@attalabs/vinaya 0.19.3 → 0.20.1

package/dist/checks/bin/check-registry-gates.js

@@ -6,17 +6,17 @@ import { existsSync as existsSync3, readdirSync, readFileSync, statSync } from "
 import matter2 from "gray-matter";
 // ../../packages/aeg-core/src/gate-audience.ts
 var GATE_AUDIENCE = {
-  "check-branch-topology": { shippedAs: "branch-topology" },
-  "check-first-push-dispatch": { shippedAs: "first-push-dispatch" },
-  "check-no-disk-state": { shippedAs: "no-disk-state" },
-  "verify-brief": { shippedAs: "brief-shape" },
-  "verify-coherence": { shippedAs: "coherence" },
-  "verify-dispatch": { shippedAs: "dispatch-readiness" },
-  "verify-docs": { shippedAs: ["doc-coverage", "doc-coverage-push"] },
-  "verify-registry": { shippedAs: "registry-gates" },
-  "verify-review-gate": { shippedAs: "review-gate" },
-  "verify-single-plan-pr": { shippedAs: "single-plan-pr" },
-  "verify-test-plan": { shippedAs: "test-plan" },
+  "check-branch-topology": { shippedAs: "branch-topology", ring: 0 },
+  "check-first-push-dispatch": { shippedAs: "first-push-dispatch", ring: 0 },
+  "check-no-disk-state": { shippedAs: "no-disk-state", ring: 0 },
+  "verify-brief": { shippedAs: "brief-shape", ring: 0 },
+  "verify-coherence": { shippedAs: "coherence", ring: 0 },
+  "verify-dispatch": { shippedAs: "dispatch-readiness", ring: 0 },
+  "verify-docs": { shippedAs: ["doc-coverage", "doc-coverage-push"], ring: 0 },
+  "verify-registry": { shippedAs: "registry-gates", ring: 0 },
+  "verify-review-gate": { shippedAs: "review-gate", ring: 1 },
+  "verify-single-plan-pr": { shippedAs: "single-plan-pr", ring: 0 },
+  "verify-test-plan": { shippedAs: "test-plan", ring: 1 },
   "check-direct-main-push": {
     internal: "Reaches adopters through `vinaya audit --only=direct-push`, not the check registry: it is a ring-2 sweep over merge history keyed on `GITHUB_SHA`, run by the generated archivist job on push to the default branch. It has no diff to key on, so there is nothing for `vinaya check` to run it against."
   },
@@ -328,6 +328,13 @@ var LABELS = [
     form: "literal",
     carries: "Execution is halted pending an external unblock; wins over every other derived status."
   },
+  {
+    key: "backlog",
+    id: "vinaya/backlog",
+    category: "state",
+    form: "literal",
+    carries: "The Issue is deliberately unplanned — belongs to no tranche and is excluded from dispatch, until a Planner promotes it."
+  },
   {
     key: "tier-0",
     id: "vinaya/tier:0",
@@ -1986,7 +1993,59 @@ function overrideActive(opts) {
   return false;
 }
 // ../../packages/aeg-core/src/premise-check.ts
+import { createHash } from "node:crypto";
 var ASSERTION_KINDS = new Set(["contains", "absent", "sha256"]);
+function isPremiseHeader(line) {
+  const stripped = line.replace(/[*#]/g, "").trim();
+  return /^premise\s*:?$/i.test(stripped);
+}
+var PREMISE_LINE = /^[-*]\s*(\S+)\s+(contains|absent|sha256)\s*:\s*(.+)$/i;
+function parsePremiseBlock(prBody) {
+  const searchIn = anchoredRegion(prBody, "PREMISE") ?? prBody;
+  const lines = searchIn.split(/\r?\n/);
+  const assertions = [];
+  let inBlock = false;
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!inBlock) {
+      if (isPremiseHeader(line))
+        inBlock = true;
+      continue;
+    }
+    if (line === "")
+      break;
+    const m = line.match(PREMISE_LINE);
+    if (!m)
+      break;
+    const [, path, kindRaw, value] = m;
+    const kind = kindRaw.toLowerCase();
+    if (!ASSERTION_KINDS.has(kind))
+      continue;
+    assertions.push({ kind, path, value: value.trim() });
+  }
+  return assertions;
+}
+function checkPremises(assertions, fileReader) {
+  const failures = [];
+  for (const a of assertions) {
+    const content = fileReader(a.path);
+    if (content === null) {
+      failures.push(`premise-check: ${a.path} does not exist on disk (premise asserted \`${a.kind}: ${a.value}\`) — the surface moved since this brief was authored; re-dig before proceeding.`);
+      continue;
+    }
+    if (a.kind === "contains" && !content.includes(a.value)) {
+      failures.push(`premise-check: ${a.path} no longer contains "${a.value}" — the premise this brief pinned has moved; re-dig before proceeding.`);
+    } else if (a.kind === "absent" && content.includes(a.value)) {
+      failures.push(`premise-check: ${a.path} now contains "${a.value}", but the brief pinned it absent — the premise has moved; re-dig before proceeding.`);
+    } else if (a.kind === "sha256") {
+      const actual = createHash("sha256").update(content).digest("hex");
+      if (actual !== a.value.toLowerCase()) {
+        failures.push(`premise-check: ${a.path} sha256 mismatch (brief pinned ${a.value}, file is now ${actual}) — the file changed since this brief was authored; re-dig before proceeding.`);
+      }
+    }
+  }
+  return { pass: failures.length === 0, failures };
+}
 
 // ../../packages/aeg-core/src/test-plan-section.ts
 var HEADING_FORM_RE = /^#{1,4}[ \t]*(?:\d+[a-z]?\.[ \t]*)?\*{0,2}Test Plan\*{0,2}[ \t]*$/im;
@@ -2790,6 +2849,7 @@ function checkG1(rows, existsFn) {
   }
   return { check: "G1", status: findings.length > 0 ? "fail" : "pass", findings };
 }
+var SCAFFOLD_PLACEHOLDER = "[undocumented — fill in why]";
 function checkG2(rows, candidateFiles) {
   const implementations = new Set(rows.map((r) => r.implementation).filter((p) => p !== ""));
   const findings = [];
@@ -2801,6 +2861,16 @@ function checkG2(rows, candidateFiles) {
       });
     }
   }
+  for (const row of rows) {
+    const carriesPlaceholder = [row.summary, row.description, row.spec].some((cell) => cell === SCAFFOLD_PLACEHOLDER);
+    if (carriesPlaceholder) {
+      findings.push({
+        row: row.action,
+        path: row.implementation,
+        reason: `${row.ring} row "${row.action}" still carries the scaffold placeholder marker — the why is owed`
+      });
+    }
+  }
   return { check: "G2", status: findings.length > 0 ? "info" : "pass", findings };
 }
 function checkG3(ring0Rows, crossingFiles) {
@@ -3320,6 +3390,29 @@ function isNewDiskStateFile(path, status) {
     return false;
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
+// ../../packages/aeg-core/src/main-branch-refusal.ts
+function checkMainBranchRefusal(facts) {
+  const { currentSymbolicBranch, defaultBranch } = facts;
+  if (currentSymbolicBranch === null)
+    return null;
+  if (defaultBranch === null) {
+    return {
+      reason: "default-branch-undetermined",
+      severity: "warning",
+      currentBranch: currentSymbolicBranch,
+      defaultBranch: null
+    };
+  }
+  if (currentSymbolicBranch === defaultBranch) {
+    return {
+      reason: "on-default-branch",
+      severity: "error",
+      currentBranch: currentSymbolicBranch,
+      defaultBranch
+    };
+  }
+  return null;
+}
 // ../../packages/aeg-core/src/branch-topology-gate.ts
 function taskBranchTopologyFields(branch) {
   if (!/^task\/.*\/.*$/.test(branch))
@@ -3609,8 +3702,8 @@ var BIN_EXT = BIN_DIR === DIST_BIN_DIR ? ".js" : ".ts";
 function bin(name) {
   return join2(BIN_DIR, `${name}${BIN_EXT}`);
 }
-function coreCheckRegistry() {
-  return [
+var REGISTRY = [
+  [
     {
       name: "brief-shape",
       run: bin("check-brief-shape"),
@@ -3621,6 +3714,9 @@ function coreCheckRegistry() {
         BRANCH: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "doc-coverage",
       run: bin("check-doc-coverage"),
@@ -3636,6 +3732,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "coherence",
       run: bin("check-coherence"),
@@ -3648,6 +3747,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "dispatch-readiness",
       run: bin("check-dispatch-readiness"),
@@ -3657,9 +3759,13 @@ function coreCheckRegistry() {
         AEG_REPO: { optional: true },
         BRANCH: { optional: true },
         GITHUB_TOKEN: { optional: true },
-        GH_TOKEN: { optional: true }
+        GH_TOKEN: { optional: true },
+        PREMISE_FILE: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "closes-n",
       run: bin("check-closes-n"),
@@ -3674,6 +3780,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    1
+  ],
+  [
     {
       name: "single-plan-pr",
       run: bin("check-single-plan-pr"),
@@ -3686,6 +3795,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "test-plan",
       run: bin("check-test-plan"),
@@ -3697,6 +3809,9 @@ function coreCheckRegistry() {
         BRANCH: { optional: true }
       }
     },
+    1
+  ],
+  [
     {
       name: "body-bare-digits",
       run: bin("check-body-bare-digits"),
@@ -3712,6 +3827,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    1
+  ],
+  [
     {
       name: "no-disk-state",
       run: bin("check-no-disk-state"),
@@ -3719,6 +3837,9 @@ function coreCheckRegistry() {
       timeoutMs: 15000,
       env: { BASE_SHA: { optional: true } }
     },
+    0
+  ],
+  [
     {
       name: "registry-gates",
       run: bin("check-registry-gates"),
@@ -3730,6 +3851,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "review-gate",
       run: bin("check-review-gate"),
@@ -3743,6 +3867,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    1
+  ],
+  [
     {
       name: "branch-topology",
       run: bin("check-branch-topology"),
@@ -3755,6 +3882,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "dead-branch-push",
       run: bin("check-dead-branch-push"),
@@ -3766,6 +3896,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "first-push-dispatch",
       run: bin("check-first-push-dispatch"),
@@ -3778,6 +3911,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "doc-coverage-push",
       run: bin("check-doc-coverage-push"),
@@ -3795,6 +3931,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "issue-assignment",
       run: bin("check-issue-assignment"),
@@ -3807,6 +3946,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "evidence-fresh",
       run: bin("check-evidence-fresh"),
@@ -3821,6 +3963,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    1
+  ],
+  [
     {
       name: "reader-resolvable-prose",
       run: bin("check-reader-resolvable-prose"),
@@ -3828,6 +3973,9 @@ function coreCheckRegistry() {
       timeoutMs: 30000,
       env: {}
     },
+    0
+  ],
+  [
     {
       name: "retired-vocabulary",
       run: bin("check-retired-vocabulary"),
@@ -3835,6 +3983,9 @@ function coreCheckRegistry() {
       timeoutMs: 30000,
       env: {}
     },
+    0
+  ],
+  [
     {
       name: "doctrine-portability",
       run: bin("check-doctrine-portability"),
@@ -3842,15 +3993,33 @@ function coreCheckRegistry() {
       timeoutMs: 30000,
       env: { BASE_SHA: { optional: true } }
     },
+    0
+  ],
+  [
     {
       name: "workspace-escape",
       run: bin("check-workspace-escape"),
       scope: "full",
       timeoutMs: 30000,
       env: {}
-    }
-  ];
+    },
+    0
+  ],
+  [
+    {
+      name: "main-branch-refusal",
+      run: bin("check-main-branch-refusal"),
+      scope: "full",
+      timeoutMs: 15000,
+      env: {}
+    },
+    0
+  ]
+];
+function coreCheckRegistry() {
+  return REGISTRY.map(([spec]) => spec);
 }
+var CORE_CHECK_RING = Object.fromEntries(REGISTRY.map(([spec, ring]) => [spec.name, ring]));
 
 // src/checks/bin/check-registry-gates.ts
 var CHECK_NAME = "registry-gates";

package/dist/checks/bin/check-retired-vocabulary.js

@@ -2,20 +2,20 @@
 
 // src/checks/bin/check-retired-vocabulary.ts
 import { readdirSync as readdirSync2, readFileSync as readFileSync3, statSync } from "node:fs";
-import { join as join4 } from "node:path";
+import { join as join5, resolve } from "node:path";
 // ../../packages/aeg-core/src/gate-audience.ts
 var GATE_AUDIENCE = {
-  "check-branch-topology": { shippedAs: "branch-topology" },
-  "check-first-push-dispatch": { shippedAs: "first-push-dispatch" },
-  "check-no-disk-state": { shippedAs: "no-disk-state" },
-  "verify-brief": { shippedAs: "brief-shape" },
-  "verify-coherence": { shippedAs: "coherence" },
-  "verify-dispatch": { shippedAs: "dispatch-readiness" },
-  "verify-docs": { shippedAs: ["doc-coverage", "doc-coverage-push"] },
-  "verify-registry": { shippedAs: "registry-gates" },
-  "verify-review-gate": { shippedAs: "review-gate" },
-  "verify-single-plan-pr": { shippedAs: "single-plan-pr" },
-  "verify-test-plan": { shippedAs: "test-plan" },
+  "check-branch-topology": { shippedAs: "branch-topology", ring: 0 },
+  "check-first-push-dispatch": { shippedAs: "first-push-dispatch", ring: 0 },
+  "check-no-disk-state": { shippedAs: "no-disk-state", ring: 0 },
+  "verify-brief": { shippedAs: "brief-shape", ring: 0 },
+  "verify-coherence": { shippedAs: "coherence", ring: 0 },
+  "verify-dispatch": { shippedAs: "dispatch-readiness", ring: 0 },
+  "verify-docs": { shippedAs: ["doc-coverage", "doc-coverage-push"], ring: 0 },
+  "verify-registry": { shippedAs: "registry-gates", ring: 0 },
+  "verify-review-gate": { shippedAs: "review-gate", ring: 1 },
+  "verify-single-plan-pr": { shippedAs: "single-plan-pr", ring: 0 },
+  "verify-test-plan": { shippedAs: "test-plan", ring: 1 },
   "check-direct-main-push": {
     internal: "Reaches adopters through `vinaya audit --only=direct-push`, not the check registry: it is a ring-2 sweep over merge history keyed on `GITHUB_SHA`, run by the generated archivist job on push to the default branch. It has no diff to key on, so there is nothing for `vinaya check` to run it against."
   },
@@ -327,6 +327,13 @@ var LABELS = [
     form: "literal",
     carries: "Execution is halted pending an external unblock; wins over every other derived status."
   },
+  {
+    key: "backlog",
+    id: "vinaya/backlog",
+    category: "state",
+    form: "literal",
+    carries: "The Issue is deliberately unplanned — belongs to no tranche and is excluded from dispatch, until a Planner promotes it."
+  },
   {
     key: "tier-0",
     id: "vinaya/tier:0",
@@ -1985,7 +1992,59 @@ function overrideActive(opts) {
   return false;
 }
 // ../../packages/aeg-core/src/premise-check.ts
+import { createHash } from "node:crypto";
 var ASSERTION_KINDS = new Set(["contains", "absent", "sha256"]);
+function isPremiseHeader(line) {
+  const stripped = line.replace(/[*#]/g, "").trim();
+  return /^premise\s*:?$/i.test(stripped);
+}
+var PREMISE_LINE = /^[-*]\s*(\S+)\s+(contains|absent|sha256)\s*:\s*(.+)$/i;
+function parsePremiseBlock(prBody) {
+  const searchIn = anchoredRegion(prBody, "PREMISE") ?? prBody;
+  const lines = searchIn.split(/\r?\n/);
+  const assertions = [];
+  let inBlock = false;
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!inBlock) {
+      if (isPremiseHeader(line))
+        inBlock = true;
+      continue;
+    }
+    if (line === "")
+      break;
+    const m = line.match(PREMISE_LINE);
+    if (!m)
+      break;
+    const [, path, kindRaw, value] = m;
+    const kind = kindRaw.toLowerCase();
+    if (!ASSERTION_KINDS.has(kind))
+      continue;
+    assertions.push({ kind, path, value: value.trim() });
+  }
+  return assertions;
+}
+function checkPremises(assertions, fileReader) {
+  const failures = [];
+  for (const a of assertions) {
+    const content = fileReader(a.path);
+    if (content === null) {
+      failures.push(`premise-check: ${a.path} does not exist on disk (premise asserted \`${a.kind}: ${a.value}\`) — the surface moved since this brief was authored; re-dig before proceeding.`);
+      continue;
+    }
+    if (a.kind === "contains" && !content.includes(a.value)) {
+      failures.push(`premise-check: ${a.path} no longer contains "${a.value}" — the premise this brief pinned has moved; re-dig before proceeding.`);
+    } else if (a.kind === "absent" && content.includes(a.value)) {
+      failures.push(`premise-check: ${a.path} now contains "${a.value}", but the brief pinned it absent — the premise has moved; re-dig before proceeding.`);
+    } else if (a.kind === "sha256") {
+      const actual = createHash("sha256").update(content).digest("hex");
+      if (actual !== a.value.toLowerCase()) {
+        failures.push(`premise-check: ${a.path} sha256 mismatch (brief pinned ${a.value}, file is now ${actual}) — the file changed since this brief was authored; re-dig before proceeding.`);
+      }
+    }
+  }
+  return { pass: failures.length === 0, failures };
+}
 
 // ../../packages/aeg-core/src/test-plan-section.ts
 var HEADING_FORM_RE = /^#{1,4}[ \t]*(?:\d+[a-z]?\.[ \t]*)?\*{0,2}Test Plan\*{0,2}[ \t]*$/im;
@@ -2789,6 +2848,7 @@ function checkG1(rows, existsFn) {
   }
   return { check: "G1", status: findings.length > 0 ? "fail" : "pass", findings };
 }
+var SCAFFOLD_PLACEHOLDER = "[undocumented — fill in why]";
 function checkG2(rows, candidateFiles) {
   const implementations = new Set(rows.map((r) => r.implementation).filter((p) => p !== ""));
   const findings = [];
@@ -2800,6 +2860,16 @@ function checkG2(rows, candidateFiles) {
       });
     }
   }
+  for (const row of rows) {
+    const carriesPlaceholder = [row.summary, row.description, row.spec].some((cell) => cell === SCAFFOLD_PLACEHOLDER);
+    if (carriesPlaceholder) {
+      findings.push({
+        row: row.action,
+        path: row.implementation,
+        reason: `${row.ring} row "${row.action}" still carries the scaffold placeholder marker — the why is owed`
+      });
+    }
+  }
   return { check: "G2", status: findings.length > 0 ? "info" : "pass", findings };
 }
 function checkG3(ring0Rows, crossingFiles) {
@@ -3319,6 +3389,29 @@ function isNewDiskStateFile(path, status) {
     return false;
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
+// ../../packages/aeg-core/src/main-branch-refusal.ts
+function checkMainBranchRefusal(facts) {
+  const { currentSymbolicBranch, defaultBranch } = facts;
+  if (currentSymbolicBranch === null)
+    return null;
+  if (defaultBranch === null) {
+    return {
+      reason: "default-branch-undetermined",
+      severity: "warning",
+      currentBranch: currentSymbolicBranch,
+      defaultBranch: null
+    };
+  }
+  if (currentSymbolicBranch === defaultBranch) {
+    return {
+      reason: "on-default-branch",
+      severity: "error",
+      currentBranch: currentSymbolicBranch,
+      defaultBranch
+    };
+  }
+  return null;
+}
 // ../../packages/aeg-core/src/branch-topology-gate.ts
 function taskBranchTopologyFields(branch) {
   if (!/^task\/.*\/.*$/.test(branch))
@@ -3700,8 +3793,15 @@ function isSafeRepoRelPath(p) {
 var SafeRepoRelPath = z.string().refine(isSafeRepoRelPath, {
   message: "must be a repo-root-relative path with no `..` segment or absolute root"
 });
+var CANONICAL_HOOK_BLOCK_PREFIXES = [".git/", ".husky/", ".vinaya/hooks/", ".claude/hooks/"];
+function isCanonicalHookBlockPath(p) {
+  return CANONICAL_HOOK_BLOCK_PREFIXES.some((prefix) => p.startsWith(prefix) && p.length > prefix.length);
+}
+var ManagedHookBlockPath = SafeRepoRelPath.refine(isCanonicalHookBlockPath, {
+  message: `must start with one of ${CANONICAL_HOOK_BLOCK_PREFIXES.join(", ")} (byte-exact, case-sensitive)`
+});
 var ManagedBlockRecordSchema = z.object({
-  path: SafeRepoRelPath,
+  path: ManagedHookBlockPath,
   marker: z.string(),
   comment: z.enum(["hash", "html"])
 });
@@ -3882,6 +3982,71 @@ function emitCheckError(error) {
 `);
 }
 
+// src/lib/diff-evidence.ts
+import { execFileSync as execFileSync3 } from "node:child_process";
+import { join as join4 } from "node:path";
+function fileDiffAgainst(ref, path) {
+  let out;
+  try {
+    out = execFileSync3("git", ["diff", `${ref}...HEAD`, "--", path], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+  } catch {
+    return null;
+  }
+  return out === "" ? null : out;
+}
+function revParse(ref) {
+  try {
+    return execFileSync3("git", ["rev-parse", "--verify", ref], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function repoRoot() {
+  try {
+    return execFileSync3("git", ["rev-parse", "--show-toplevel"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function changedFiles(base) {
+  let out;
+  try {
+    out = execFileSync3("git", ["diff", "--name-only", `${base}...HEAD`], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+  } catch {
+    return null;
+  }
+  return out === "" ? [] : out.split(`
+`).map((s) => s.trim()).filter(Boolean);
+}
+function resolveChangedFiles(base = process.env.BASE_SHA || "origin/main") {
+  const root = repoRoot();
+  if (root === null)
+    return null;
+  const head = revParse("HEAD");
+  for (const ref of [base, "main"]) {
+    const resolved = revParse(ref);
+    if (resolved === null || resolved === head)
+      continue;
+    const relPaths = changedFiles(ref);
+    if (relPaths === null)
+      continue;
+    return relPaths.map((p) => join4(root, p));
+  }
+  return null;
+}
+
 // src/checks/bin/check-retired-vocabulary.ts
 var CHECK_NAME = "retired-vocabulary";
 var DOCTRINE_ROOT = loadConfig()?.proseGates?.doctrineRoot ?? resolveDoctrineRoot() ?? "aeg-root";
@@ -3896,7 +4061,7 @@ function collect(dir, out = []) {
     return out;
   }
   for (const name of entries) {
-    const full = join4(dir, name);
+    const full = join5(dir, name);
     let isDir;
     try {
       isDir = statSync(full).isDirectory();
@@ -3920,8 +4085,12 @@ function main() {
   const paths = collect(DOCTRINE_ROOT);
   const files = readAll(paths);
   const findings = scanRetiredVocabulary(files);
-  console.log(`${CHECK_NAME}: doctrine root "${DOCTRINE_ROOT}"; ${paths.length} file(s) swept; ${findings.length} finding(s)`);
-  for (const finding of findings) {
+  const changedFilesList = resolveChangedFiles();
+  const changed = changedFilesList === null ? null : new Set(changedFilesList);
+  const pathBase = repoRoot() ?? process.cwd();
+  const reportable = changed === null ? findings : findings.filter((f) => changed.has(resolve(pathBase, f.file)));
+  console.log(`${CHECK_NAME}: doctrine root "${DOCTRINE_ROOT}"; ${paths.length} file(s) swept; ${findings.length} finding(s), ${reportable.length} in this diff`);
+  for (const finding of reportable) {
     emitCheckError({
       schema: CHECK_SCHEMA_VERSION,
       check: CHECK_NAME,