@attalabs/vinaya 0.19.3 → 0.20.1

package/dist/checks/bin/check-review-gate.js

@@ -4,17 +4,17 @@
 import { execFileSync as execFileSync3 } from "node:child_process";
 // ../../packages/aeg-core/src/gate-audience.ts
 var GATE_AUDIENCE = {
-  "check-branch-topology": { shippedAs: "branch-topology" },
-  "check-first-push-dispatch": { shippedAs: "first-push-dispatch" },
-  "check-no-disk-state": { shippedAs: "no-disk-state" },
-  "verify-brief": { shippedAs: "brief-shape" },
-  "verify-coherence": { shippedAs: "coherence" },
-  "verify-dispatch": { shippedAs: "dispatch-readiness" },
-  "verify-docs": { shippedAs: ["doc-coverage", "doc-coverage-push"] },
-  "verify-registry": { shippedAs: "registry-gates" },
-  "verify-review-gate": { shippedAs: "review-gate" },
-  "verify-single-plan-pr": { shippedAs: "single-plan-pr" },
-  "verify-test-plan": { shippedAs: "test-plan" },
+  "check-branch-topology": { shippedAs: "branch-topology", ring: 0 },
+  "check-first-push-dispatch": { shippedAs: "first-push-dispatch", ring: 0 },
+  "check-no-disk-state": { shippedAs: "no-disk-state", ring: 0 },
+  "verify-brief": { shippedAs: "brief-shape", ring: 0 },
+  "verify-coherence": { shippedAs: "coherence", ring: 0 },
+  "verify-dispatch": { shippedAs: "dispatch-readiness", ring: 0 },
+  "verify-docs": { shippedAs: ["doc-coverage", "doc-coverage-push"], ring: 0 },
+  "verify-registry": { shippedAs: "registry-gates", ring: 0 },
+  "verify-review-gate": { shippedAs: "review-gate", ring: 1 },
+  "verify-single-plan-pr": { shippedAs: "single-plan-pr", ring: 0 },
+  "verify-test-plan": { shippedAs: "test-plan", ring: 1 },
   "check-direct-main-push": {
     internal: "Reaches adopters through `vinaya audit --only=direct-push`, not the check registry: it is a ring-2 sweep over merge history keyed on `GITHUB_SHA`, run by the generated archivist job on push to the default branch. It has no diff to key on, so there is nothing for `vinaya check` to run it against."
   },
@@ -326,6 +326,13 @@ var LABELS = [
     form: "literal",
     carries: "Execution is halted pending an external unblock; wins over every other derived status."
   },
+  {
+    key: "backlog",
+    id: "vinaya/backlog",
+    category: "state",
+    form: "literal",
+    carries: "The Issue is deliberately unplanned — belongs to no tranche and is excluded from dispatch, until a Planner promotes it."
+  },
   {
     key: "tier-0",
     id: "vinaya/tier:0",
@@ -1984,7 +1991,59 @@ function overrideActive(opts) {
   return false;
 }
 // ../../packages/aeg-core/src/premise-check.ts
+import { createHash } from "node:crypto";
 var ASSERTION_KINDS = new Set(["contains", "absent", "sha256"]);
+function isPremiseHeader(line) {
+  const stripped = line.replace(/[*#]/g, "").trim();
+  return /^premise\s*:?$/i.test(stripped);
+}
+var PREMISE_LINE = /^[-*]\s*(\S+)\s+(contains|absent|sha256)\s*:\s*(.+)$/i;
+function parsePremiseBlock(prBody) {
+  const searchIn = anchoredRegion(prBody, "PREMISE") ?? prBody;
+  const lines = searchIn.split(/\r?\n/);
+  const assertions = [];
+  let inBlock = false;
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!inBlock) {
+      if (isPremiseHeader(line))
+        inBlock = true;
+      continue;
+    }
+    if (line === "")
+      break;
+    const m = line.match(PREMISE_LINE);
+    if (!m)
+      break;
+    const [, path, kindRaw, value] = m;
+    const kind = kindRaw.toLowerCase();
+    if (!ASSERTION_KINDS.has(kind))
+      continue;
+    assertions.push({ kind, path, value: value.trim() });
+  }
+  return assertions;
+}
+function checkPremises(assertions, fileReader) {
+  const failures = [];
+  for (const a of assertions) {
+    const content = fileReader(a.path);
+    if (content === null) {
+      failures.push(`premise-check: ${a.path} does not exist on disk (premise asserted \`${a.kind}: ${a.value}\`) — the surface moved since this brief was authored; re-dig before proceeding.`);
+      continue;
+    }
+    if (a.kind === "contains" && !content.includes(a.value)) {
+      failures.push(`premise-check: ${a.path} no longer contains "${a.value}" — the premise this brief pinned has moved; re-dig before proceeding.`);
+    } else if (a.kind === "absent" && content.includes(a.value)) {
+      failures.push(`premise-check: ${a.path} now contains "${a.value}", but the brief pinned it absent — the premise has moved; re-dig before proceeding.`);
+    } else if (a.kind === "sha256") {
+      const actual = createHash("sha256").update(content).digest("hex");
+      if (actual !== a.value.toLowerCase()) {
+        failures.push(`premise-check: ${a.path} sha256 mismatch (brief pinned ${a.value}, file is now ${actual}) — the file changed since this brief was authored; re-dig before proceeding.`);
+      }
+    }
+  }
+  return { pass: failures.length === 0, failures };
+}
 
 // ../../packages/aeg-core/src/test-plan-section.ts
 var HEADING_FORM_RE = /^#{1,4}[ \t]*(?:\d+[a-z]?\.[ \t]*)?\*{0,2}Test Plan\*{0,2}[ \t]*$/im;
@@ -2788,6 +2847,7 @@ function checkG1(rows, existsFn) {
   }
   return { check: "G1", status: findings.length > 0 ? "fail" : "pass", findings };
 }
+var SCAFFOLD_PLACEHOLDER = "[undocumented — fill in why]";
 function checkG2(rows, candidateFiles) {
   const implementations = new Set(rows.map((r) => r.implementation).filter((p) => p !== ""));
   const findings = [];
@@ -2799,6 +2859,16 @@ function checkG2(rows, candidateFiles) {
       });
     }
   }
+  for (const row of rows) {
+    const carriesPlaceholder = [row.summary, row.description, row.spec].some((cell) => cell === SCAFFOLD_PLACEHOLDER);
+    if (carriesPlaceholder) {
+      findings.push({
+        row: row.action,
+        path: row.implementation,
+        reason: `${row.ring} row "${row.action}" still carries the scaffold placeholder marker — the why is owed`
+      });
+    }
+  }
   return { check: "G2", status: findings.length > 0 ? "info" : "pass", findings };
 }
 function checkG3(ring0Rows, crossingFiles) {
@@ -3318,6 +3388,29 @@ function isNewDiskStateFile(path, status) {
     return false;
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
+// ../../packages/aeg-core/src/main-branch-refusal.ts
+function checkMainBranchRefusal(facts) {
+  const { currentSymbolicBranch, defaultBranch } = facts;
+  if (currentSymbolicBranch === null)
+    return null;
+  if (defaultBranch === null) {
+    return {
+      reason: "default-branch-undetermined",
+      severity: "warning",
+      currentBranch: currentSymbolicBranch,
+      defaultBranch: null
+    };
+  }
+  if (currentSymbolicBranch === defaultBranch) {
+    return {
+      reason: "on-default-branch",
+      severity: "error",
+      currentBranch: currentSymbolicBranch,
+      defaultBranch
+    };
+  }
+  return null;
+}
 // ../../packages/aeg-core/src/branch-topology-gate.ts
 function taskBranchTopologyFields(branch) {
   if (!/^task\/.*\/.*$/.test(branch))
@@ -3671,8 +3764,15 @@ function isSafeRepoRelPath(p) {
 var SafeRepoRelPath = z.string().refine(isSafeRepoRelPath, {
   message: "must be a repo-root-relative path with no `..` segment or absolute root"
 });
+var CANONICAL_HOOK_BLOCK_PREFIXES = [".git/", ".husky/", ".vinaya/hooks/", ".claude/hooks/"];
+function isCanonicalHookBlockPath(p) {
+  return CANONICAL_HOOK_BLOCK_PREFIXES.some((prefix) => p.startsWith(prefix) && p.length > prefix.length);
+}
+var ManagedHookBlockPath = SafeRepoRelPath.refine(isCanonicalHookBlockPath, {
+  message: `must start with one of ${CANONICAL_HOOK_BLOCK_PREFIXES.join(", ")} (byte-exact, case-sensitive)`
+});
 var ManagedBlockRecordSchema = z.object({
-  path: SafeRepoRelPath,
+  path: ManagedHookBlockPath,
   marker: z.string(),
   comment: z.enum(["hash", "html"])
 });

package/dist/checks/bin/check-single-plan-pr.js

@@ -4,17 +4,17 @@
 import { execFileSync as execFileSync2 } from "node:child_process";
 // ../../packages/aeg-core/src/gate-audience.ts
 var GATE_AUDIENCE = {
-  "check-branch-topology": { shippedAs: "branch-topology" },
-  "check-first-push-dispatch": { shippedAs: "first-push-dispatch" },
-  "check-no-disk-state": { shippedAs: "no-disk-state" },
-  "verify-brief": { shippedAs: "brief-shape" },
-  "verify-coherence": { shippedAs: "coherence" },
-  "verify-dispatch": { shippedAs: "dispatch-readiness" },
-  "verify-docs": { shippedAs: ["doc-coverage", "doc-coverage-push"] },
-  "verify-registry": { shippedAs: "registry-gates" },
-  "verify-review-gate": { shippedAs: "review-gate" },
-  "verify-single-plan-pr": { shippedAs: "single-plan-pr" },
-  "verify-test-plan": { shippedAs: "test-plan" },
+  "check-branch-topology": { shippedAs: "branch-topology", ring: 0 },
+  "check-first-push-dispatch": { shippedAs: "first-push-dispatch", ring: 0 },
+  "check-no-disk-state": { shippedAs: "no-disk-state", ring: 0 },
+  "verify-brief": { shippedAs: "brief-shape", ring: 0 },
+  "verify-coherence": { shippedAs: "coherence", ring: 0 },
+  "verify-dispatch": { shippedAs: "dispatch-readiness", ring: 0 },
+  "verify-docs": { shippedAs: ["doc-coverage", "doc-coverage-push"], ring: 0 },
+  "verify-registry": { shippedAs: "registry-gates", ring: 0 },
+  "verify-review-gate": { shippedAs: "review-gate", ring: 1 },
+  "verify-single-plan-pr": { shippedAs: "single-plan-pr", ring: 0 },
+  "verify-test-plan": { shippedAs: "test-plan", ring: 1 },
   "check-direct-main-push": {
     internal: "Reaches adopters through `vinaya audit --only=direct-push`, not the check registry: it is a ring-2 sweep over merge history keyed on `GITHUB_SHA`, run by the generated archivist job on push to the default branch. It has no diff to key on, so there is nothing for `vinaya check` to run it against."
   },
@@ -326,6 +326,13 @@ var LABELS = [
     form: "literal",
     carries: "Execution is halted pending an external unblock; wins over every other derived status."
   },
+  {
+    key: "backlog",
+    id: "vinaya/backlog",
+    category: "state",
+    form: "literal",
+    carries: "The Issue is deliberately unplanned — belongs to no tranche and is excluded from dispatch, until a Planner promotes it."
+  },
   {
     key: "tier-0",
     id: "vinaya/tier:0",
@@ -1984,7 +1991,59 @@ function overrideActive(opts) {
   return false;
 }
 // ../../packages/aeg-core/src/premise-check.ts
+import { createHash } from "node:crypto";
 var ASSERTION_KINDS = new Set(["contains", "absent", "sha256"]);
+function isPremiseHeader(line) {
+  const stripped = line.replace(/[*#]/g, "").trim();
+  return /^premise\s*:?$/i.test(stripped);
+}
+var PREMISE_LINE = /^[-*]\s*(\S+)\s+(contains|absent|sha256)\s*:\s*(.+)$/i;
+function parsePremiseBlock(prBody) {
+  const searchIn = anchoredRegion(prBody, "PREMISE") ?? prBody;
+  const lines = searchIn.split(/\r?\n/);
+  const assertions = [];
+  let inBlock = false;
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!inBlock) {
+      if (isPremiseHeader(line))
+        inBlock = true;
+      continue;
+    }
+    if (line === "")
+      break;
+    const m = line.match(PREMISE_LINE);
+    if (!m)
+      break;
+    const [, path, kindRaw, value] = m;
+    const kind = kindRaw.toLowerCase();
+    if (!ASSERTION_KINDS.has(kind))
+      continue;
+    assertions.push({ kind, path, value: value.trim() });
+  }
+  return assertions;
+}
+function checkPremises(assertions, fileReader) {
+  const failures = [];
+  for (const a of assertions) {
+    const content = fileReader(a.path);
+    if (content === null) {
+      failures.push(`premise-check: ${a.path} does not exist on disk (premise asserted \`${a.kind}: ${a.value}\`) — the surface moved since this brief was authored; re-dig before proceeding.`);
+      continue;
+    }
+    if (a.kind === "contains" && !content.includes(a.value)) {
+      failures.push(`premise-check: ${a.path} no longer contains "${a.value}" — the premise this brief pinned has moved; re-dig before proceeding.`);
+    } else if (a.kind === "absent" && content.includes(a.value)) {
+      failures.push(`premise-check: ${a.path} now contains "${a.value}", but the brief pinned it absent — the premise has moved; re-dig before proceeding.`);
+    } else if (a.kind === "sha256") {
+      const actual = createHash("sha256").update(content).digest("hex");
+      if (actual !== a.value.toLowerCase()) {
+        failures.push(`premise-check: ${a.path} sha256 mismatch (brief pinned ${a.value}, file is now ${actual}) — the file changed since this brief was authored; re-dig before proceeding.`);
+      }
+    }
+  }
+  return { pass: failures.length === 0, failures };
+}
 
 // ../../packages/aeg-core/src/test-plan-section.ts
 var HEADING_FORM_RE = /^#{1,4}[ \t]*(?:\d+[a-z]?\.[ \t]*)?\*{0,2}Test Plan\*{0,2}[ \t]*$/im;
@@ -2788,6 +2847,7 @@ function checkG1(rows, existsFn) {
   }
   return { check: "G1", status: findings.length > 0 ? "fail" : "pass", findings };
 }
+var SCAFFOLD_PLACEHOLDER = "[undocumented — fill in why]";
 function checkG2(rows, candidateFiles) {
   const implementations = new Set(rows.map((r) => r.implementation).filter((p) => p !== ""));
   const findings = [];
@@ -2799,6 +2859,16 @@ function checkG2(rows, candidateFiles) {
       });
     }
   }
+  for (const row of rows) {
+    const carriesPlaceholder = [row.summary, row.description, row.spec].some((cell) => cell === SCAFFOLD_PLACEHOLDER);
+    if (carriesPlaceholder) {
+      findings.push({
+        row: row.action,
+        path: row.implementation,
+        reason: `${row.ring} row "${row.action}" still carries the scaffold placeholder marker — the why is owed`
+      });
+    }
+  }
   return { check: "G2", status: findings.length > 0 ? "info" : "pass", findings };
 }
 function checkG3(ring0Rows, crossingFiles) {
@@ -3318,6 +3388,29 @@ function isNewDiskStateFile(path, status) {
     return false;
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
+// ../../packages/aeg-core/src/main-branch-refusal.ts
+function checkMainBranchRefusal(facts) {
+  const { currentSymbolicBranch, defaultBranch } = facts;
+  if (currentSymbolicBranch === null)
+    return null;
+  if (defaultBranch === null) {
+    return {
+      reason: "default-branch-undetermined",
+      severity: "warning",
+      currentBranch: currentSymbolicBranch,
+      defaultBranch: null
+    };
+  }
+  if (currentSymbolicBranch === defaultBranch) {
+    return {
+      reason: "on-default-branch",
+      severity: "error",
+      currentBranch: currentSymbolicBranch,
+      defaultBranch
+    };
+  }
+  return null;
+}
 // ../../packages/aeg-core/src/branch-topology-gate.ts
 function taskBranchTopologyFields(branch) {
   if (!/^task\/.*\/.*$/.test(branch))

package/dist/checks/bin/check-test-plan.js

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 // ../../packages/aeg-core/src/gate-audience.ts
 var GATE_AUDIENCE = {
-  "check-branch-topology": { shippedAs: "branch-topology" },
-  "check-first-push-dispatch": { shippedAs: "first-push-dispatch" },
-  "check-no-disk-state": { shippedAs: "no-disk-state" },
-  "verify-brief": { shippedAs: "brief-shape" },
-  "verify-coherence": { shippedAs: "coherence" },
-  "verify-dispatch": { shippedAs: "dispatch-readiness" },
-  "verify-docs": { shippedAs: ["doc-coverage", "doc-coverage-push"] },
-  "verify-registry": { shippedAs: "registry-gates" },
-  "verify-review-gate": { shippedAs: "review-gate" },
-  "verify-single-plan-pr": { shippedAs: "single-plan-pr" },
-  "verify-test-plan": { shippedAs: "test-plan" },
+  "check-branch-topology": { shippedAs: "branch-topology", ring: 0 },
+  "check-first-push-dispatch": { shippedAs: "first-push-dispatch", ring: 0 },
+  "check-no-disk-state": { shippedAs: "no-disk-state", ring: 0 },
+  "verify-brief": { shippedAs: "brief-shape", ring: 0 },
+  "verify-coherence": { shippedAs: "coherence", ring: 0 },
+  "verify-dispatch": { shippedAs: "dispatch-readiness", ring: 0 },
+  "verify-docs": { shippedAs: ["doc-coverage", "doc-coverage-push"], ring: 0 },
+  "verify-registry": { shippedAs: "registry-gates", ring: 0 },
+  "verify-review-gate": { shippedAs: "review-gate", ring: 1 },
+  "verify-single-plan-pr": { shippedAs: "single-plan-pr", ring: 0 },
+  "verify-test-plan": { shippedAs: "test-plan", ring: 1 },
   "check-direct-main-push": {
     internal: "Reaches adopters through `vinaya audit --only=direct-push`, not the check registry: it is a ring-2 sweep over merge history keyed on `GITHUB_SHA`, run by the generated archivist job on push to the default branch. It has no diff to key on, so there is nothing for `vinaya check` to run it against."
   },
@@ -323,6 +323,13 @@ var LABELS = [
     form: "literal",
     carries: "Execution is halted pending an external unblock; wins over every other derived status."
   },
+  {
+    key: "backlog",
+    id: "vinaya/backlog",
+    category: "state",
+    form: "literal",
+    carries: "The Issue is deliberately unplanned — belongs to no tranche and is excluded from dispatch, until a Planner promotes it."
+  },
   {
     key: "tier-0",
     id: "vinaya/tier:0",
@@ -1981,7 +1988,59 @@ function overrideActive(opts) {
   return false;
 }
 // ../../packages/aeg-core/src/premise-check.ts
+import { createHash } from "node:crypto";
 var ASSERTION_KINDS = new Set(["contains", "absent", "sha256"]);
+function isPremiseHeader(line) {
+  const stripped = line.replace(/[*#]/g, "").trim();
+  return /^premise\s*:?$/i.test(stripped);
+}
+var PREMISE_LINE = /^[-*]\s*(\S+)\s+(contains|absent|sha256)\s*:\s*(.+)$/i;
+function parsePremiseBlock(prBody) {
+  const searchIn = anchoredRegion(prBody, "PREMISE") ?? prBody;
+  const lines = searchIn.split(/\r?\n/);
+  const assertions = [];
+  let inBlock = false;
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!inBlock) {
+      if (isPremiseHeader(line))
+        inBlock = true;
+      continue;
+    }
+    if (line === "")
+      break;
+    const m = line.match(PREMISE_LINE);
+    if (!m)
+      break;
+    const [, path, kindRaw, value] = m;
+    const kind = kindRaw.toLowerCase();
+    if (!ASSERTION_KINDS.has(kind))
+      continue;
+    assertions.push({ kind, path, value: value.trim() });
+  }
+  return assertions;
+}
+function checkPremises(assertions, fileReader) {
+  const failures = [];
+  for (const a of assertions) {
+    const content = fileReader(a.path);
+    if (content === null) {
+      failures.push(`premise-check: ${a.path} does not exist on disk (premise asserted \`${a.kind}: ${a.value}\`) — the surface moved since this brief was authored; re-dig before proceeding.`);
+      continue;
+    }
+    if (a.kind === "contains" && !content.includes(a.value)) {
+      failures.push(`premise-check: ${a.path} no longer contains "${a.value}" — the premise this brief pinned has moved; re-dig before proceeding.`);
+    } else if (a.kind === "absent" && content.includes(a.value)) {
+      failures.push(`premise-check: ${a.path} now contains "${a.value}", but the brief pinned it absent — the premise has moved; re-dig before proceeding.`);
+    } else if (a.kind === "sha256") {
+      const actual = createHash("sha256").update(content).digest("hex");
+      if (actual !== a.value.toLowerCase()) {
+        failures.push(`premise-check: ${a.path} sha256 mismatch (brief pinned ${a.value}, file is now ${actual}) — the file changed since this brief was authored; re-dig before proceeding.`);
+      }
+    }
+  }
+  return { pass: failures.length === 0, failures };
+}
 
 // ../../packages/aeg-core/src/test-plan-section.ts
 var HEADING_FORM_RE = /^#{1,4}[ \t]*(?:\d+[a-z]?\.[ \t]*)?\*{0,2}Test Plan\*{0,2}[ \t]*$/im;
@@ -2785,6 +2844,7 @@ function checkG1(rows, existsFn) {
   }
   return { check: "G1", status: findings.length > 0 ? "fail" : "pass", findings };
 }
+var SCAFFOLD_PLACEHOLDER = "[undocumented — fill in why]";
 function checkG2(rows, candidateFiles) {
   const implementations = new Set(rows.map((r) => r.implementation).filter((p) => p !== ""));
   const findings = [];
@@ -2796,6 +2856,16 @@ function checkG2(rows, candidateFiles) {
       });
     }
   }
+  for (const row of rows) {
+    const carriesPlaceholder = [row.summary, row.description, row.spec].some((cell) => cell === SCAFFOLD_PLACEHOLDER);
+    if (carriesPlaceholder) {
+      findings.push({
+        row: row.action,
+        path: row.implementation,
+        reason: `${row.ring} row "${row.action}" still carries the scaffold placeholder marker — the why is owed`
+      });
+    }
+  }
   return { check: "G2", status: findings.length > 0 ? "info" : "pass", findings };
 }
 function checkG3(ring0Rows, crossingFiles) {
@@ -3315,6 +3385,29 @@ function isNewDiskStateFile(path, status) {
     return false;
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
+// ../../packages/aeg-core/src/main-branch-refusal.ts
+function checkMainBranchRefusal(facts) {
+  const { currentSymbolicBranch, defaultBranch } = facts;
+  if (currentSymbolicBranch === null)
+    return null;
+  if (defaultBranch === null) {
+    return {
+      reason: "default-branch-undetermined",
+      severity: "warning",
+      currentBranch: currentSymbolicBranch,
+      defaultBranch: null
+    };
+  }
+  if (currentSymbolicBranch === defaultBranch) {
+    return {
+      reason: "on-default-branch",
+      severity: "error",
+      currentBranch: currentSymbolicBranch,
+      defaultBranch
+    };
+  }
+  return null;
+}
 // ../../packages/aeg-core/src/branch-topology-gate.ts
 function taskBranchTopologyFields(branch) {
   if (!/^task\/.*\/.*$/.test(branch))

package/dist/checks/bin/check-workspace-escape.js

@@ -5,17 +5,17 @@ import { readdirSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 // ../../packages/aeg-core/src/gate-audience.ts
 var GATE_AUDIENCE = {
-  "check-branch-topology": { shippedAs: "branch-topology" },
-  "check-first-push-dispatch": { shippedAs: "first-push-dispatch" },
-  "check-no-disk-state": { shippedAs: "no-disk-state" },
-  "verify-brief": { shippedAs: "brief-shape" },
-  "verify-coherence": { shippedAs: "coherence" },
-  "verify-dispatch": { shippedAs: "dispatch-readiness" },
-  "verify-docs": { shippedAs: ["doc-coverage", "doc-coverage-push"] },
-  "verify-registry": { shippedAs: "registry-gates" },
-  "verify-review-gate": { shippedAs: "review-gate" },
-  "verify-single-plan-pr": { shippedAs: "single-plan-pr" },
-  "verify-test-plan": { shippedAs: "test-plan" },
+  "check-branch-topology": { shippedAs: "branch-topology", ring: 0 },
+  "check-first-push-dispatch": { shippedAs: "first-push-dispatch", ring: 0 },
+  "check-no-disk-state": { shippedAs: "no-disk-state", ring: 0 },
+  "verify-brief": { shippedAs: "brief-shape", ring: 0 },
+  "verify-coherence": { shippedAs: "coherence", ring: 0 },
+  "verify-dispatch": { shippedAs: "dispatch-readiness", ring: 0 },
+  "verify-docs": { shippedAs: ["doc-coverage", "doc-coverage-push"], ring: 0 },
+  "verify-registry": { shippedAs: "registry-gates", ring: 0 },
+  "verify-review-gate": { shippedAs: "review-gate", ring: 1 },
+  "verify-single-plan-pr": { shippedAs: "single-plan-pr", ring: 0 },
+  "verify-test-plan": { shippedAs: "test-plan", ring: 1 },
   "check-direct-main-push": {
     internal: "Reaches adopters through `vinaya audit --only=direct-push`, not the check registry: it is a ring-2 sweep over merge history keyed on `GITHUB_SHA`, run by the generated archivist job on push to the default branch. It has no diff to key on, so there is nothing for `vinaya check` to run it against."
   },
@@ -327,6 +327,13 @@ var LABELS = [
     form: "literal",
     carries: "Execution is halted pending an external unblock; wins over every other derived status."
   },
+  {
+    key: "backlog",
+    id: "vinaya/backlog",
+    category: "state",
+    form: "literal",
+    carries: "The Issue is deliberately unplanned — belongs to no tranche and is excluded from dispatch, until a Planner promotes it."
+  },
   {
     key: "tier-0",
     id: "vinaya/tier:0",
@@ -1985,7 +1992,59 @@ function overrideActive(opts) {
   return false;
 }
 // ../../packages/aeg-core/src/premise-check.ts
+import { createHash } from "node:crypto";
 var ASSERTION_KINDS = new Set(["contains", "absent", "sha256"]);
+function isPremiseHeader(line) {
+  const stripped = line.replace(/[*#]/g, "").trim();
+  return /^premise\s*:?$/i.test(stripped);
+}
+var PREMISE_LINE = /^[-*]\s*(\S+)\s+(contains|absent|sha256)\s*:\s*(.+)$/i;
+function parsePremiseBlock(prBody) {
+  const searchIn = anchoredRegion(prBody, "PREMISE") ?? prBody;
+  const lines = searchIn.split(/\r?\n/);
+  const assertions = [];
+  let inBlock = false;
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!inBlock) {
+      if (isPremiseHeader(line))
+        inBlock = true;
+      continue;
+    }
+    if (line === "")
+      break;
+    const m = line.match(PREMISE_LINE);
+    if (!m)
+      break;
+    const [, path, kindRaw, value] = m;
+    const kind = kindRaw.toLowerCase();
+    if (!ASSERTION_KINDS.has(kind))
+      continue;
+    assertions.push({ kind, path, value: value.trim() });
+  }
+  return assertions;
+}
+function checkPremises(assertions, fileReader) {
+  const failures = [];
+  for (const a of assertions) {
+    const content = fileReader(a.path);
+    if (content === null) {
+      failures.push(`premise-check: ${a.path} does not exist on disk (premise asserted \`${a.kind}: ${a.value}\`) — the surface moved since this brief was authored; re-dig before proceeding.`);
+      continue;
+    }
+    if (a.kind === "contains" && !content.includes(a.value)) {
+      failures.push(`premise-check: ${a.path} no longer contains "${a.value}" — the premise this brief pinned has moved; re-dig before proceeding.`);
+    } else if (a.kind === "absent" && content.includes(a.value)) {
+      failures.push(`premise-check: ${a.path} now contains "${a.value}", but the brief pinned it absent — the premise has moved; re-dig before proceeding.`);
+    } else if (a.kind === "sha256") {
+      const actual = createHash("sha256").update(content).digest("hex");
+      if (actual !== a.value.toLowerCase()) {
+        failures.push(`premise-check: ${a.path} sha256 mismatch (brief pinned ${a.value}, file is now ${actual}) — the file changed since this brief was authored; re-dig before proceeding.`);
+      }
+    }
+  }
+  return { pass: failures.length === 0, failures };
+}
 
 // ../../packages/aeg-core/src/test-plan-section.ts
 var HEADING_FORM_RE = /^#{1,4}[ \t]*(?:\d+[a-z]?\.[ \t]*)?\*{0,2}Test Plan\*{0,2}[ \t]*$/im;
@@ -2789,6 +2848,7 @@ function checkG1(rows, existsFn) {
   }
   return { check: "G1", status: findings.length > 0 ? "fail" : "pass", findings };
 }
+var SCAFFOLD_PLACEHOLDER = "[undocumented — fill in why]";
 function checkG2(rows, candidateFiles) {
   const implementations = new Set(rows.map((r) => r.implementation).filter((p) => p !== ""));
   const findings = [];
@@ -2800,6 +2860,16 @@ function checkG2(rows, candidateFiles) {
       });
     }
   }
+  for (const row of rows) {
+    const carriesPlaceholder = [row.summary, row.description, row.spec].some((cell) => cell === SCAFFOLD_PLACEHOLDER);
+    if (carriesPlaceholder) {
+      findings.push({
+        row: row.action,
+        path: row.implementation,
+        reason: `${row.ring} row "${row.action}" still carries the scaffold placeholder marker — the why is owed`
+      });
+    }
+  }
   return { check: "G2", status: findings.length > 0 ? "info" : "pass", findings };
 }
 function checkG3(ring0Rows, crossingFiles) {
@@ -3319,6 +3389,29 @@ function isNewDiskStateFile(path, status) {
     return false;
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
+// ../../packages/aeg-core/src/main-branch-refusal.ts
+function checkMainBranchRefusal(facts) {
+  const { currentSymbolicBranch, defaultBranch } = facts;
+  if (currentSymbolicBranch === null)
+    return null;
+  if (defaultBranch === null) {
+    return {
+      reason: "default-branch-undetermined",
+      severity: "warning",
+      currentBranch: currentSymbolicBranch,
+      defaultBranch: null
+    };
+  }
+  if (currentSymbolicBranch === defaultBranch) {
+    return {
+      reason: "on-default-branch",
+      severity: "error",
+      currentBranch: currentSymbolicBranch,
+      defaultBranch
+    };
+  }
+  return null;
+}
 // ../../packages/aeg-core/src/branch-topology-gate.ts
 function taskBranchTopologyFields(branch) {
   if (!/^task\/.*\/.*$/.test(branch))