@attalabs/vinaya 0.19.3 → 0.20.1

package/dist/checks/bin/check-doctrine-portability.js

@@ -6,17 +6,17 @@ import { readdirSync, readFileSync as readFileSync2, statSync } from "node:fs";
 import { join as join2 } from "node:path";
 // ../../packages/aeg-core/src/gate-audience.ts
 var GATE_AUDIENCE = {
-  "check-branch-topology": { shippedAs: "branch-topology" },
-  "check-first-push-dispatch": { shippedAs: "first-push-dispatch" },
-  "check-no-disk-state": { shippedAs: "no-disk-state" },
-  "verify-brief": { shippedAs: "brief-shape" },
-  "verify-coherence": { shippedAs: "coherence" },
-  "verify-dispatch": { shippedAs: "dispatch-readiness" },
-  "verify-docs": { shippedAs: ["doc-coverage", "doc-coverage-push"] },
-  "verify-registry": { shippedAs: "registry-gates" },
-  "verify-review-gate": { shippedAs: "review-gate" },
-  "verify-single-plan-pr": { shippedAs: "single-plan-pr" },
-  "verify-test-plan": { shippedAs: "test-plan" },
+  "check-branch-topology": { shippedAs: "branch-topology", ring: 0 },
+  "check-first-push-dispatch": { shippedAs: "first-push-dispatch", ring: 0 },
+  "check-no-disk-state": { shippedAs: "no-disk-state", ring: 0 },
+  "verify-brief": { shippedAs: "brief-shape", ring: 0 },
+  "verify-coherence": { shippedAs: "coherence", ring: 0 },
+  "verify-dispatch": { shippedAs: "dispatch-readiness", ring: 0 },
+  "verify-docs": { shippedAs: ["doc-coverage", "doc-coverage-push"], ring: 0 },
+  "verify-registry": { shippedAs: "registry-gates", ring: 0 },
+  "verify-review-gate": { shippedAs: "review-gate", ring: 1 },
+  "verify-single-plan-pr": { shippedAs: "single-plan-pr", ring: 0 },
+  "verify-test-plan": { shippedAs: "test-plan", ring: 1 },
   "check-direct-main-push": {
     internal: "Reaches adopters through `vinaya audit --only=direct-push`, not the check registry: it is a ring-2 sweep over merge history keyed on `GITHUB_SHA`, run by the generated archivist job on push to the default branch. It has no diff to key on, so there is nothing for `vinaya check` to run it against."
   },
@@ -328,6 +328,13 @@ var LABELS = [
     form: "literal",
     carries: "Execution is halted pending an external unblock; wins over every other derived status."
   },
+  {
+    key: "backlog",
+    id: "vinaya/backlog",
+    category: "state",
+    form: "literal",
+    carries: "The Issue is deliberately unplanned — belongs to no tranche and is excluded from dispatch, until a Planner promotes it."
+  },
   {
     key: "tier-0",
     id: "vinaya/tier:0",
@@ -1986,7 +1993,59 @@ function overrideActive(opts) {
   return false;
 }
 // ../../packages/aeg-core/src/premise-check.ts
+import { createHash } from "node:crypto";
 var ASSERTION_KINDS = new Set(["contains", "absent", "sha256"]);
+function isPremiseHeader(line) {
+  const stripped = line.replace(/[*#]/g, "").trim();
+  return /^premise\s*:?$/i.test(stripped);
+}
+var PREMISE_LINE = /^[-*]\s*(\S+)\s+(contains|absent|sha256)\s*:\s*(.+)$/i;
+function parsePremiseBlock(prBody) {
+  const searchIn = anchoredRegion(prBody, "PREMISE") ?? prBody;
+  const lines = searchIn.split(/\r?\n/);
+  const assertions = [];
+  let inBlock = false;
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!inBlock) {
+      if (isPremiseHeader(line))
+        inBlock = true;
+      continue;
+    }
+    if (line === "")
+      break;
+    const m = line.match(PREMISE_LINE);
+    if (!m)
+      break;
+    const [, path, kindRaw, value] = m;
+    const kind = kindRaw.toLowerCase();
+    if (!ASSERTION_KINDS.has(kind))
+      continue;
+    assertions.push({ kind, path, value: value.trim() });
+  }
+  return assertions;
+}
+function checkPremises(assertions, fileReader) {
+  const failures = [];
+  for (const a of assertions) {
+    const content = fileReader(a.path);
+    if (content === null) {
+      failures.push(`premise-check: ${a.path} does not exist on disk (premise asserted \`${a.kind}: ${a.value}\`) — the surface moved since this brief was authored; re-dig before proceeding.`);
+      continue;
+    }
+    if (a.kind === "contains" && !content.includes(a.value)) {
+      failures.push(`premise-check: ${a.path} no longer contains "${a.value}" — the premise this brief pinned has moved; re-dig before proceeding.`);
+    } else if (a.kind === "absent" && content.includes(a.value)) {
+      failures.push(`premise-check: ${a.path} now contains "${a.value}", but the brief pinned it absent — the premise has moved; re-dig before proceeding.`);
+    } else if (a.kind === "sha256") {
+      const actual = createHash("sha256").update(content).digest("hex");
+      if (actual !== a.value.toLowerCase()) {
+        failures.push(`premise-check: ${a.path} sha256 mismatch (brief pinned ${a.value}, file is now ${actual}) — the file changed since this brief was authored; re-dig before proceeding.`);
+      }
+    }
+  }
+  return { pass: failures.length === 0, failures };
+}
 
 // ../../packages/aeg-core/src/test-plan-section.ts
 var HEADING_FORM_RE = /^#{1,4}[ \t]*(?:\d+[a-z]?\.[ \t]*)?\*{0,2}Test Plan\*{0,2}[ \t]*$/im;
@@ -2790,6 +2849,7 @@ function checkG1(rows, existsFn) {
   }
   return { check: "G1", status: findings.length > 0 ? "fail" : "pass", findings };
 }
+var SCAFFOLD_PLACEHOLDER = "[undocumented — fill in why]";
 function checkG2(rows, candidateFiles) {
   const implementations = new Set(rows.map((r) => r.implementation).filter((p) => p !== ""));
   const findings = [];
@@ -2801,6 +2861,16 @@ function checkG2(rows, candidateFiles) {
       });
     }
   }
+  for (const row of rows) {
+    const carriesPlaceholder = [row.summary, row.description, row.spec].some((cell) => cell === SCAFFOLD_PLACEHOLDER);
+    if (carriesPlaceholder) {
+      findings.push({
+        row: row.action,
+        path: row.implementation,
+        reason: `${row.ring} row "${row.action}" still carries the scaffold placeholder marker — the why is owed`
+      });
+    }
+  }
   return { check: "G2", status: findings.length > 0 ? "info" : "pass", findings };
 }
 function checkG3(ring0Rows, crossingFiles) {
@@ -3320,6 +3390,29 @@ function isNewDiskStateFile(path, status) {
     return false;
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
+// ../../packages/aeg-core/src/main-branch-refusal.ts
+function checkMainBranchRefusal(facts) {
+  const { currentSymbolicBranch, defaultBranch } = facts;
+  if (currentSymbolicBranch === null)
+    return null;
+  if (defaultBranch === null) {
+    return {
+      reason: "default-branch-undetermined",
+      severity: "warning",
+      currentBranch: currentSymbolicBranch,
+      defaultBranch: null
+    };
+  }
+  if (currentSymbolicBranch === defaultBranch) {
+    return {
+      reason: "on-default-branch",
+      severity: "error",
+      currentBranch: currentSymbolicBranch,
+      defaultBranch
+    };
+  }
+  return null;
+}
 // ../../packages/aeg-core/src/branch-topology-gate.ts
 function taskBranchTopologyFields(branch) {
   if (!/^task\/.*\/.*$/.test(branch))
@@ -3666,8 +3759,15 @@ function isSafeRepoRelPath(p) {
 var SafeRepoRelPath = z.string().refine(isSafeRepoRelPath, {
   message: "must be a repo-root-relative path with no `..` segment or absolute root"
 });
+var CANONICAL_HOOK_BLOCK_PREFIXES = [".git/", ".husky/", ".vinaya/hooks/", ".claude/hooks/"];
+function isCanonicalHookBlockPath(p) {
+  return CANONICAL_HOOK_BLOCK_PREFIXES.some((prefix) => p.startsWith(prefix) && p.length > prefix.length);
+}
+var ManagedHookBlockPath = SafeRepoRelPath.refine(isCanonicalHookBlockPath, {
+  message: `must start with one of ${CANONICAL_HOOK_BLOCK_PREFIXES.join(", ")} (byte-exact, case-sensitive)`
+});
 var ManagedBlockRecordSchema = z.object({
-  path: SafeRepoRelPath,
+  path: ManagedHookBlockPath,
   marker: z.string(),
   comment: z.enum(["hash", "html"])
 });

package/dist/checks/bin/check-evidence-fresh.js

@@ -2,19 +2,48 @@
 
 // src/checks/bin/check-evidence-fresh.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
+
+// src/checks/contract.ts
+var CHECK_SCHEMA_VERSION = 1;
+function emitCheckError(error) {
+  process.stderr.write(`${JSON.stringify(error)}
+`);
+}
+
+// src/lib/numstat.ts
+function summariseNumstat(numstat) {
+  const rows = numstat.split(`
+`).filter((l) => l.trim() !== "");
+  let added = 0;
+  let deleted = 0;
+  let binary = 0;
+  for (const row of rows) {
+    const [a, d] = row.split("\t");
+    if (a === "-" || d === "-") {
+      binary++;
+      continue;
+    }
+    added += Number(a) || 0;
+    deleted += Number(d) || 0;
+  }
+  const files = `${rows.length} file${rows.length === 1 ? "" : "s"} changed`;
+  const bin = binary > 0 ? `, ${binary} binary` : "";
+  return `${files}, ${added} insertion${added === 1 ? "" : "s"}(+), ${deleted} deletion${deleted === 1 ? "" : "s"}(-)${bin}`;
+}
+var EVIDENCE_SUMMARY_PREFIX = "Summary: ";
 // ../../packages/aeg-core/src/gate-audience.ts
 var GATE_AUDIENCE = {
-  "check-branch-topology": { shippedAs: "branch-topology" },
-  "check-first-push-dispatch": { shippedAs: "first-push-dispatch" },
-  "check-no-disk-state": { shippedAs: "no-disk-state" },
-  "verify-brief": { shippedAs: "brief-shape" },
-  "verify-coherence": { shippedAs: "coherence" },
-  "verify-dispatch": { shippedAs: "dispatch-readiness" },
-  "verify-docs": { shippedAs: ["doc-coverage", "doc-coverage-push"] },
-  "verify-registry": { shippedAs: "registry-gates" },
-  "verify-review-gate": { shippedAs: "review-gate" },
-  "verify-single-plan-pr": { shippedAs: "single-plan-pr" },
-  "verify-test-plan": { shippedAs: "test-plan" },
+  "check-branch-topology": { shippedAs: "branch-topology", ring: 0 },
+  "check-first-push-dispatch": { shippedAs: "first-push-dispatch", ring: 0 },
+  "check-no-disk-state": { shippedAs: "no-disk-state", ring: 0 },
+  "verify-brief": { shippedAs: "brief-shape", ring: 0 },
+  "verify-coherence": { shippedAs: "coherence", ring: 0 },
+  "verify-dispatch": { shippedAs: "dispatch-readiness", ring: 0 },
+  "verify-docs": { shippedAs: ["doc-coverage", "doc-coverage-push"], ring: 0 },
+  "verify-registry": { shippedAs: "registry-gates", ring: 0 },
+  "verify-review-gate": { shippedAs: "review-gate", ring: 1 },
+  "verify-single-plan-pr": { shippedAs: "single-plan-pr", ring: 0 },
+  "verify-test-plan": { shippedAs: "test-plan", ring: 1 },
   "check-direct-main-push": {
     internal: "Reaches adopters through `vinaya audit --only=direct-push`, not the check registry: it is a ring-2 sweep over merge history keyed on `GITHUB_SHA`, run by the generated archivist job on push to the default branch. It has no diff to key on, so there is nothing for `vinaya check` to run it against."
   },
@@ -326,6 +355,13 @@ var LABELS = [
     form: "literal",
     carries: "Execution is halted pending an external unblock; wins over every other derived status."
   },
+  {
+    key: "backlog",
+    id: "vinaya/backlog",
+    category: "state",
+    form: "literal",
+    carries: "The Issue is deliberately unplanned — belongs to no tranche and is excluded from dispatch, until a Planner promotes it."
+  },
   {
     key: "tier-0",
     id: "vinaya/tier:0",
@@ -1984,7 +2020,59 @@ function overrideActive(opts) {
   return false;
 }
 // ../../packages/aeg-core/src/premise-check.ts
+import { createHash } from "node:crypto";
 var ASSERTION_KINDS = new Set(["contains", "absent", "sha256"]);
+function isPremiseHeader(line) {
+  const stripped = line.replace(/[*#]/g, "").trim();
+  return /^premise\s*:?$/i.test(stripped);
+}
+var PREMISE_LINE = /^[-*]\s*(\S+)\s+(contains|absent|sha256)\s*:\s*(.+)$/i;
+function parsePremiseBlock(prBody) {
+  const searchIn = anchoredRegion(prBody, "PREMISE") ?? prBody;
+  const lines = searchIn.split(/\r?\n/);
+  const assertions = [];
+  let inBlock = false;
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!inBlock) {
+      if (isPremiseHeader(line))
+        inBlock = true;
+      continue;
+    }
+    if (line === "")
+      break;
+    const m = line.match(PREMISE_LINE);
+    if (!m)
+      break;
+    const [, path, kindRaw, value] = m;
+    const kind = kindRaw.toLowerCase();
+    if (!ASSERTION_KINDS.has(kind))
+      continue;
+    assertions.push({ kind, path, value: value.trim() });
+  }
+  return assertions;
+}
+function checkPremises(assertions, fileReader) {
+  const failures = [];
+  for (const a of assertions) {
+    const content = fileReader(a.path);
+    if (content === null) {
+      failures.push(`premise-check: ${a.path} does not exist on disk (premise asserted \`${a.kind}: ${a.value}\`) — the surface moved since this brief was authored; re-dig before proceeding.`);
+      continue;
+    }
+    if (a.kind === "contains" && !content.includes(a.value)) {
+      failures.push(`premise-check: ${a.path} no longer contains "${a.value}" — the premise this brief pinned has moved; re-dig before proceeding.`);
+    } else if (a.kind === "absent" && content.includes(a.value)) {
+      failures.push(`premise-check: ${a.path} now contains "${a.value}", but the brief pinned it absent — the premise has moved; re-dig before proceeding.`);
+    } else if (a.kind === "sha256") {
+      const actual = createHash("sha256").update(content).digest("hex");
+      if (actual !== a.value.toLowerCase()) {
+        failures.push(`premise-check: ${a.path} sha256 mismatch (brief pinned ${a.value}, file is now ${actual}) — the file changed since this brief was authored; re-dig before proceeding.`);
+      }
+    }
+  }
+  return { pass: failures.length === 0, failures };
+}
 
 // ../../packages/aeg-core/src/test-plan-section.ts
 var HEADING_FORM_RE = /^#{1,4}[ \t]*(?:\d+[a-z]?\.[ \t]*)?\*{0,2}Test Plan\*{0,2}[ \t]*$/im;
@@ -2788,6 +2876,7 @@ function checkG1(rows, existsFn) {
   }
   return { check: "G1", status: findings.length > 0 ? "fail" : "pass", findings };
 }
+var SCAFFOLD_PLACEHOLDER = "[undocumented — fill in why]";
 function checkG2(rows, candidateFiles) {
   const implementations = new Set(rows.map((r) => r.implementation).filter((p) => p !== ""));
   const findings = [];
@@ -2799,6 +2888,16 @@ function checkG2(rows, candidateFiles) {
       });
     }
   }
+  for (const row of rows) {
+    const carriesPlaceholder = [row.summary, row.description, row.spec].some((cell) => cell === SCAFFOLD_PLACEHOLDER);
+    if (carriesPlaceholder) {
+      findings.push({
+        row: row.action,
+        path: row.implementation,
+        reason: `${row.ring} row "${row.action}" still carries the scaffold placeholder marker — the why is owed`
+      });
+    }
+  }
   return { check: "G2", status: findings.length > 0 ? "info" : "pass", findings };
 }
 function checkG3(ring0Rows, crossingFiles) {
@@ -3318,6 +3417,29 @@ function isNewDiskStateFile(path, status) {
     return false;
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
+// ../../packages/aeg-core/src/main-branch-refusal.ts
+function checkMainBranchRefusal(facts) {
+  const { currentSymbolicBranch, defaultBranch } = facts;
+  if (currentSymbolicBranch === null)
+    return null;
+  if (defaultBranch === null) {
+    return {
+      reason: "default-branch-undetermined",
+      severity: "warning",
+      currentBranch: currentSymbolicBranch,
+      defaultBranch: null
+    };
+  }
+  if (currentSymbolicBranch === defaultBranch) {
+    return {
+      reason: "on-default-branch",
+      severity: "error",
+      currentBranch: currentSymbolicBranch,
+      defaultBranch
+    };
+  }
+  return null;
+}
 // ../../packages/aeg-core/src/branch-topology-gate.ts
 function taskBranchTopologyFields(branch) {
   if (!/^task\/.*\/.*$/.test(branch))
@@ -3571,17 +3693,64 @@ function findWorkspaceEscapes(files, knownPaths, workspaceDirs = DEFAULT_WORKSPA
   }
   return findings;
 }
-// src/checks/contract.ts
-var CHECK_SCHEMA_VERSION = 1;
-function emitCheckError(error) {
-  process.stderr.write(`${JSON.stringify(error)}
-`);
+// src/checks/scan-context.ts
+var ZERO_WIDTH = /[\u200B-\u200D\u2060\uFEFF]/g;
+var HTML_ENTITIES = {
+  """: '"',
+  "'": "'",
+  "&lt;": "<",
+  "&gt;": ">",
+  "&amp;": "&"
+};
+function decodeNamedEntities(body) {
+  return body.replace(/&(?:quot|apos|lt|gt|amp);/g, (m) => HTML_ENTITIES[m] ?? m);
+}
+function normalizeBody(rawBody) {
+  return decodeNamedEntities(rawBody.replace(ZERO_WIDTH, ""));
+}
+function buildAnchorLookupMask(body) {
+  return maskDetailsBlocks(maskCode(body));
+}
+
+class ScanContext {
+  raw;
+  normalised;
+  masked;
+  constructor(raw, normalised, masked) {
+    this.raw = raw;
+    this.normalised = normalised;
+    this.masked = masked;
+  }
+  static from(rawBody) {
+    const normalised = normalizeBody(rawBody);
+    return new ScanContext(rawBody, normalised, buildAnchorLookupMask(normalised));
+  }
+  rawResolutionAgrees(field) {
+    const rawHasPair = anchoredRegionBounds(this.raw, field) !== null;
+    return rawHasPair === (anchoredRegionBounds(this.masked, field) !== null);
+  }
+}
+function resolveAnchoredRegion(ctx, field) {
+  const bounds = anchoredRegionBounds(ctx.masked, field);
+  if (bounds === null) {
+    return anchoredRegionBounds(ctx.normalised, field) !== null ? "hidden" : null;
+  }
+  return {
+    region: ctx.normalised.slice(bounds.innerStart, bounds.innerEnd),
+    maskedRegion: ctx.masked.slice(bounds.innerStart, bounds.innerEnd)
+  };
+}
+function summaryLineIndex(maskedRegion) {
+  const index = maskedRegion.split(`
+`).findIndex((line) => line.startsWith(EVIDENCE_SUMMARY_PREFIX));
+  return index === -1 ? null : index;
 }
 
 // src/checks/evidence-fresh-logic.ts
 var HEAD_LINE = /^Head:\s*([0-9a-f]{7,40})\s*$/m;
 var FENCE = /```[^\n]*\n?([\s\S]*?)```/g;
-function compareEvidenceBlock(region, resolvedHead, actualNumstat) {
+function compareEvidenceBlock(resolved, resolvedHead, actualNumstat) {
+  const region = resolved.region;
   const headMatch = region.match(HEAD_LINE);
   const fences = [...region.matchAll(FENCE)].map((m) => (m[1] ?? "").trim());
   if (!headMatch || fences.length < 1) {
@@ -3607,6 +3776,20 @@ function compareEvidenceBlock(region, resolvedHead, actualNumstat) {
     ].join(`
 `));
   }
+  const summaryIndex = summaryLineIndex(resolved.maskedRegion);
+  if (summaryIndex !== null) {
+    const storedSummary = resolved.region.split(`
+`)[summaryIndex];
+    const expectedSummary = `${EVIDENCE_SUMMARY_PREFIX}\`${summariseNumstat(actual)}\``;
+    if (storedSummary !== expectedSummary) {
+      errors.push([
+        "evidence-fresh: the Summary line does not match a fresh recompute of the diff it summarises.",
+        `  block:  ${JSON.stringify(storedSummary)}`,
+        `  actual: ${JSON.stringify(expectedSummary)}`
+      ].join(`
+`));
+    }
+  }
   return errors.length > 0 ? { status: "fail", errors } : { status: "pass" };
 }
 
@@ -3665,10 +3848,20 @@ function main() {
   if (!body) {
     process.exit(0);
   }
-  const region = anchoredRegion(body, "EVIDENCE");
-  if (region === null) {
+  const resolved = resolveAnchoredRegion(ScanContext.from(body), "EVIDENCE");
+  if (resolved === null) {
     process.exit(0);
   }
+  if (resolved === "hidden") {
+    emitCheckError({
+      schema: CHECK_SCHEMA_VERSION,
+      check: CHECK_NAME,
+      severity: "error",
+      message: "evidence-fresh: the AEG:EVIDENCE block sits inside a `<details>` block, where its digits are exempt from `body-bare-digits` and nothing can verify what it claims. Move the block out of the collapsed section.",
+      agent_recovery_prompt: "Move the AEG:EVIDENCE anchor pair out of the `<details>` block (the canonical home is its own `## Evidence` section), then re-run `vinaya pr report --write <body-file>`."
+    });
+    process.exit(1);
+  }
   const prNumberStr = process.env.PR_NUMBER;
   if (!prNumberStr) {
     process.exit(0);
@@ -3699,7 +3892,7 @@ function main() {
     });
     process.exit(1);
   }
-  const result = compareEvidenceBlock(region, resolvedHead, actualNumstat);
+  const result = compareEvidenceBlock(resolved, resolvedHead, actualNumstat);
   if (result.status === "fail") {
     for (const message of result.errors) {
       emitCheckError({