repo, slug) {
+  const milestones = ghApiGet(`repos/${owner}/${repo}/milestones?state=all&per_page=100`);
+  const legacy = matchesLegacyMilestone(milestones, slug);
+  const issues = ghIssueListByLabel(owner, repo, trancheLabel(slug));
+  if (legacy)
+    return resolveLegacyFacts(legacy, issues);
+  return { goal: goalFromMilestones(milestones, slug), lifecycle: lifecycleFromIssues(issues) };
+}
+
 // ../../packages/aeg-forge-state/src/derive-from-forge.ts
 function trancheFromIssues(slug, issues, known) {
   return {
@@ -2725,16 +2776,18 @@ function checkDeadBranchPush(input) {
 }
 // ../../packages/aeg-core/src/reader-resolvable-prose.ts
 var SHIPS_PREFIX = "aeg-root/";
-var SHIPS_ARCHIVE_PREFIX = "aeg-root/tranches/completed/";
+function shipsArchivePrefix(shipsPrefix) {
+  return `${shipsPrefix}tranches/completed/`;
+}
 function isSpecFile2(path) {
   return path.startsWith("apps/") && path.includes("/specs/") && path.endsWith(".md");
 }
 function isClaudeMdFile(path) {
   return path === "CLAUDE.md" || path.endsWith("/CLAUDE.md");
 }
-function classifyProseFile(path, readerFacingPrefix, readerFacingSuffix) {
-  if (path.startsWith(SHIPS_PREFIX)) {
-    return path.startsWith(SHIPS_ARCHIVE_PREFIX) ? "internal" : "ships";
+function classifyProseFile(path, readerFacingPrefix, readerFacingSuffix, shipsPrefix = SHIPS_PREFIX) {
+  if (path.startsWith(shipsPrefix)) {
+    return path.startsWith(shipsArchivePrefix(shipsPrefix)) ? "internal" : "ships";
   }
   if (path.startsWith(readerFacingPrefix) && path.endsWith(readerFacingSuffix)) {
     return "reader-facing";
@@ -2769,7 +2822,7 @@ function legacySlugPattern(legacySlugs) {
   const alternation = legacySlugs.map((s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
   return new RegExp(`(^|[^a-zA-Z0-9\\n-])(${alternation})([^a-zA-Z0-9\\n-]|$)`, "g");
 }
-function checkUnresolvableReferences(files, readerFacingPrefix, readerFacingSuffix, legacySlugs = []) {
+function checkUnresolvableReferences(files, readerFacingPrefix, readerFacingSuffix, legacySlugs = [], shipsPrefix = SHIPS_PREFIX) {
   const findings = [];
   const legacyPattern = legacySlugPattern(legacySlugs);
   const patterns = [
@@ -2778,7 +2831,7 @@ function checkUnresolvableReferences(files, readerFacingPrefix, readerFacingSuff
     ...legacyPattern ? [{ pattern: legacyPattern, what: "an internal tranche slug", group: 2 }] : []
   ];
   for (const file of files) {
-    const cls = classifyProseFile(file.path, readerFacingPrefix, readerFacingSuffix);
+    const cls = classifyProseFile(file.path, readerFacingPrefix, readerFacingSuffix, shipsPrefix);
     if (!cls || !SWEPT_CLASSES.has(cls))
       continue;
     const scrubbed = stripNonProse(file.path, file.content);
@@ -2824,10 +2877,10 @@ function definesOrLinksGlossary(content, term) {
     return true;
   return /docs\/glossary|glossary\.md/i.test(content);
 }
-function checkUndefinedVocabulary(files, glossaryTerms, readerFacingPrefix, readerFacingSuffix) {
+function checkUndefinedVocabulary(files, glossaryTerms, readerFacingPrefix, readerFacingSuffix, shipsPrefix = SHIPS_PREFIX) {
   const findings = [];
   for (const file of files) {
-    const cls = classifyProseFile(file.path, readerFacingPrefix, readerFacingSuffix);
+    const cls = classifyProseFile(file.path, readerFacingPrefix, readerFacingSuffix, shipsPrefix);
     if (!cls || !SWEPT_CLASSES.has(cls))
       continue;
     const scrubbed = stripNonProse(file.path, file.content);
@@ -2846,10 +2899,10 @@ function checkUndefinedVocabulary(files, glossaryTerms, readerFacingPrefix, read
   }
   return findings;
 }
-function checkReaderResolvableProse(files, glossaryTerms, readerFacingPrefix, readerFacingSuffix, legacySlugs = []) {
+function checkReaderResolvableProse(files, glossaryTerms, readerFacingPrefix, readerFacingSuffix, legacySlugs = [], shipsPrefix = SHIPS_PREFIX) {
   return [
-    ...checkUnresolvableReferences(files, readerFacingPrefix, readerFacingSuffix, legacySlugs),
-    ...checkUndefinedVocabulary(files, glossaryTerms, readerFacingPrefix, readerFacingSuffix)
+    ...checkUnresolvableReferences(files, readerFacingPrefix, readerFacingSuffix, legacySlugs, shipsPrefix),
+    ...checkUndefinedVocabulary(files, glossaryTerms, readerFacingPrefix, readerFacingSuffix, shipsPrefix)
   ];
 }
 function parseGlossaryTerms(glossaryContent) {
@@ -2863,6 +2916,101 @@ function parseGlossaryTerms(glossaryContent) {
   }
   return terms;
 }
+// ../../packages/aeg-core/src/retired-vocabulary.ts
+var RETIRED_PATTERNS = [
+  String.raw`\bD-[0-9]{3}\b`,
+  "D-(###|NNN|nnn|xxx)",
+  "decision (entry|logged)",
+  "decision-log entry",
+  "decision log entry",
+  "decision log(s|ged|ging)?([^a-z]|$)",
+  "decision-log",
+  "decision entr",
+  "decisions? (are |is )?logged",
+  "log entries",
+  String.raw`decisions\.md`,
+  "decisions-legacy",
+  "CONTRADICTION",
+  "assumes Tier 3",
+  "Lock: ?YES",
+  "Lock: ?NO",
+  "lock approvals?",
+  "approves locks",
+  "Conforms to lock",
+  "Challenges lock",
+  "checkDecisionNumbersFresh",
+  String.raw`roles/team-leader\.md`,
+  String.raw`\(,`,
+  String.raw`,\)`,
+  String.raw`\(\.\)`
+];
+var RETIRED_EXEMPT_SUBSTRINGS = [
+  "docs/decisions-legacy.md",
+  "apps/herald-ai/docs/",
+  "apps/vada-ai/docs/",
+  "aeg-root/tranches/completed/",
+  "packages/aeg-core/src/docs/published-prose",
+  "packages/aeg-core/src/retired-vocabulary.test.ts",
+  "packages/aeg-core/src/retired-vocabulary.ts",
+  "/fixtures/",
+  "/node_modules/",
+  "/.next/",
+  "/.turbo/"
+];
+var PATTERN_EXEMPT = {
+  [String.raw`\bD-[0-9]{3}\b`]: ["./CLAUDE.md"],
+  [String.raw`decisions\.md`]: [
+    "docs-index.md",
+    "apps/vada-ai/specs/legacy/README.md",
+    "apps/vada-ai/specs/vada-product-spec.md",
+    "apps/vada-ai/web/CLAUDE.md",
+    "apps/vada-ai/CLAUDE.md"
+  ],
+  "decisions-legacy": [
+    "packages/aeg-core/src/file-classify.ts",
+    "packages/aeg-core/src/file-classify.test.ts",
+    "packages/aeg-core/src/pr-tier.test.ts",
+    "docs-index.md",
+    ".claude/skills/database/SKILL.md",
+    ".claude/skills/vada-architecture/SKILL.md",
+    "apps/vada-ai/specs/vada-byok-principles.md",
+    "apps/vada-ai/web/CLAUDE.md",
+    "apps/vada-ai/CLAUDE.md"
+  ],
+  CONTRADICTION: ["apps/vada-ai/specs/vada-reviewers-spec.md"]
+};
+function lineNumbers(content, pattern) {
+  const out = [];
+  const lines = content.split(`
+`);
+  for (let i = 0;i < lines.length; i++) {
+    if (pattern.test(lines[i] ?? ""))
+      out.push(i + 1);
+  }
+  return out;
+}
+function scanRetiredVocabulary(files) {
+  const findings = [];
+  for (const file of files) {
+    if (RETIRED_EXEMPT_SUBSTRINGS.some((e) => file.path.includes(e)))
+      continue;
+    for (const pattern of RETIRED_PATTERNS) {
+      const patternExempt = PATTERN_EXEMPT[pattern] ?? [];
+      if (patternExempt.some((e) => file.path.includes(e)))
+        continue;
+      const re = new RegExp(pattern);
+      for (const line of lineNumbers(file.content, re)) {
+        findings.push({
+          file: file.path,
+          line,
+          pattern,
+          message: `claims a retired AEG mechanism is still live (matches /${pattern}/)`
+        });
+      }
+    }
+  }
+  return findings;
+}
 // ../../packages/aeg-core/src/dispatch-gate.ts
 function isHandClosedByRecognizedPrincipal(dep, principalAllowlist) {
   return dep.issueState === "closed" && dep.stateReason === "completed" && isPrincipal(dep.closedByActor ?? null, principalAllowlist);
@@ -3139,9 +3287,15 @@ function emitCheckError(error) {
 
 // src/lib/config.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { z as z2 } from "zod";
+
+// src/lib/agent-vendors.ts
+var AGENT_VENDORS = ["skills", "claude", "gemini"];
+
+// src/lib/config.ts
 var EnvEntrySchema = z2.union([
   z2.literal(true),
   z2.object({ optional: z2.literal(true) }),
@@ -3180,6 +3334,11 @@ var CheckEntrySchema = z2.object({
     }
   }
 });
+var RoleEntrySchema = z2.object({
+  contract: z2.string().refine((p) => p.includes("/"), {
+    message: 'must be a path (contain at least one "/"), not a bare filename'
+  })
+});
 var BRIEF_BUILTINS = [
   "tier",
   "testPlan",
@@ -3194,7 +3353,8 @@ var BRIEF_BUILTINS = [
   "for",
   "closesN",
   "premiseCoverage",
-  "issueRationale"
+  "issueRationale",
+  "milestoneShape"
 ];
 var BriefSectionSchema = z2.union([
   z2.object({ builtin: z2.enum(BRIEF_BUILTINS) }),
@@ -3205,6 +3365,7 @@ var BriefSectionSchema = z2.union([
 var BriefSchemaSchema = z2.object({
   pr: z2.object({ sections: z2.array(BriefSectionSchema) }).optional(),
   issue: z2.object({ sections: z2.array(BriefSectionSchema) }).optional(),
+  milestone: z2.object({ sections: z2.array(BriefSectionSchema) }).optional(),
   ack: z2.array(z2.enum(BRIEF_BUILTINS)).optional()
 });
 function isSafeRepoRelPath(p) {
@@ -3226,7 +3387,8 @@ var ManagedManifestSchema = z2.object({
   version: z2.number().int().positive(),
   files: z2.array(SafeRepoRelPath),
   blocks: z2.array(ManagedBlockRecordSchema),
-  labels: z2.array(z2.string())
+  labels: z2.array(z2.string()),
+  agents: z2.array(z2.enum(AGENT_VENDORS)).optional()
 });
 var VinayaConfigSchema = z2.object({
   rings: z2.object({
@@ -3234,16 +3396,79 @@ var VinayaConfigSchema = z2.object({
     ring2_asyncAudits: z2.boolean()
   }).optional(),
   checks: z2.record(z2.string(), CheckEntrySchema).optional(),
+  roles: z2.record(z2.string(), RoleEntrySchema).optional(),
   briefSchema: BriefSchemaSchema.optional(),
   managed: ManagedManifestSchema.optional(),
   principals: z2.array(z2.string()).min(1).optional(),
   releaseActor: z2.string().min(1).optional(),
   ci: z2.object({ setup: z2.string().min(1) }).optional(),
-  blastRadius: z2.object({ extraDomains: z2.array(z2.string()).optional() }).optional()
+  blastRadius: z2.object({ extraDomains: z2.array(z2.string()).optional() }).optional(),
+  proseGates: z2.object({
+    doctrineRoot: z2.string().min(1).optional(),
+    readerFacingPrefix: z2.string().min(1).optional(),
+    readerFacingSuffix: z2.string().min(1).optional(),
+    legacySlugDir: z2.string().min(1).optional()
+  }).optional()
 });
 var GLOBAL_VINAYA_HOME = join(homedir(), ".vinaya");
 var GLOBAL_CONFIG_PATH = join(GLOBAL_VINAYA_HOME, "config.json");
 var LOCAL_CONFIG_FILENAME = "vinaya.config.json";
+function findLocalConfig() {
+  let dir = process.cwd();
+  while (true) {
+    const candidate = join(dir, LOCAL_CONFIG_FILENAME);
+    if (existsSync(candidate))
+      return candidate;
+    if (existsSync(join(dir, ".git")))
+      return null;
+    const parent = dirname(dir);
+    if (parent === dir)
+      return null;
+    dir = parent;
+  }
+}
+function configPath() {
+  const local = findLocalConfig();
+  if (local)
+    return local;
+  if (existsSync(GLOBAL_CONFIG_PATH))
+    return GLOBAL_CONFIG_PATH;
+  return null;
+}
+function globalChecksIgnoredWarning(path) {
+  return `${path}: "checks" registration in the global config is ignored — checks may only be registered from a repo-local vinaya.config.json.`;
+}
+function globalPrincipalsIgnoredWarning(path) {
+  return `${path}: "principals" in the global config is ignored — principals may only be declared from a repo-local vinaya.config.json.`;
+}
+function globalRolesIgnoredWarning(path) {
+  return `${path}: "roles" registration in the global config is ignored — roles may only be registered from a repo-local vinaya.config.json.`;
+}
+function globalReleaseActorIgnoredWarning(path) {
+  return `${path}: "releaseActor" in the global config is ignored — releaseActor may only be declared from a repo-local vinaya.config.json.`;
+}
+function stripGlobalOnlyKeys(config, path) {
+  if (path !== GLOBAL_CONFIG_PATH)
+    return config;
+  let result = config;
+  if (result.checks && Object.keys(result.checks).length > 0) {
+    console.error(`⚠ ${globalChecksIgnoredWarning(path)}`);
+    result = { ...result, checks: undefined };
+  }
+  if (result.roles && Object.keys(result.roles).length > 0) {
+    console.error(`⚠ ${globalRolesIgnoredWarning(path)}`);
+    result = { ...result, roles: undefined };
+  }
+  if (result.principals && result.principals.length > 0) {
+    console.error(`⚠ ${globalPrincipalsIgnoredWarning(path)}`);
+    result = { ...result, principals: undefined };
+  }
+  if (result.releaseActor) {
+    console.error(`⚠ ${globalReleaseActorIgnoredWarning(path)}`);
+    result = { ...result, releaseActor: undefined };
+  }
+  return result;
+}
 function resolvePrincipalAllowlist(config) {
   return config?.principals ?? PRINCIPAL_ALLOWLIST;
 }
@@ -3316,12 +3541,86 @@ function loadTrustAnchorConfig(fetcher = ghFetchTrustAnchorConfig) {
     return null;
   }
 }
+function loadConfig() {
+  const path = configPath();
+  if (!path)
+    return null;
+  try {
+    const raw = JSON.parse(readFileSync(path, "utf-8"));
+    return stripGlobalOnlyKeys(VinayaConfigSchema.parse(raw), path);
+  } catch {
+    return null;
+  }
+}
+
+// src/checks/edge-resolve.ts
+import { execFileSync as execFileSync3 } from "node:child_process";
+var DIRECT_ISSUE_REF = /#(\d+)/;
+var issueCache = new Map;
+function fetchIssueState(num, repo) {
+  const key = `${repo.owner}/${repo.repo}#${num}`;
+  if (issueCache.has(key))
+    return issueCache.get(key) ?? null;
+  let out = null;
+  try {
+    const raw = execFileSync3("gh", [
+      "issue",
+      "view",
+      String(num),
+      "-R",
+      `${repo.owner}/${repo.repo}`,
+      "--json",
+      "state,stateReason,closedByPullRequestsReferences"
+    ], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    out = JSON.parse(raw);
+  } catch {
+    out = null;
+  }
+  issueCache.set(key, out);
+  return out;
+}
+function edgeFromIssueJson(num, json) {
+  if (json === null) {
+    return { issue: num, merged: false, open: false, issueState: null, stateReason: null, closedByActor: null };
+  }
+  const state = json.state === "CLOSED" ? "closed" : json.state === "OPEN" ? "open" : null;
+  const reason = json.stateReason === "COMPLETED" ? "completed" : json.stateReason === "NOT_PLANNED" ? "not_planned" : null;
+  const closedByMergedPr = (json.closedByPullRequestsReferences ?? []).length > 0;
+  return {
+    issue: num,
+    merged: state === "closed" && closedByMergedPr,
+    open: false,
+    issueState: state,
+    stateReason: reason,
+    closedByActor: null
+  };
+}
+function resolveEdge(id, taskById, factsByTaskId, repo) {
+  const target = taskById.get(id);
+  if (target) {
+    const facts = target.issue !== null ? factsByTaskId.get(target.id) : undefined;
+    return {
+      issue: target.issue,
+      merged: facts?.prState === "merged",
+      open: facts?.prState === "open",
+      issueState: facts?.issueState ?? null,
+      stateReason: facts?.stateReason ?? null,
+      closedByActor: facts?.closedByActor ?? null
+    };
+  }
+  const direct = id.match(DIRECT_ISSUE_REF);
+  if (direct) {
+    const num = Number(direct[1]);
+    return edgeFromIssueJson(num, fetchIssueState(num, repo));
+  }
+  return { issue: null, merged: false, open: false, issueState: null, stateReason: null, closedByActor: null };
+}
 
 // src/checks/bin/check-first-push-dispatch.ts
 var CHECK_NAME = "first-push-dispatch";
 function git(args) {
   try {
-    return execFileSync3("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync4("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch {
     return "";
   }
@@ -3344,7 +3643,7 @@ function resolveRepo2() {
 }
 function prExistsFor(branch) {
   try {
-    const out = execFileSync3("gh", ["pr", "list", "--head", branch, "--state", "all", "--json", "number", "--limit", "1"], {
+    const out = execFileSync4("gh", ["pr", "list", "--head", branch, "--state", "all", "--json", "number", "--limit", "1"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -3354,29 +3653,6 @@ function prExistsFor(branch) {
     return false;
   }
 }
-function resolveEdge(id, taskById, factsByTaskId) {
-  const target = taskById.get(id);
-  if (target) {
-    const facts = target.issue !== null ? factsByTaskId.get(target.id) : undefined;
-    return {
-      issue: target.issue,
-      merged: facts?.prState === "merged",
-      open: facts?.prState === "open",
-      issueState: facts?.issueState ?? null,
-      stateReason: facts?.stateReason ?? null,
-      closedByActor: facts?.closedByActor ?? null
-    };
-  }
-  const direct = id.match(/^#(\d+)$/);
-  return {
-    issue: direct ? Number(direct[1]) : null,
-    merged: false,
-    open: false,
-    issueState: null,
-    stateReason: null,
-    closedByActor: null
-  };
-}
 async function classifyReadiness(trancheSlug, taskId) {
   const repo = resolveRepo2();
   if (!repo)
@@ -3404,7 +3680,7 @@ async function classifyReadiness(trancheSlug, taskId) {
     const taskById = new Map(tranche.tasks.map((t) => [t.id, t]));
     const factsByTaskId = snapshot.facts;
     const dependsOn = task.dependsOn.map((dep) => {
-      const r = resolveEdge(dep, taskById, factsByTaskId);
+      const r = resolveEdge(dep, taskById, factsByTaskId, repo);
       return {
         id: dep,
         issue: r.issue,
@@ -3415,7 +3691,7 @@ async function classifyReadiness(trancheSlug, taskId) {
       };
     });
     const conflictsWith = task.conflictsWith.map((c) => {
-      const r = resolveEdge(c, taskById, factsByTaskId);
+      const r = resolveEdge(c, taskById, factsByTaskId, repo);
       return { id: c, issue: r.issue, openOrInFlight: r.open };
     });
     const input = {