@attalabs/vinaya 0.23.0 → 0.24.0

package/README.md

@@ -31,6 +31,7 @@ npx @attalabs/vinaya init        # or: pnpm dlx / yarn dlx / bunx
 | `vinaya milestone edit <n> --body-file <path>` | Edit an existing Milestone's description after the same `checkMilestoneShape` gate `create` runs — the gated replacement for a raw `gh api PATCH` against a Milestone. Only the description changes; the title is untouched. `--validate-only` runs every check without writing; `--json` for the enveloped machine form. |
 | `vinaya milestone close --slug <slug>` | Close a tranche's Milestone — the gated replacement for the raw `gh api .../milestones/<n> -X PATCH -f state=closed` recipe the Tranche Archivist used to run on faith. Resolves the target Milestone the same legacy-or-intent-declared way Issue create auto-attach does, then refuses to close on any mismatch between the label's Issues and the Milestone's natively attached Issues — naming each unattached or foreign Issue and its repair path (`gh issue edit <n> --milestone <title>`, or `vinaya milestone adopt`) — before the PATCH ever reaches the forge. `--validate-only` verifies attachment without closing; `--json` for the enveloped machine form. |
 | `vinaya quickstart [--yes] [--dry-run]` | Guided wizard that runs `init` → optional doc-owners bind → optional project registration → commit → `demo break` → `doctor` → `push` in sequence, prompting between steps. `--yes` forwards straight through to `init` and answers every one of quickstart's own prompts with its documented default (skip the two optional steps, run the refusal-then-fix proof, push) — no prompt is opened at all, so the command completes with no human at the keyboard rather than merely with stdin closed. `--dry-run` also forwards to `init` and stops immediately after its preview — nothing is installed, so no later step runs against an uninstalled repo. |
+| `vinaya release [--dry-run] [--allow-any-commit]` | Run this repo's own publish sequence in one command (`apps/cli/specs/self-hosting.md`, "How the published version is produced"). Refuses unless HEAD is the default branch, the tree is clean, HEAD equals `origin/<default>` (after `git fetch origin`), HEAD's commit subject starts with `Chore(release): Version packages` (unless `--allow-any-commit`), and `npm whoami` exits `0` — each its own refusal naming the fix. Then streams `bun install --frozen-lockfile`, `bun run build`, `bun run changeset:publish`, and a real `git push origin --tags`, so the repo's own generated pre-push hook sees the push exactly as any other push would. Afterward prints `npm view <pkg> version` for every tag now on HEAD, noting registry lag on `@attalabs/vinaya` (observed ~20 minutes) when it still shows the previous version. `--dry-run` stops after the preconditions and prints the plan; publishes nothing. |
 
 ## Config
 

package/dist/checks/bin/check-body-bare-digits.js

@@ -4157,8 +4157,12 @@ function isNewDiskStateFile(path, status) {
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
 // ../../packages/aeg-core/src/main-branch-refusal.ts
+function pushesAnyBranchRef(pushRefs) {
+  return pushRefs.split(`
+`).map((line) => line.trim()).filter((line) => line.length > 0).some((line) => line.split(/\s+/)[2]?.startsWith("refs/heads/") === true);
+}
 function checkMainBranchRefusal(facts) {
-  const { currentSymbolicBranch, defaultBranch } = facts;
+  const { currentSymbolicBranch, defaultBranch, pushRefs = null } = facts;
   if (currentSymbolicBranch === null)
     return null;
   if (defaultBranch === null) {
@@ -4170,6 +4174,8 @@ function checkMainBranchRefusal(facts) {
     };
   }
   if (currentSymbolicBranch === defaultBranch) {
+    if (pushRefs !== null && !pushesAnyBranchRef(pushRefs))
+      return null;
     return {
       reason: "on-default-branch",
       severity: "error",

package/dist/checks/bin/check-branch-topology.js

@@ -4157,8 +4157,12 @@ function isNewDiskStateFile(path, status) {
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
 // ../../packages/aeg-core/src/main-branch-refusal.ts
+function pushesAnyBranchRef(pushRefs) {
+  return pushRefs.split(`
+`).map((line) => line.trim()).filter((line) => line.length > 0).some((line) => line.split(/\s+/)[2]?.startsWith("refs/heads/") === true);
+}
 function checkMainBranchRefusal(facts) {
-  const { currentSymbolicBranch, defaultBranch } = facts;
+  const { currentSymbolicBranch, defaultBranch, pushRefs = null } = facts;
   if (currentSymbolicBranch === null)
     return null;
   if (defaultBranch === null) {
@@ -4170,6 +4174,8 @@ function checkMainBranchRefusal(facts) {
     };
   }
   if (currentSymbolicBranch === defaultBranch) {
+    if (pushRefs !== null && !pushesAnyBranchRef(pushRefs))
+      return null;
     return {
       reason: "on-default-branch",
       severity: "error",
@@ -4915,6 +4921,26 @@ var COMMANDS = [
       "Never reimplements or edits `init`/`init product`/`demo break`/`doctor` — it only calls their existing, unmodified entry points in sequence."
     ],
     status: "shipped"
+  },
+  {
+    name: "release",
+    description: "Run this repo's own publish sequence in one command, refusing to start unless every precondition holds",
+    flags: [
+      {
+        flag: "--dry-run",
+        description: "Run the preconditions only and print the plan; publishes nothing"
+      },
+      {
+        flag: "--allow-any-commit",
+        description: "Skip the check that HEAD's commit is a Version Packages commit"
+      }
+    ],
+    details: [
+      "Refuses unless HEAD is the default branch, the working tree is clean, HEAD equals `origin/<default>` (after `git fetch origin`), HEAD's commit subject starts with `Chore(release): Version packages` (unless `--allow-any-commit`), and `npm whoami` exits `0` — each its own refusal naming the fix.",
+      "Then streams `bun install --frozen-lockfile`, `bun run build`, `bun run changeset:publish`, and `git push origin --tags` — a real push, so the repo's own generated pre-push hook sees it exactly as any other push would. After it, prints `npm view <pkg> version` for every tag now on HEAD, noting registry lag on `@attalabs/vinaya` (observed ~20 minutes) when it still shows the previous version.",
+      'This is the one procedure named in `apps/cli/specs/self-hosting.md`, "How the published version is produced" — publishing itself stays manual and human-triggered; this command only removes the hand-typed four-step recipe.'
+    ],
+    status: "shipped"
   }
 ];
 // ../../packages/sources/src/forge-adapter.ts

package/dist/checks/bin/check-brief-shape.js

@@ -4157,8 +4157,12 @@ function isNewDiskStateFile(path, status) {
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
 // ../../packages/aeg-core/src/main-branch-refusal.ts
+function pushesAnyBranchRef(pushRefs) {
+  return pushRefs.split(`
+`).map((line) => line.trim()).filter((line) => line.length > 0).some((line) => line.split(/\s+/)[2]?.startsWith("refs/heads/") === true);
+}
 function checkMainBranchRefusal(facts) {
-  const { currentSymbolicBranch, defaultBranch } = facts;
+  const { currentSymbolicBranch, defaultBranch, pushRefs = null } = facts;
   if (currentSymbolicBranch === null)
     return null;
   if (defaultBranch === null) {
@@ -4170,6 +4174,8 @@ function checkMainBranchRefusal(facts) {
     };
   }
   if (currentSymbolicBranch === defaultBranch) {
+    if (pushRefs !== null && !pushesAnyBranchRef(pushRefs))
+      return null;
     return {
       reason: "on-default-branch",
       severity: "error",

package/dist/checks/bin/check-changeset-coverage.js

@@ -4159,8 +4159,12 @@ function isNewDiskStateFile(path, status) {
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
 // ../../packages/aeg-core/src/main-branch-refusal.ts
+function pushesAnyBranchRef(pushRefs) {
+  return pushRefs.split(`
+`).map((line) => line.trim()).filter((line) => line.length > 0).some((line) => line.split(/\s+/)[2]?.startsWith("refs/heads/") === true);
+}
 function checkMainBranchRefusal(facts) {
-  const { currentSymbolicBranch, defaultBranch } = facts;
+  const { currentSymbolicBranch, defaultBranch, pushRefs = null } = facts;
   if (currentSymbolicBranch === null)
     return null;
   if (defaultBranch === null) {
@@ -4172,6 +4176,8 @@ function checkMainBranchRefusal(facts) {
     };
   }
   if (currentSymbolicBranch === defaultBranch) {
+    if (pushRefs !== null && !pushesAnyBranchRef(pushRefs))
+      return null;
     return {
       reason: "on-default-branch",
       severity: "error",

package/dist/checks/bin/check-closes-n.js

@@ -4157,8 +4157,12 @@ function isNewDiskStateFile(path, status) {
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
 // ../../packages/aeg-core/src/main-branch-refusal.ts
+function pushesAnyBranchRef(pushRefs) {
+  return pushRefs.split(`
+`).map((line) => line.trim()).filter((line) => line.length > 0).some((line) => line.split(/\s+/)[2]?.startsWith("refs/heads/") === true);
+}
 function checkMainBranchRefusal(facts) {
-  const { currentSymbolicBranch, defaultBranch } = facts;
+  const { currentSymbolicBranch, defaultBranch, pushRefs = null } = facts;
   if (currentSymbolicBranch === null)
     return null;
   if (defaultBranch === null) {
@@ -4170,6 +4174,8 @@ function checkMainBranchRefusal(facts) {
     };
   }
   if (currentSymbolicBranch === defaultBranch) {
+    if (pushRefs !== null && !pushesAnyBranchRef(pushRefs))
+      return null;
     return {
       reason: "on-default-branch",
       severity: "error",
@@ -4915,6 +4921,26 @@ var COMMANDS = [
       "Never reimplements or edits `init`/`init product`/`demo break`/`doctor` — it only calls their existing, unmodified entry points in sequence."
     ],
     status: "shipped"
+  },
+  {
+    name: "release",
+    description: "Run this repo's own publish sequence in one command, refusing to start unless every precondition holds",
+    flags: [
+      {
+        flag: "--dry-run",
+        description: "Run the preconditions only and print the plan; publishes nothing"
+      },
+      {
+        flag: "--allow-any-commit",
+        description: "Skip the check that HEAD's commit is a Version Packages commit"
+      }
+    ],
+    details: [
+      "Refuses unless HEAD is the default branch, the working tree is clean, HEAD equals `origin/<default>` (after `git fetch origin`), HEAD's commit subject starts with `Chore(release): Version packages` (unless `--allow-any-commit`), and `npm whoami` exits `0` — each its own refusal naming the fix.",
+      "Then streams `bun install --frozen-lockfile`, `bun run build`, `bun run changeset:publish`, and `git push origin --tags` — a real push, so the repo's own generated pre-push hook sees it exactly as any other push would. After it, prints `npm view <pkg> version` for every tag now on HEAD, noting registry lag on `@attalabs/vinaya` (observed ~20 minutes) when it still shows the previous version.",
+      'This is the one procedure named in `apps/cli/specs/self-hosting.md`, "How the published version is produced" — publishing itself stays manual and human-triggered; this command only removes the hand-typed four-step recipe.'
+    ],
+    status: "shipped"
   }
 ];
 // ../../packages/sources/src/forge-adapter.ts

package/dist/checks/bin/check-coherence.js

@@ -4160,8 +4160,12 @@ function isNewDiskStateFile(path, status) {
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
 // ../../packages/aeg-core/src/main-branch-refusal.ts
+function pushesAnyBranchRef(pushRefs) {
+  return pushRefs.split(`
+`).map((line) => line.trim()).filter((line) => line.length > 0).some((line) => line.split(/\s+/)[2]?.startsWith("refs/heads/") === true);
+}
 function checkMainBranchRefusal(facts) {
-  const { currentSymbolicBranch, defaultBranch } = facts;
+  const { currentSymbolicBranch, defaultBranch, pushRefs = null } = facts;
   if (currentSymbolicBranch === null)
     return null;
   if (defaultBranch === null) {
@@ -4173,6 +4177,8 @@ function checkMainBranchRefusal(facts) {
     };
   }
   if (currentSymbolicBranch === defaultBranch) {
+    if (pushRefs !== null && !pushesAnyBranchRef(pushRefs))
+      return null;
     return {
       reason: "on-default-branch",
       severity: "error",
@@ -4918,6 +4924,26 @@ var COMMANDS = [
       "Never reimplements or edits `init`/`init product`/`demo break`/`doctor` — it only calls their existing, unmodified entry points in sequence."
     ],
     status: "shipped"
+  },
+  {
+    name: "release",
+    description: "Run this repo's own publish sequence in one command, refusing to start unless every precondition holds",
+    flags: [
+      {
+        flag: "--dry-run",
+        description: "Run the preconditions only and print the plan; publishes nothing"
+      },
+      {
+        flag: "--allow-any-commit",
+        description: "Skip the check that HEAD's commit is a Version Packages commit"
+      }
+    ],
+    details: [
+      "Refuses unless HEAD is the default branch, the working tree is clean, HEAD equals `origin/<default>` (after `git fetch origin`), HEAD's commit subject starts with `Chore(release): Version packages` (unless `--allow-any-commit`), and `npm whoami` exits `0` — each its own refusal naming the fix.",
+      "Then streams `bun install --frozen-lockfile`, `bun run build`, `bun run changeset:publish`, and `git push origin --tags` — a real push, so the repo's own generated pre-push hook sees it exactly as any other push would. After it, prints `npm view <pkg> version` for every tag now on HEAD, noting registry lag on `@attalabs/vinaya` (observed ~20 minutes) when it still shows the previous version.",
+      'This is the one procedure named in `apps/cli/specs/self-hosting.md`, "How the published version is produced" — publishing itself stays manual and human-triggered; this command only removes the hand-typed four-step recipe.'
+    ],
+    status: "shipped"
   }
 ];
 // ../../packages/sources/src/forge-adapter.ts

package/dist/checks/bin/check-dead-branch-push.js

@@ -4157,8 +4157,12 @@ function isNewDiskStateFile(path, status) {
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
 // ../../packages/aeg-core/src/main-branch-refusal.ts
+function pushesAnyBranchRef(pushRefs) {
+  return pushRefs.split(`
+`).map((line) => line.trim()).filter((line) => line.length > 0).some((line) => line.split(/\s+/)[2]?.startsWith("refs/heads/") === true);
+}
 function checkMainBranchRefusal(facts) {
-  const { currentSymbolicBranch, defaultBranch } = facts;
+  const { currentSymbolicBranch, defaultBranch, pushRefs = null } = facts;
   if (currentSymbolicBranch === null)
     return null;
   if (defaultBranch === null) {
@@ -4170,6 +4174,8 @@ function checkMainBranchRefusal(facts) {
     };
   }
   if (currentSymbolicBranch === defaultBranch) {
+    if (pushRefs !== null && !pushesAnyBranchRef(pushRefs))
+      return null;
     return {
       reason: "on-default-branch",
       severity: "error",

package/dist/checks/bin/check-dispatch-readiness.js

@@ -4160,8 +4160,12 @@ function isNewDiskStateFile(path, status) {
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
 // ../../packages/aeg-core/src/main-branch-refusal.ts
+function pushesAnyBranchRef(pushRefs) {
+  return pushRefs.split(`
+`).map((line) => line.trim()).filter((line) => line.length > 0).some((line) => line.split(/\s+/)[2]?.startsWith("refs/heads/") === true);
+}
 function checkMainBranchRefusal(facts) {
-  const { currentSymbolicBranch, defaultBranch } = facts;
+  const { currentSymbolicBranch, defaultBranch, pushRefs = null } = facts;
   if (currentSymbolicBranch === null)
     return null;
   if (defaultBranch === null) {
@@ -4173,6 +4177,8 @@ function checkMainBranchRefusal(facts) {
     };
   }
   if (currentSymbolicBranch === defaultBranch) {
+    if (pushRefs !== null && !pushesAnyBranchRef(pushRefs))
+      return null;
     return {
       reason: "on-default-branch",
       severity: "error",
@@ -4918,6 +4924,26 @@ var COMMANDS = [
       "Never reimplements or edits `init`/`init product`/`demo break`/`doctor` — it only calls their existing, unmodified entry points in sequence."
     ],
     status: "shipped"
+  },
+  {
+    name: "release",
+    description: "Run this repo's own publish sequence in one command, refusing to start unless every precondition holds",
+    flags: [
+      {
+        flag: "--dry-run",
+        description: "Run the preconditions only and print the plan; publishes nothing"
+      },
+      {
+        flag: "--allow-any-commit",
+        description: "Skip the check that HEAD's commit is a Version Packages commit"
+      }
+    ],
+    details: [
+      "Refuses unless HEAD is the default branch, the working tree is clean, HEAD equals `origin/<default>` (after `git fetch origin`), HEAD's commit subject starts with `Chore(release): Version packages` (unless `--allow-any-commit`), and `npm whoami` exits `0` — each its own refusal naming the fix.",
+      "Then streams `bun install --frozen-lockfile`, `bun run build`, `bun run changeset:publish`, and `git push origin --tags` — a real push, so the repo's own generated pre-push hook sees it exactly as any other push would. After it, prints `npm view <pkg> version` for every tag now on HEAD, noting registry lag on `@attalabs/vinaya` (observed ~20 minutes) when it still shows the previous version.",
+      'This is the one procedure named in `apps/cli/specs/self-hosting.md`, "How the published version is produced" — publishing itself stays manual and human-triggered; this command only removes the hand-typed four-step recipe.'
+    ],
+    status: "shipped"
   }
 ];
 // ../../packages/sources/src/forge-adapter.ts

package/dist/checks/bin/check-doc-coverage-push.js

@@ -4158,8 +4158,12 @@ function isNewDiskStateFile(path, status) {
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
 // ../../packages/aeg-core/src/main-branch-refusal.ts
+function pushesAnyBranchRef(pushRefs) {
+  return pushRefs.split(`
+`).map((line) => line.trim()).filter((line) => line.length > 0).some((line) => line.split(/\s+/)[2]?.startsWith("refs/heads/") === true);
+}
 function checkMainBranchRefusal(facts) {
-  const { currentSymbolicBranch, defaultBranch } = facts;
+  const { currentSymbolicBranch, defaultBranch, pushRefs = null } = facts;
   if (currentSymbolicBranch === null)
     return null;
   if (defaultBranch === null) {
@@ -4171,6 +4175,8 @@ function checkMainBranchRefusal(facts) {
     };
   }
   if (currentSymbolicBranch === defaultBranch) {
+    if (pushRefs !== null && !pushesAnyBranchRef(pushRefs))
+      return null;
     return {
       reason: "on-default-branch",
       severity: "error",

package/dist/checks/bin/check-doc-coverage.js

@@ -4158,8 +4158,12 @@ function isNewDiskStateFile(path, status) {
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
 // ../../packages/aeg-core/src/main-branch-refusal.ts
+function pushesAnyBranchRef(pushRefs) {
+  return pushRefs.split(`
+`).map((line) => line.trim()).filter((line) => line.length > 0).some((line) => line.split(/\s+/)[2]?.startsWith("refs/heads/") === true);
+}
 function checkMainBranchRefusal(facts) {
-  const { currentSymbolicBranch, defaultBranch } = facts;
+  const { currentSymbolicBranch, defaultBranch, pushRefs = null } = facts;
   if (currentSymbolicBranch === null)
     return null;
   if (defaultBranch === null) {
@@ -4171,6 +4175,8 @@ function checkMainBranchRefusal(facts) {
     };
   }
   if (currentSymbolicBranch === defaultBranch) {
+    if (pushRefs !== null && !pushesAnyBranchRef(pushRefs))
+      return null;
     return {
       reason: "on-default-branch",
       severity: "error",

package/dist/checks/bin/check-doctrine-no-procedures.js

@@ -4158,8 +4158,12 @@ function isNewDiskStateFile(path, status) {
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
 // ../../packages/aeg-core/src/main-branch-refusal.ts
+function pushesAnyBranchRef(pushRefs) {
+  return pushRefs.split(`
+`).map((line) => line.trim()).filter((line) => line.length > 0).some((line) => line.split(/\s+/)[2]?.startsWith("refs/heads/") === true);
+}
 function checkMainBranchRefusal(facts) {
-  const { currentSymbolicBranch, defaultBranch } = facts;
+  const { currentSymbolicBranch, defaultBranch, pushRefs = null } = facts;
   if (currentSymbolicBranch === null)
     return null;
   if (defaultBranch === null) {
@@ -4171,6 +4175,8 @@ function checkMainBranchRefusal(facts) {
     };
   }
   if (currentSymbolicBranch === defaultBranch) {
+    if (pushRefs !== null && !pushesAnyBranchRef(pushRefs))
+      return null;
     return {
       reason: "on-default-branch",
       severity: "error",

package/dist/checks/bin/check-doctrine-portability.js

@@ -4159,8 +4159,12 @@ function isNewDiskStateFile(path, status) {
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
 // ../../packages/aeg-core/src/main-branch-refusal.ts
+function pushesAnyBranchRef(pushRefs) {
+  return pushRefs.split(`
+`).map((line) => line.trim()).filter((line) => line.length > 0).some((line) => line.split(/\s+/)[2]?.startsWith("refs/heads/") === true);
+}
 function checkMainBranchRefusal(facts) {
-  const { currentSymbolicBranch, defaultBranch } = facts;
+  const { currentSymbolicBranch, defaultBranch, pushRefs = null } = facts;
   if (currentSymbolicBranch === null)
     return null;
   if (defaultBranch === null) {
@@ -4172,6 +4176,8 @@ function checkMainBranchRefusal(facts) {
     };
   }
   if (currentSymbolicBranch === defaultBranch) {
+    if (pushRefs !== null && !pushesAnyBranchRef(pushRefs))
+      return null;
     return {
       reason: "on-default-branch",
       severity: "error",

package/dist/checks/bin/check-evidence-fresh.js

@@ -4157,8 +4157,12 @@ function isNewDiskStateFile(path, status) {
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
 // ../../packages/aeg-core/src/main-branch-refusal.ts
+function pushesAnyBranchRef(pushRefs) {
+  return pushRefs.split(`
+`).map((line) => line.trim()).filter((line) => line.length > 0).some((line) => line.split(/\s+/)[2]?.startsWith("refs/heads/") === true);
+}
 function checkMainBranchRefusal(facts) {
-  const { currentSymbolicBranch, defaultBranch } = facts;
+  const { currentSymbolicBranch, defaultBranch, pushRefs = null } = facts;
   if (currentSymbolicBranch === null)
     return null;
   if (defaultBranch === null) {
@@ -4170,6 +4174,8 @@ function checkMainBranchRefusal(facts) {
     };
   }
   if (currentSymbolicBranch === defaultBranch) {
+    if (pushRefs !== null && !pushesAnyBranchRef(pushRefs))
+      return null;
     return {
       reason: "on-default-branch",
       severity: "error",

package/dist/checks/bin/check-exec-bits.js

@@ -4169,8 +4169,12 @@ function isNewDiskStateFile(path, status) {
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
 // ../../packages/aeg-core/src/main-branch-refusal.ts
+function pushesAnyBranchRef(pushRefs) {
+  return pushRefs.split(`
+`).map((line) => line.trim()).filter((line) => line.length > 0).some((line) => line.split(/\s+/)[2]?.startsWith("refs/heads/") === true);
+}
 function checkMainBranchRefusal(facts) {
-  const { currentSymbolicBranch, defaultBranch } = facts;
+  const { currentSymbolicBranch, defaultBranch, pushRefs = null } = facts;
   if (currentSymbolicBranch === null)
     return null;
   if (defaultBranch === null) {
@@ -4182,6 +4186,8 @@ function checkMainBranchRefusal(facts) {
     };
   }
   if (currentSymbolicBranch === defaultBranch) {
+    if (pushRefs !== null && !pushesAnyBranchRef(pushRefs))
+      return null;
     return {
       reason: "on-default-branch",
       severity: "error",

package/dist/checks/bin/check-first-push-dispatch.js

@@ -4157,8 +4157,12 @@ function isNewDiskStateFile(path, status) {
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
 // ../../packages/aeg-core/src/main-branch-refusal.ts
+function pushesAnyBranchRef(pushRefs) {
+  return pushRefs.split(`
+`).map((line) => line.trim()).filter((line) => line.length > 0).some((line) => line.split(/\s+/)[2]?.startsWith("refs/heads/") === true);
+}
 function checkMainBranchRefusal(facts) {
-  const { currentSymbolicBranch, defaultBranch } = facts;
+  const { currentSymbolicBranch, defaultBranch, pushRefs = null } = facts;
   if (currentSymbolicBranch === null)
     return null;
   if (defaultBranch === null) {
@@ -4170,6 +4174,8 @@ function checkMainBranchRefusal(facts) {
     };
   }
   if (currentSymbolicBranch === defaultBranch) {
+    if (pushRefs !== null && !pushesAnyBranchRef(pushRefs))
+      return null;
     return {
       reason: "on-default-branch",
       severity: "error",
@@ -4915,6 +4921,26 @@ var COMMANDS = [
       "Never reimplements or edits `init`/`init product`/`demo break`/`doctor` — it only calls their existing, unmodified entry points in sequence."
     ],
     status: "shipped"
+  },
+  {
+    name: "release",
+    description: "Run this repo's own publish sequence in one command, refusing to start unless every precondition holds",
+    flags: [
+      {
+        flag: "--dry-run",
+        description: "Run the preconditions only and print the plan; publishes nothing"
+      },
+      {
+        flag: "--allow-any-commit",
+        description: "Skip the check that HEAD's commit is a Version Packages commit"
+      }
+    ],
+    details: [
+      "Refuses unless HEAD is the default branch, the working tree is clean, HEAD equals `origin/<default>` (after `git fetch origin`), HEAD's commit subject starts with `Chore(release): Version packages` (unless `--allow-any-commit`), and `npm whoami` exits `0` — each its own refusal naming the fix.",
+      "Then streams `bun install --frozen-lockfile`, `bun run build`, `bun run changeset:publish`, and `git push origin --tags` — a real push, so the repo's own generated pre-push hook sees it exactly as any other push would. After it, prints `npm view <pkg> version` for every tag now on HEAD, noting registry lag on `@attalabs/vinaya` (observed ~20 minutes) when it still shows the previous version.",
+      'This is the one procedure named in `apps/cli/specs/self-hosting.md`, "How the published version is produced" — publishing itself stays manual and human-triggered; this command only removes the hand-typed four-step recipe.'
+    ],
+    status: "shipped"
   }
 ];
 // ../../packages/sources/src/forge-adapter.ts

package/dist/checks/bin/check-issue-assignment.js

@@ -4157,8 +4157,12 @@ function isNewDiskStateFile(path, status) {
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
 // ../../packages/aeg-core/src/main-branch-refusal.ts
+function pushesAnyBranchRef(pushRefs) {
+  return pushRefs.split(`
+`).map((line) => line.trim()).filter((line) => line.length > 0).some((line) => line.split(/\s+/)[2]?.startsWith("refs/heads/") === true);
+}
 function checkMainBranchRefusal(facts) {
-  const { currentSymbolicBranch, defaultBranch } = facts;
+  const { currentSymbolicBranch, defaultBranch, pushRefs = null } = facts;
   if (currentSymbolicBranch === null)
     return null;
   if (defaultBranch === null) {
@@ -4170,6 +4174,8 @@ function checkMainBranchRefusal(facts) {
     };
   }
   if (currentSymbolicBranch === defaultBranch) {
+    if (pushRefs !== null && !pushesAnyBranchRef(pushRefs))
+      return null;
     return {
       reason: "on-default-branch",
       severity: "error",
@@ -4915,6 +4921,26 @@ var COMMANDS = [
       "Never reimplements or edits `init`/`init product`/`demo break`/`doctor` — it only calls their existing, unmodified entry points in sequence."
     ],
     status: "shipped"
+  },
+  {
+    name: "release",
+    description: "Run this repo's own publish sequence in one command, refusing to start unless every precondition holds",
+    flags: [
+      {
+        flag: "--dry-run",
+        description: "Run the preconditions only and print the plan; publishes nothing"
+      },
+      {
+        flag: "--allow-any-commit",
+        description: "Skip the check that HEAD's commit is a Version Packages commit"
+      }
+    ],
+    details: [
+      "Refuses unless HEAD is the default branch, the working tree is clean, HEAD equals `origin/<default>` (after `git fetch origin`), HEAD's commit subject starts with `Chore(release): Version packages` (unless `--allow-any-commit`), and `npm whoami` exits `0` — each its own refusal naming the fix.",
+      "Then streams `bun install --frozen-lockfile`, `bun run build`, `bun run changeset:publish`, and `git push origin --tags` — a real push, so the repo's own generated pre-push hook sees it exactly as any other push would. After it, prints `npm view <pkg> version` for every tag now on HEAD, noting registry lag on `@attalabs/vinaya` (observed ~20 minutes) when it still shows the previous version.",
+      'This is the one procedure named in `apps/cli/specs/self-hosting.md`, "How the published version is produced" — publishing itself stays manual and human-triggered; this command only removes the hand-typed four-step recipe.'
+    ],
+    status: "shipped"
   }
 ];
 // ../../packages/sources/src/forge-adapter.ts

package/dist/checks/bin/check-main-branch-refusal.js

@@ -4157,8 +4157,12 @@ function isNewDiskStateFile(path, status) {
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
 // ../../packages/aeg-core/src/main-branch-refusal.ts
+function pushesAnyBranchRef(pushRefs) {
+  return pushRefs.split(`
+`).map((line) => line.trim()).filter((line) => line.length > 0).some((line) => line.split(/\s+/)[2]?.startsWith("refs/heads/") === true);
+}
 function checkMainBranchRefusal(facts) {
-  const { currentSymbolicBranch, defaultBranch } = facts;
+  const { currentSymbolicBranch, defaultBranch, pushRefs = null } = facts;
   if (currentSymbolicBranch === null)
     return null;
   if (defaultBranch === null) {
@@ -4170,6 +4174,8 @@ function checkMainBranchRefusal(facts) {
     };
   }
   if (currentSymbolicBranch === defaultBranch) {
+    if (pushRefs !== null && !pushesAnyBranchRef(pushRefs))
+      return null;
     return {
       reason: "on-default-branch",
       severity: "error",
@@ -4462,12 +4468,17 @@ function defaultBranch() {
 function main() {
   const currentSymbolicBranchName = currentSymbolicBranch();
   const defaultBranchName = defaultBranch();
+  const pushRefs = process.env.VINAYA_PUSH_REFS ?? null;
   const finding = checkMainBranchRefusal({
     currentSymbolicBranch: currentSymbolicBranchName,
-    defaultBranch: defaultBranchName
+    defaultBranch: defaultBranchName,
+    pushRefs
   });
   if (finding === null) {
     console.log(`${CHECK_NAME}: pass (branch: ${currentSymbolicBranchName ?? "(detached)"})`);
+    if (pushRefs !== null && currentSymbolicBranchName !== null && currentSymbolicBranchName === defaultBranchName) {
+      console.log(`${CHECK_NAME}: tag-only push — no refs/heads/* ref in this push, allowing it from the default branch`);
+    }
     process.exit(0);
   }
   if (finding.reason === "on-default-branch") {

package/dist/checks/bin/check-no-disk-state.js

@@ -4157,8 +4157,12 @@ function isNewDiskStateFile(path, status) {
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
 // ../../packages/aeg-core/src/main-branch-refusal.ts
+function pushesAnyBranchRef(pushRefs) {
+  return pushRefs.split(`
+`).map((line) => line.trim()).filter((line) => line.length > 0).some((line) => line.split(/\s+/)[2]?.startsWith("refs/heads/") === true);
+}
 function checkMainBranchRefusal(facts) {
-  const { currentSymbolicBranch, defaultBranch } = facts;
+  const { currentSymbolicBranch, defaultBranch, pushRefs = null } = facts;
   if (currentSymbolicBranch === null)
     return null;
   if (defaultBranch === null) {
@@ -4170,6 +4174,8 @@ function checkMainBranchRefusal(facts) {
     };
   }
   if (currentSymbolicBranch === defaultBranch) {
+    if (pushRefs !== null && !pushesAnyBranchRef(pushRefs))
+      return null;
     return {
       reason: "on-default-branch",
       severity: "error",

package/dist/checks/bin/check-pr-report-density.js

@@ -4154,8 +4154,12 @@ function isNewDiskStateFile(path, status) {
   return ANY_DEPTH_TRANCHES_MD.test(path) || TOKENS_FILE.test(path);
 }
 // ../../packages/aeg-core/src/main-branch-refusal.ts
+function pushesAnyBranchRef(pushRefs) {
+  return pushRefs.split(`
+`).map((line) => line.trim()).filter((line) => line.length > 0).some((line) => line.split(/\s+/)[2]?.startsWith("refs/heads/") === true);
+}
 function checkMainBranchRefusal(facts) {
-  const { currentSymbolicBranch, defaultBranch } = facts;
+  const { currentSymbolicBranch, defaultBranch, pushRefs = null } = facts;
   if (currentSymbolicBranch === null)
     return null;
   if (defaultBranch === null) {
@@ -4167,6 +4171,8 @@ function checkMainBranchRefusal(facts) {
     };
   }
   if (currentSymbolicBranch === defaultBranch) {
+    if (pushRefs !== null && !pushesAnyBranchRef(pushRefs))
+      return null;
     return {
       reason: "on-default-branch",
       severity: "error",