@attalabs/vinaya 0.22.0 → 0.23.0

package/studio-standalone/_node_modules/@attalabs/aeg-core/src/file-classify.ts

@@ -0,0 +1,51 @@
+/**
+ * Path classifiers shared by the tier-derivation and doc-owners checks.
+ * Pure string predicates — no I/O.
+ */
+
+/**
+ * Decision archives: frozen records of what was decided, not documentation.
+ * Touching one must never satisfy C3's code-requires-docs pairing, carry a
+ * tier signal, or be held to a spec's `Status:` block.
+ *
+ * Recognized by filename suffix, never by an enumerated path list. An earlier
+ * form of this predicate hardcoded each consumer's archive by full path, which
+ * put specific product names inside a package that ships to adopters who have
+ * neither. The suffix is the actual rule — a file named `…decisions-legacy.md`
+ * is an archive in any repo — and it subsumes every path that list held, so
+ * the coupling was removable with no behavior change.
+ *
+ * The historical failure the path list was added to prevent (renaming an
+ * archive out of recognition) is not re-opened: the earlier rule required a
+ * `-decisions-legacy.md` suffix and so missed a top-level `decisions-legacy.md`
+ * with no prefix, which is why the list existed at all. Matching the bare
+ * suffix covers both shapes.
+ */
+export function isFrozenArchive(p: string): boolean {
+  return p.endsWith('decisions-legacy.md')
+}
+
+export function isDocFile(p: string): boolean {
+  return (
+    (p.startsWith('aeg-root/') && p.endsWith('.md')) ||
+    (p.startsWith('aeg-project/') && p.endsWith('.md')) ||
+    (p.includes('/aeg-project/') && p.endsWith('.md')) ||
+    (p.startsWith('.vinaya/') && p.endsWith('.md')) ||
+    (p.startsWith('docs/') && p.endsWith('.md') && !isFrozenArchive(p)) ||
+    (p.startsWith('apps/') && p.includes('/specs/') && p.endsWith('.md') && !isFrozenArchive(p)) ||
+    (p.startsWith('.claude/skills/') && p.endsWith('.md')) ||
+    /^(apps|packages)\/[^/]+\/README\.md$/.test(p) ||
+    p === 'docs-index.md' ||
+    p === 'README.md' ||
+    p === 'CLAUDE.md'
+  )
+}
+
+export function isCodeFile(p: string): boolean {
+  if (p.endsWith('.md')) return false
+  return /\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs|sql|css)$/.test(p)
+}
+
+export function isSpecFile(p: string): boolean {
+  return p.startsWith('apps/') && p.includes('/specs/') && p.endsWith('.md') && !isFrozenArchive(p)
+}

package/studio-standalone/_node_modules/@attalabs/aeg-core/src/first-push-dispatch-gate.ts

@@ -0,0 +1,80 @@
+/**
+ * First-push dispatch gate (aeg-governance-hardening task 25, #365). Pure —
+ * no `fs`, no `gh`/`git` shell-outs. The CLI shim (`bin/check-first-push-
+ * dispatch.ts`, wired into `.husky/pre-push`) runs the UNCHANGED
+ * `verify-dispatch.ts` gate mode once on a `task/<tranche>/<n>` branch's
+ * first push, maps its exit/output to a `DispatchReadinessFact`, and passes
+ * it in here.
+ *
+ * Mechanizes `roles/developer.md`'s entry-gate items 3–7 at the earliest
+ * possible moment — the first push — instead of relying on the Developer to
+ * run `verify-dispatch.ts` by hand before Step 0. Subsequent pushes (once a
+ * PR exists) skip the gate: dispatch readiness was validated once, and
+ * re-blocking mid-task on a sibling's later state change would strand
+ * in-flight work.
+ *
+ * `UNKNOWN` (forge unreachable — `verify-dispatch.ts`'s own `severity:infra`
+ * marker, printed when repo/token resolution fails) maps to `allow`, the
+ * same deliberate fail-open choice `dead-branch-push-guard.ts` already makes
+ * for the sibling gate: a guard that can block *all* pushes on a
+ * transient forge-reachability issue is worse than the bug it fixes. See
+ * `aeg-root/enforcement.md`.
+ */
+
+/** A `task/<tranche>/<n>` branch parses to its two topology coordinates; anything else does not. */
+export function parseTaskBranch(branch: string): { tranche: string; taskId: string } | null {
+  const m = /^task\/([^/]+)\/([^/]+)$/.exec(branch)
+  return m ? { tranche: m[1] as string, taskId: m[2] as string } : null
+}
+
+export type DispatchReadinessFact = 'READY' | 'NOT_READY' | 'UNKNOWN'
+
+export type FirstPushDispatchGateInput = {
+  /** The branch being pushed. */
+  branch: string
+  /** Whether a PR already exists for this branch — the hook's existing C5/ detection, reused, never re-derived here. */
+  prExists: boolean
+  /** verify-dispatch's classified result. Irrelevant (never read) when the branch is not a task branch or a PR already exists. */
+  readiness: DispatchReadinessFact
+}
+
+export type FirstPushDispatchGateVerdict = 'allow' | 'refuse'
+
+export type FirstPushDispatchGateResult = { verdict: FirstPushDispatchGateVerdict; reason: string }
+
+export function checkFirstPushDispatchGate(input: FirstPushDispatchGateInput): FirstPushDispatchGateResult {
+  const { branch, prExists, readiness } = input
+
+  if (parseTaskBranch(branch) === null) {
+    return {
+      verdict: 'allow',
+      reason: `Branch \`${branch}\` is not a task/<tranche>/<n> branch — the first-push dispatch gate only applies to task branches.`
+    }
+  }
+
+  if (prExists) {
+    return {
+      verdict: 'allow',
+      reason: `Branch \`${branch}\` already has an open PR — dispatch readiness was already validated on its first push; later pushes are not re-blocked by a sibling task's state change.`
+    }
+  }
+
+  if (readiness === 'UNKNOWN') {
+    return {
+      verdict: 'allow',
+      reason: `verify-dispatch could not reach the forge for \`${branch}\` (repo/token unresolvable) — failing OPEN rather than blocking the push on a transient issue.`
+    }
+  }
+
+  if (readiness === 'NOT_READY') {
+    return {
+      verdict: 'refuse',
+      reason: `verify-dispatch reports NOT READY for \`${branch}\` — see the failing predicate printed above.`
+    }
+  }
+
+  return {
+    verdict: 'allow',
+    reason: `verify-dispatch reports READY TO DISPATCH for \`${branch}\`.`
+  }
+}

package/studio-standalone/_node_modules/@attalabs/aeg-core/src/gate-audience.ts

@@ -0,0 +1,168 @@
+/**
+ * Who each governance gate under `packages/aeg-core/bin/` is FOR.
+ *
+ * The problem this closes: this repository holds two parallel worlds — the
+ * gates it runs on itself (`packages/aeg-core/bin/*`) and the checks an
+ * adopter runs through the published CLI (`apps/cli/src/checks/bin/*`) — and
+ * nothing asserted a relationship between them. Membership of the shipped set
+ * was defined by ABSENCE from `coreCheckRegistry()`, which means a deliberate
+ * exclusion and a forgotten port left exactly the same trace.
+ *
+ * `reader-resolvable-prose` is the instructive case, and the reason this file
+ * exists. That call was made carefully and its reasoning written up well — in
+ * a paragraph of prose inside `registry.ts`. It is right, and it is invisible
+ * to tooling. A good decision and an unmade decision looked identical, so the
+ * next one might simply not get made.
+ *
+ * So `internal` is a thing you must SAY, with a reason, rather than something
+ * you can forget to notice. `gate-audience.test.ts` enumerates the bin
+ * directory and fails when a gate is in neither column.
+ *
+ * **This is deliberately NOT a field on `CheckSpec`.** Adopter-defined checks
+ * in `vinaya.config.json` produce that same shape (`lib/config.ts`), so an
+ * `audience` field there would push an internal-governance concept into
+ * adopter-facing config, where it means nothing and cannot be answered.
+ * The question is about THIS repo's own bins, so the declaration lives here.
+ *
+ * Adding a gate to `bin/` and nothing else is now a failing build, naming the
+ * file. That is the whole mechanism; deciding which column a given gate
+ * belongs in stays a human judgement, which is the point.
+ */
+
+/** A gate that adopters run, and the `coreCheckRegistry()` name it ships
+ * under. `ring` mirrors `apps/cli/src/checks/registry.ts`'s `CORE_CHECK_RING`
+ * value for that same name — duplicated here, not imported, because
+ * `aeg-core` cannot import `apps/cli` (see this file's own module comment on
+ * the dependency-cycle constraint `coreCheckRegistry()` runs into). Kept
+ * from drifting by `registry-ring-parity.test.ts` (`apps/cli`), which is the
+ * only place both sides are in scope at once — same shape as
+ * `shipped-bin-audience.test.ts`'s existing `shippedAs` cross-check. This is
+ * the "registry-derived fact" `registry-scaffold.ts` reads to place a stub
+ * row for an aeg-core-bin G2 candidate that IS registry-backed; a candidate
+ * with no entry here gets no stub (see `registry-scaffold.ts`). */
+export type ShippedGate = { shippedAs: string | string[]; ring: 0 | 1 | 2 }
+/** A gate this repo runs on itself, and why it cannot or should not ship. */
+export type InternalGate = { internal: string }
+export type GateAudience = ShippedGate | InternalGate
+
+/**
+ * Keyed by basename (no extension) of each `packages/aeg-core/bin/*.ts` that
+ * is a GATE — something that inspects a repo and passes or fails. Non-gate
+ * tooling in the same directory (forge writers, one-shot reporters) is listed
+ * in `NON_GATE_BINS` below rather than given a fake audience.
+ */
+export const GATE_AUDIENCE: Record<string, GateAudience> = {
+  'check-branch-topology': { shippedAs: 'branch-topology', ring: 0 },
+  'check-first-push-dispatch': { shippedAs: 'first-push-dispatch', ring: 0 },
+  'check-no-disk-state': { shippedAs: 'no-disk-state', ring: 0 },
+  'verify-brief': { shippedAs: 'brief-shape', ring: 0 },
+  'verify-coherence': { shippedAs: 'coherence', ring: 0 },
+  'verify-dispatch': { shippedAs: 'dispatch-readiness', ring: 0 },
+  'verify-docs': { shippedAs: ['doc-coverage', 'doc-coverage-push'], ring: 0 },
+  'verify-registry': { shippedAs: 'registry-gates', ring: 0 },
+  'verify-review-gate': { shippedAs: 'review-gate', ring: 1 },
+  'verify-single-plan-pr': { shippedAs: 'single-plan-pr', ring: 0 },
+  'verify-test-plan': { shippedAs: 'test-plan', ring: 1 },
+
+  'check-direct-main-push': {
+    internal:
+      'Reaches adopters through `vinaya audit --only=direct-push`, not the check registry: it is a ring-2 sweep over merge history keyed on `GITHUB_SHA`, run by the generated archivist job on push to the default branch. It has no diff to key on, so there is nothing for `vinaya check` to run it against.'
+  },
+  'check-push-target': {
+    internal:
+      'A pre-push hook helper: it takes a branch name as `argv[2]` and answers one `gh pr list --head <branch>` question, for a caller that already knows which ref is being pushed. Adopters reach the same question through the registered `dead-branch-push`, which resolves the branch itself when `BRANCH` is unset. Registering this one too would add a second entry answering an identical forge query with a worse interface.'
+  },
+  'verify-task': {
+    internal:
+      "A composite that shells this repo's own `typecheck`/`lint`/`test`/`build` scripts by name. Those names are this monorepo's toolchain (bun + turbo + biome), not an adopter's; the shipped equivalent of its intent is `vinaya check --all`, which is portable by construction."
+  }
+}
+
+/**
+ * The other half, and the one the motivating case actually lives in.
+ *
+ * `reader-resolvable-prose` has no bin under `packages/aeg-core/bin/` at all —
+ * its logic is `src/reader-resolvable-prose.ts` and its only executable is
+ * `apps/cli/src/checks/bin/check-reader-resolvable-prose.ts`. So the map above
+ * would never have seen it, and an earlier revision of this file claimed it as
+ * the reason the file exists while leaving it uncovered. Review caught that;
+ * this is the fix, not a re-wording.
+ *
+ * Enumerating the SHIPPED check bins asks the question that case actually
+ * poses: here is an executable adopters could run — is it registered, and if
+ * not, why not? `coreCheckRegistry()` lives in `apps/cli`, which `aeg-core`
+ * cannot import without closing a dependency cycle, so the declaration lives
+ * here and `apps/cli`'s own suite does the asserting.
+ *
+ * `check-reader-resolvable-prose`/`check-retired-vocabulary` (task 7, Issue
+ * #56): both used to live here as `internal` — hardcoded monorepo-specific
+ * doctrine paths made them unreachable through an adopter's own registry.
+ * Both are now config-driven (`vinaya.config.json`'s `proseGates`) and
+ * registered in `coreCheckRegistry()` as `reader-resolvable-prose` /
+ * `retired-vocabulary`, so neither belongs in this map any more — this repo's
+ * own `shipped-bin-audience.test.ts` refuses a bin declared in BOTH places.
+ */
+export const SHIPPED_BIN_AUDIENCE: Record<string, GateAudience> = {}
+
+/**
+ * `name` -> `ring` for every check registered in `coreCheckRegistry()` whose
+ * bin lives under `apps/cli/src/checks/bin/` — the direct analogue of
+ * `ShippedGate.ring` above, for the OTHER directory. Mirrors
+ * `apps/cli/src/checks/registry.ts`'s `CORE_CHECK_RING` — duplicated, not
+ * imported, for the identical dependency-cycle reason `ShippedGate.ring`'s
+ * own comment gives: `aeg-core` cannot import `apps/cli`. This is the
+ * registry-derived fact `registry-scaffold.ts` reads to place a stub row for
+ * an `apps/cli/src/checks/bin/` G2 candidate; a bin whose stripped name has
+ * no entry here gets no stub — same no-guess discipline `classify()`
+ * already applies to `packages/aeg-core/bin/` candidates via
+ * `GATE_AUDIENCE`. Kept from drifting by `shipped-bin-audience.test.ts`
+ * (`apps/cli`)'s own ring-parity block, the only place both sides are in
+ * scope at once — same shape as this file's `ShippedGate.ring` check.
+ */
+export const CLI_CHECK_RING: Readonly<Record<string, 0 | 1 | 2>> = {
+  'brief-shape': 0,
+  'doc-coverage': 0,
+  coherence: 0,
+  'dispatch-readiness': 0,
+  'closes-n': 1,
+  'single-plan-pr': 0,
+  'test-plan': 1,
+  'body-bare-digits': 1,
+  'no-disk-state': 0,
+  'registry-gates': 0,
+  'review-gate': 1,
+  'branch-topology': 0,
+  'dead-branch-push': 0,
+  'first-push-dispatch': 0,
+  'doc-coverage-push': 0,
+  'issue-assignment': 0,
+  'evidence-fresh': 1,
+  'reader-resolvable-prose': 0,
+  'retired-vocabulary': 0,
+  'doctrine-portability': 0,
+  'workspace-escape': 0,
+  'changeset-coverage': 0,
+  'quoted-command': 0,
+  'main-branch-refusal': 0,
+  'token-collection-wired': 0,
+  'token-report': 1
+}
+
+/**
+ * Files in `bin/` that are not gates and therefore have no audience: forge
+ * writers and one-shot reporters. Listed explicitly rather than pattern-matched
+ * so a NEW file cannot slip through by being named unlike a gate.
+ */
+export const NON_GATE_BINS = [
+  'archive-task',
+  'assign-task-issue',
+  'dead-branch-audit',
+  'eval-agent-compliance',
+  'open-issue',
+  'open-pr',
+  'report-tokens'
+] as const
+
+export function isShipped(a: GateAudience): a is ShippedGate {
+  return 'shippedAs' in a
+}

package/studio-standalone/_node_modules/@attalabs/aeg-core/src/index.ts

@@ -0,0 +1,301 @@
+export * from './types'
+export type { StateSource } from './state-source'
+export type { DoctrineContent, DoctrineSource } from './doctrine-source'
+export { CLI_CHECK_RING, GATE_AUDIENCE, NON_GATE_BINS, SHIPPED_BIN_AUDIENCE, isShipped } from './gate-audience'
+export type { GateAudience, InternalGate, ShippedGate } from './gate-audience'
+export { ANCHOR_FIELDS, anchoredRegion, anchoredRegionBounds } from './anchored-region'
+export type { AnchorField } from './anchored-region'
+export { parseRegistry } from './parse-registry'
+export {
+  CROSS_CUTTING_CANDIDATES,
+  deriveBuiltinCrossCuttingDefaults,
+  deriveWorkspacePackageDomains,
+  parsePnpmWorkspaceYaml
+} from './blast-radius-domains'
+export { parseTranche } from './parse-tranche'
+export { deriveTranche } from './derive-tranche'
+export { parseLedger, rowFromCells } from './parse-ledger'
+export { sumLedger } from './sum-ledger'
+export { aggregateTaskTokenRows, parseTokenReportEntries, parseTokensLines } from './parse-token-report'
+export type { TokenSourcePr } from './parse-token-report'
+export { formatBreakdown, formatTokenReportRow, formatTokensLine } from './report-tokens'
+export type { TokenReportRowInput, TokensLineInput, TranscriptSummary, UsageComponents } from './report-tokens'
+// The Claude Code collection adapter (`tranche-model.md` §12 layer 2) — one
+// host's way to produce a `TranscriptSummary`, exported beside the portable
+// renderers it feeds, never as a requirement of the contract.
+export {
+  isTokenCollectionWiringBroken,
+  resolveMeteringCapability,
+  summarizeTranscript
+} from './claude-code-transcript'
+export type { MeteringCapability, MeteringCapabilityDeps, MeteringIncapableReason } from './claude-code-transcript'
+// The hardened deps every real caller of `resolveMeteringCapability` should
+// build from (`#313`) — a sibling module, not part of the pure adapter above.
+export { hardenedMeteringDeps, isTrustedMeteringStat } from './metering-io-guard'
+export { declarationsIn, findCollisions } from './symbol-collisions'
+export type { SymbolCollision, SymbolDeclaration } from './symbol-collisions'
+export { isCodeFile, isDocFile, isSpecFile } from './file-classify'
+export { hasStatusBlock } from './status-block'
+export {
+  classifyDocOwnersManifest,
+  DOC_OWNERS_PATH,
+  evaluateC5,
+  globToRegex,
+  isMechanicallyNeutralDiff,
+  isUrlPointer,
+  parseDocOwners,
+  pointerToPath,
+  readDocAcks,
+  readDocNeutrals
+} from './doc-owners'
+export type { C5Result, DocAck, DocNeutral, DocOwnersBinding, DocOwnersManifestState } from './doc-owners'
+export {
+  isPrincipal,
+  isWaiverLabelActorVerified,
+  PRINCIPAL_ALLOWLIST,
+  WAIVER_LABEL,
+  WAIVER_LABEL_REVIEW
+} from './waiver-label'
+export { deriveSection7, globsOverlap } from './derive-section7'
+export type { Section7Match } from './derive-section7'
+export { checkManifestValidity, parseNoDocRules } from './manifest-validity'
+export type { NoDocRule } from './manifest-validity'
+export { evaluateVocabularyCitation } from './vocabulary-citation'
+export type {
+  VocabularyCheckResult,
+  VocabularyFinding,
+  VocabularyHit,
+  VocabularyPattern
+} from './vocabulary-citation'
+export { deriveTierFromDiff, overrideActive, readTierFromPrBody, TIER_FIELD } from './pr-tier'
+export {
+  checkAutonomyClause,
+  checkBriefSections,
+  checkClosesN as checkBriefClosesN,
+  checkDocUpdateList,
+  checkForField,
+  checkForgeTitle,
+  checkPlanPrNoCloses,
+  checkPremiseCoverage,
+  checkPrincipalPlaceholder,
+  checkProjectField,
+  checkStopConditions,
+  checkSurfaceMap,
+  checkTestPlan,
+  checkTestPlanExclusivity,
+  checkTierField,
+  checkWorktreeStep0,
+  COMMIT_TYPE_STYLE,
+  COMMIT_TYPES,
+  headerRegion,
+  inferBranchFromBody,
+  isBriefShaped,
+  isTaskBranch
+} from './brief-validation'
+export type { BriefSectionResult, BriefSectionsOptions } from './brief-validation'
+export {
+  checkA1,
+  checkA2,
+  checkA3,
+  checkClosesN,
+  checkD1,
+  checkL1,
+  checkL2,
+  checkL3,
+  checkL4,
+  checkL5,
+  checkR1,
+  checkT1,
+  checkT2,
+  checkT3,
+  COHERENCE_ENFORCED_FROM,
+  extractClosesReferences,
+  isGrandfathered,
+  R1_GRANDFATHERED_ISSUES,
+  scopeT2ToPlanPr
+} from './coherence-checks'
+export type { CheckFailure, CheckResult, ForgeIssue, TrancheFile, TaskEntry } from './coherence-checks'
+export {
+  buildProvenanceBlock,
+  extractIssue,
+  hasProvenance,
+  isEligibleForProvenance,
+  taskRefFromBranch
+} from './archive-task'
+export type { MergedPrFacts } from './archive-task'
+export { extractCodeReviewVerdict, extractSecurityReviewVerdict } from './verdict-extraction'
+export type { VerdictExtraction } from './verdict-extraction'
+export {
+  CHANGESET_RELEASE_BRANCH,
+  checkReviewGate,
+  DEFAULT_RELEASE_ACTOR,
+  isChangesetsReleasePr,
+  isReviewGateExemptBranch
+} from './review-gate'
+export type { ReviewGateComment, ReviewGateInput, ReviewGateResult, ReviewGateVerdict } from './review-gate'
+export {
+  checkBlastRadiusScope,
+  checkConflictCompleteness,
+  checkIssueRationale,
+  checkIssueType,
+  checkNoBriefContent,
+  checkProjectsRegistered,
+  checkRationaleNamesDocs,
+  declaredProjects,
+  isTaskIssueLabelSet
+} from './issue-validation'
+export type { IssueSectionResult, ProjectPath, TaskIssueFacts } from './issue-validation'
+export { findHeadingLine, findTable, rowToRecord } from './markdown-table'
+export type { ParsedTable, TableRow } from './markdown-table'
+export { deriveDiagramModel } from './diagram-model'
+export type {
+  DiagramConfig,
+  DiagramEdge,
+  DiagramFinding,
+  DiagramModel,
+  DiagramNode,
+  DiagramNodeKind,
+  RenderState
+} from './diagram-model'
+export { parseEnforcementRegistry } from './registry-parse'
+export type { GateRing, GateRow } from './registry-parse'
+export { checkG1, checkG2, checkG3, checkG4, checkG5, checkG6 } from './registry-checks'
+export type { RegistryCheckResult, RegistryCheckStatus, RegistryFinding } from './registry-checks'
+export { applyScaffoldPlan, computeScaffoldPlan, PLACEHOLDER } from './registry-scaffold'
+export type { ScaffoldPlan, ScaffoldSkip, ScaffoldStub } from './registry-scaffold'
+export { ACTIONS, CROSSING_KEYWORDS } from './actions'
+export type { Action, ActionCrossing } from './actions'
+export {
+  DERIVABLE_STATUSES,
+  DERIVATION_RULES,
+  DERIVED_STATUSES,
+  deriveStatusFromModel,
+  FORGE_FACT_INPUTS
+} from './state-machine-model'
+export type { DerivationRule, ForgeFactInput } from './state-machine-model'
+export { checkPremises, parsePremiseBlock } from './premise-check'
+export type { PremiseAssertion, PremiseCheckResult } from './premise-check'
+export { classifyLeftover } from './leftover-detection'
+export type { LeftoverInput, LeftoverResult, LeftoverVerdict } from './leftover-detection'
+export { checkDeadBranchPush } from './dead-branch-push-guard'
+export type {
+  DeadBranchPushInput,
+  DeadBranchPushResult,
+  DeadBranchPushVerdict,
+  PrStateFact
+} from './dead-branch-push-guard'
+export { captureBaseline, compareToBaseline } from './baseline-capture'
+export type { BaselineComparison, BaselineEntry, BaselineToolComparison } from './baseline-capture'
+export { checkDoctrinePortability } from './doctrine-portability'
+export type { PortabilityFinding, PortabilitySourceFile } from './doctrine-portability'
+export {
+  checkReaderResolvableProse,
+  checkUndefinedVocabulary,
+  checkUnresolvableReferences,
+  classifyProseFile,
+  legacySlugPattern,
+  parseGlossaryTerms,
+  stripNonProse
+} from './reader-resolvable-prose'
+export type { ProseFileClass, ProseFinding, ProseSourceFile } from './reader-resolvable-prose'
+export {
+  checkQuotedCommandStaleness,
+  evaluateCitedQuotes,
+  findCitedQuotes,
+  isValidCitedFilePath
+} from './quoted-command'
+export type { CitedQuote, QuotedCommandFinding, QuotedCommandSourceFile } from './quoted-command'
+export {
+  PATTERN_EXEMPT,
+  RETIRED_EXEMPT_SUBSTRINGS,
+  RETIRED_PATTERNS,
+  scanRetiredVocabulary
+} from './retired-vocabulary'
+export type { VocabFinding, VocabSourceFile } from './retired-vocabulary'
+export { checkLocalAnchorCoverage } from './local-anchor-coverage'
+export type {
+  AnchorCoverageFinding,
+  AnchorCoverageScope,
+  AnchorSourceFile,
+  LocalAnchorCoverageOptions,
+  LocalAnchorCoverageResult
+} from './local-anchor-coverage'
+export { checkDispatchReadiness } from './dispatch-gate'
+export type {
+  DispatchConflictsWithFact,
+  DispatchDependsOnFact,
+  DispatchEdgeFact,
+  DispatchGateInput,
+  DispatchIssueFact,
+  DispatchPriorTrancheFact,
+  DispatchPriorTaskFact,
+  DispatchResult
+} from './dispatch-gate'
+export { checkSinglePlanPr, trancheSlugFromTopologyPath, touchesAnyTopology } from './single-plan-pr'
+export type { OpenPrFiles } from './single-plan-pr'
+export { isNewDiskStateFile } from './no-disk-state'
+export type { DiskStateFileStatus } from './no-disk-state'
+export { checkDirectMainPush } from './direct-main-push'
+export type { DirectMainPushFact, DirectMainPushResult } from './direct-main-push'
+export { checkMainBranchRefusal } from './main-branch-refusal'
+export type { MainBranchRefusalFinding, MainBranchRefusalReason } from './main-branch-refusal'
+export { ensureLabelExists, LABEL_COLOR } from './ensure-label'
+export type { LabelExistenceIo } from './ensure-label'
+export { findDeadBranchPushes } from './dead-branch-push-audit'
+export type { DeadBranchFact, DeadBranchPush } from './dead-branch-push-audit'
+export { checkBranchTopology, taskBranchTopologyFields } from './branch-topology-gate'
+export type { BranchTopologyInput, BranchTopologyResult, BranchTopologyVerdict } from './branch-topology-gate'
+export { checkFirstPushDispatchGate, parseTaskBranch } from './first-push-dispatch-gate'
+export type {
+  DispatchReadinessFact,
+  FirstPushDispatchGateInput,
+  FirstPushDispatchGateResult,
+  FirstPushDispatchGateVerdict
+} from './first-push-dispatch-gate'
+export { decideIssueAssignment } from './issue-assignment'
+export type { IssueAssignmentDecision, IssueAssignmentInput } from './issue-assignment'
+export { locateTestPlanSection } from './test-plan-section'
+export type { TestPlanSection } from './test-plan-section'
+export { evaluateTestPlanGate } from './test-plan-gate'
+export type { TestPlanGateResult, TestPlanGateVerdict } from './test-plan-gate'
+export {
+  AEG_BLOCKED_LABEL,
+  buildBranchName,
+  fetchForgeFacts,
+  fetchForgeTasksByLabel,
+  fetchOpenIssuesByLabel,
+  fetchTaskIssueRefs,
+  findTrancheSlug,
+  hasLabel,
+  trancheLabel,
+  trancheSlugLengthError,
+  trancheSlugOf,
+  LABEL_MAX_LENGTH,
+  LABEL_NAMESPACE,
+  LABELS,
+  label,
+  mapForgeFacts,
+  matchesLabel,
+  projectsFromBody
+} from '@attalabs/aeg-forge-state'
+export type { Label, LabelCategory, LabelForm, LabelKey } from '@attalabs/aeg-forge-state'
+export type {
+  FetchForgeFactsInput,
+  ForgeFactsSnapshot,
+  PrRef,
+  RawTaskFacts,
+  TaskIssueRef,
+  TaskRef
+} from '@attalabs/aeg-types'
+export { checkAdoptable, checkMilestoneShape, releaseFieldFromBody } from './milestone-validation'
+export type {
+  AdoptFacts,
+  AdoptResult,
+  AdoptSlugFacts,
+  AdoptTargetFacts,
+  MilestoneIntent,
+  MilestoneShapeResult,
+  ReleaseField
+} from './milestone-validation'
+export { findWorkspaceEscapes } from './workspace-escape'
+export type { WorkspaceEscapeFinding, WorkspaceEscapeReason, WorkspaceEscapeSourceFile } from './workspace-escape'