@attalabs/vinaya 0.23.0 → 0.24.1

package/dist/index.js

@@ -6,7 +6,7 @@ import { dirname as dirname9, join as join29 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/commands/archive.ts
-import { execFileSync as execFileSync5 } from "node:child_process";
+import { execFileSync as execFileSync6 } from "node:child_process";
 // ../../packages/aeg-forge-state/src/strip-code.ts
 function maskCode(body) {
   const fill = (line) => " ".repeat(line.length);
@@ -3309,7 +3309,7 @@ function renderSection6(facts) {
       "   Files:",
       ...files.map((f) => `   - ${f.path}`),
       "",
-      `   Run \`bunx turbo test --affected\` before committing this Part; touches ${pkg}.`
+      `   Touches ${pkg}. The pre-push hook runs the affected suite on your one push and refuses it on failure — do not run it yourself per Part.`
     ].join(`
 `));
     n++;
@@ -3335,7 +3335,7 @@ function renderSection8() {
   return [
     "## 8. Verification before claiming done",
     "",
-    "- `bunx turbo test --affected --force` (the command and its output are attested in the Evidence block).",
+    "- The pre-push hook already ran the affected suite on your one push and refused it on failure — do not additionally run it yourself; `vinaya pr report --write`/`--push` separately re-runs it with `--force` to attest the command and its output in the Evidence block.",
     "- The full `bun run test` suite is CI's to run, on the one push — never run it locally.",
     "- Every blast-radius consumer named in §4, re-verified by name.",
     '- `roles/developer.md`\'s tier checklist genuinely satisfied, and `PR_BODY="$(cat <body-file>)" bun packages/aeg-core/bin/verify-docs.ts --pr` green.'
@@ -3444,6 +3444,7 @@ import { readFileSync as readFileSync4 } from "node:fs";
 import { join as join4 } from "node:path";
 
 // src/commands/doctrine.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2 } from "node:fs";
 import { dirname as dirname2, join as join2, sep } from "node:path";
 import matter2 from "gray-matter";
@@ -3477,10 +3478,29 @@ function packageRoot(moduleUrl) {
 
 // src/commands/doctrine.ts
 var ENTRY_SEGMENTS = ["skills", "aeg", "SKILL.md"];
-function resolveDoctrineRoot(pkg = packageRoot(import.meta.url)) {
+function resolveDoctrineRoot(pkg = packageRoot(import.meta.url), cwd = process.cwd()) {
+  return resolveDoctrineRootInfo(pkg, cwd)?.root ?? null;
+}
+function gitToplevel(cwd) {
+  try {
+    return execFileSync2("git", ["-C", cwd, "rev-parse", "--show-toplevel"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function resolveDoctrineRootInfo(pkg = packageRoot(import.meta.url), cwd = process.cwd()) {
+  const toplevel = gitToplevel(cwd);
+  if (toplevel !== null) {
+    const treeRoot = join2(toplevel, "aeg-root");
+    if (existsSync2(join2(treeRoot, "roles")))
+      return { root: treeRoot, source: "tree" };
+  }
   const fromSource = !pkg.split(sep).includes("node_modules");
-  const root = fromSource ? join2(dirname2(dirname2(pkg)), "aeg-root") : join2(pkg, "aeg-root");
-  return hasDoctrineEntry(root) ? root : null;
+  const bundleRoot = fromSource ? join2(dirname2(dirname2(pkg)), "aeg-root") : join2(pkg, "aeg-root");
+  return hasDoctrineEntry(bundleRoot) ? { root: bundleRoot, source: "bundle" } : null;
 }
 var ROLE_ALIASES = { "code-reviewer": "reviewer" };
 function hasDoctrineEntry(root) {
@@ -3550,21 +3570,24 @@ function discoverRoleNames(doctrineRoot) {
 function agentSkillPath(roleName) {
   return `.agents/skills/vinaya-${roleName}/SKILL.md`;
 }
-function renderAgentSkill(roleName) {
+function doctrineInvocation(selfHost) {
+  return selfHost ? `bun ${selfHost.dir}/src/index.ts doctrine` : "vinaya doctrine";
+}
+function renderAgentSkill(roleName, selfHost = null) {
   const roleTitle = formatRoleTitle(roleName);
   return `---
 name: vinaya-${roleName}
 description: Act as the AEG ${roleTitle} for this repo.
 ---
-Run \`vinaya doctrine --role ${roleName}\` and follow its output as your operating instructions for this session.
+Run \`${doctrineInvocation(selfHost)} --role ${roleName}\` and follow its output as your operating instructions for this session.
 `;
 }
-function buildAgentsSkillsOps(doctrineRoot) {
+function buildAgentsSkillsOps(doctrineRoot, selfHost = null) {
   const roles = discoverRoleNames(doctrineRoot);
   return roles.map((role) => ({
     kind: "create-file",
     path: agentSkillPath(role),
-    content: renderAgentSkill(role),
+    content: renderAgentSkill(role, selfHost),
     group: AGENTS_SKILLS_GROUP
   }));
 }
@@ -3572,20 +3595,24 @@ function buildAgentsSkillsOps(doctrineRoot) {
 // src/lib/claude-command-emitter.ts
 var CLAUDE_COMMAND_GROUP = "Claude Code command (.claude/commands/)";
 var CLAUDE_COMMAND_PATH = ".claude/commands/vinaya.md";
-function renderClaudeCommand() {
+function doctrineInvocation2(selfHost) {
+  return selfHost ? `bun ${selfHost.dir}/src/index.ts doctrine` : "vinaya doctrine";
+}
+function renderClaudeCommand(selfHost = null) {
+  const invocation = doctrineInvocation2(selfHost);
   return `---
 description: Act as an AEG role for this repo.
-allowed-tools: Bash(vinaya doctrine *)
+allowed-tools: Bash(${invocation} *)
 ---
-!\`vinaya doctrine --role "$ARGUMENTS"\`
+!\`${invocation} --role "$ARGUMENTS"\`
 `;
 }
-function buildClaudeCommandOps() {
+function buildClaudeCommandOps(selfHost = null) {
   return [
     {
       kind: "create-file",
       path: CLAUDE_COMMAND_PATH,
-      content: renderClaudeCommand(),
+      content: renderClaudeCommand(selfHost),
       group: CLAUDE_COMMAND_GROUP
     }
   ];
@@ -3681,16 +3708,19 @@ function buildClaudeStopHookOps() {
 // src/lib/gemini-command-emitter.ts
 var GEMINI_COMMAND_GROUP = "Gemini CLI command (.gemini/commands/)";
 var GEMINI_COMMAND_PATH = ".gemini/commands/vinaya.toml";
-function renderGeminiCommand() {
+function doctrineInvocation3(selfHost) {
+  return selfHost ? `bun ${selfHost.dir}/src/index.ts doctrine` : "vinaya doctrine";
+}
+function renderGeminiCommand(selfHost = null) {
   return `description = "Act as an AEG role for this repo."
-prompt = "!{vinaya doctrine --role {{args}}}"
+prompt = "!{${doctrineInvocation3(selfHost)} --role {{args}}}"
 `;
 }
-function buildGeminiCommandOp() {
+function buildGeminiCommandOp(selfHost = null) {
   return {
     kind: "create-file",
     path: GEMINI_COMMAND_PATH,
-    content: renderGeminiCommand(),
+    content: renderGeminiCommand(selfHost),
     group: GEMINI_COMMAND_GROUP
   };
 }
@@ -3881,7 +3911,7 @@ ${vinayaSetupSteps(selfHost, "pull-request")}${adopterSetupStep(ciSetup)}      #
           GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: \${{ github.event.pull_request.number }}
         run: |
-          DELIM="PR_BODY_$(date +%s%N)"
+          DELIM="PR_BODY_$(openssl rand -hex 16)"
           echo "PR_BODY<<$DELIM" >> "$GITHUB_ENV"
           gh pr view "$PR_NUMBER" --json body --jq .body >> "$GITHUB_ENV"
           echo "$DELIM" >> "$GITHUB_ENV"
@@ -4051,13 +4081,26 @@ jobs:
           # lookup vinaya-review-verdict.yml's own retrigger step runs.
           set -o pipefail
           RUN_TITLE="Vinaya Review Gate PR #$PR_NUMBER @ $HEAD_SHA"
+          # O7 (found live 2026-09-04): dropped \`select(.status == "completed")\`
+          # — two retriggers for the same head race the SAME required run
+          # (PR #401, PR #409: runs 33841069791/33841065139), and the loser's
+          # query landed while the winner's \`gh run rerun\` had already
+          # flipped the run to \`in_progress\`. Requiring \`completed\` made
+          # that run invisible to the loser entirely — not "already handled,
+          # skip", but "nothing matched, give up" — so when that in-flight
+          # attempt itself later failed, nothing retried it again and the
+          # gate stayed red until a hand rerun. Matching on title+event alone
+          # (any status) lets the loser find the SAME run mid-run and try
+          # \`gh run rerun\` on it too; the existing "declined (already
+          # queued)" fallback below already handles that outcome harmlessly
+          # — it is not a new failure mode, only a query that used to see
+          # nothing at all now sees the run and takes the same safe no-op.
           RUN_ID=$(gh api --paginate \\
             "repos/\${{ github.repository }}/actions/workflows/vinaya-review.yml/runs?event=pull_request_target&per_page=100" \\
             | jq -sr --arg title "$RUN_TITLE" '
                 [.[].workflow_runs[]
                  | select(.display_title == $title)
                  | select(.event == "pull_request_target")
-                 | select(.status == "completed")
                  | select(.conclusion != "cancelled")
                  | .id][0] // empty')
           if [ -z "$RUN_ID" ]; then
@@ -4134,7 +4177,7 @@ ${vinayaSetupSteps(selfHost, "trusted")}      # PR_BODY is what makes body-bare-
           GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: \${{ github.event.pull_request.number }}
         run: |
-          DELIM="PR_BODY_$(date +%s%N)"
+          DELIM="PR_BODY_$(openssl rand -hex 16)"
           echo "PR_BODY<<$DELIM" >> "$GITHUB_ENV"
           gh pr view "$PR_NUMBER" --json body --jq .body >> "$GITHUB_ENV"
           echo "$DELIM" >> "$GITHUB_ENV"
@@ -4255,13 +4298,26 @@ ${vinayaSetupSteps(selfHost, "trusted")}      - name: Review gate (verdict evalu
           # query matches that immutable display_title exactly.
           set -o pipefail
           RUN_TITLE="Vinaya Review Gate PR #$PR_NUMBER @ $HEAD_SHA"
+          # O7 (found live 2026-09-04): dropped \`select(.status == "completed")\`
+          # — two retriggers for the same head race the SAME required run
+          # (PR #401, PR #409: runs 33841069791/33841065139), and the loser's
+          # query landed while the winner's \`gh run rerun\` had already
+          # flipped the run to \`in_progress\`. Requiring \`completed\` made
+          # that run invisible to the loser entirely — not "already handled,
+          # skip", but "nothing matched, give up" — so when that in-flight
+          # attempt itself later failed, nothing retried it again and the
+          # gate stayed red until a hand rerun. Matching on title+event alone
+          # (any status) lets the loser find the SAME run mid-run and try
+          # \`gh run rerun\` on it too; the existing "declined (already
+          # queued)" fallback below already handles that outcome harmlessly
+          # — it is not a new failure mode, only a query that used to see
+          # nothing at all now sees the run and takes the same safe no-op.
           RUN_ID=$(gh api --paginate \\
             "repos/\${{ github.repository }}/actions/workflows/vinaya-review.yml/runs?event=pull_request_target&per_page=100" \\
             | jq -sr --arg title "$RUN_TITLE" '
                 [.[].workflow_runs[]
                  | select(.display_title == $title)
                  | select(.event == "pull_request_target")
-                 | select(.status == "completed")
                  | select(.conclusion != "cancelled")
                  | .id][0] // empty')
           if [ -z "$RUN_ID" ]; then
@@ -4388,8 +4444,24 @@ function preCommitBody(selfHost) {
 ${hookRun(selfHost, "check --all --diff-only --local --skip-full")}`;
 }
 function prePushBody(selfHost) {
-  return `# Vinaya pre-push gate. Runs branch/dispatch checks before the push leaves.
+  const base = `# Vinaya pre-push gate. Runs branch/dispatch checks before the push leaves.
+# Forward git's own pre-push stdin (one "<local ref> <local sha> <remote
+# ref> <remote sha>" line per ref being pushed) so main-branch-refusal can
+# tell a tag-only push apart from one that also carries a branch ref.
+VINAYA_PUSH_REFS="$(cat)"
+export VINAYA_PUSH_REFS
 ${hookRun(selfHost, "check --all --local")}`;
+  if (!selfHost)
+    return base;
+  return `${base}
+# Ring 0: the affected test suite. A failing test refuses the push with
+# its own output (#407, O4). --concurrency=1 (O9, found live 2026-09-04):
+# a local machine already running other work (another worktree's own
+# build/test, an IDE indexer) alongside this hook's parallel package
+# suites was measured pushing a git-clone-heavy fixture test past its
+# timeout under real contention — CI's own runner is dedicated and keeps
+# turbo.json's default concurrency; only this hook invocation is serialized.
+bunx turbo test --affected --concurrency=1 || exit 1`;
 }
 function commitMsgBody(selfHost) {
   return `# Vinaya commit-message gate. Validates the message's first line against
@@ -4751,14 +4823,14 @@ function buildInitOps(ctx) {
     if (!doctrineRoot) {
       throw new Error('vinaya init: --agents includes "skills" but no bundled doctrine was found next to this CLI install — ' + "cannot discover agent-skill roles. Reinstall @attalabs/vinaya, or run bundle-doctrine first in a repo " + "that vendors the CLI.");
     }
-    ops.push(...buildAgentsSkillsOps(doctrineRoot));
+    ops.push(...buildAgentsSkillsOps(doctrineRoot, ctx.selfHost));
   }
   if (ctx.agents.has("claude")) {
-    ops.push(...buildClaudeCommandOps());
+    ops.push(...buildClaudeCommandOps(ctx.selfHost));
     ops.push(...buildClaudeStopHookOps());
   }
   if (ctx.agents.has("gemini")) {
-    ops.push(buildGeminiCommandOp());
+    ops.push(buildGeminiCommandOp(ctx.selfHost));
   }
   if (ctx.agents.size > 0) {
     const affected = [];
@@ -4784,12 +4856,12 @@ function buildInitOps(ctx) {
 }
 
 // src/lib/ops.ts
-import { execFileSync as execFileSync3 } from "node:child_process";
+import { execFileSync as execFileSync4 } from "node:child_process";
 import { chmodSync, existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname4, isAbsolute, join as join6, resolve as resolve2, sep as sep2 } from "node:path";
 
 // src/lib/config.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
+import { execFileSync as execFileSync3 } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
 import { existsSync as existsSync4, mkdirSync, readFileSync as readFileSync5, realpathSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -5062,7 +5134,7 @@ function trustAnchorRepo() {
       return validated;
   }
   try {
-    const url = execFileSync2("git", ["remote", "get-url", "origin"], {
+    const url = execFileSync3("git", ["remote", "get-url", "origin"], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe"]
     }).trim();
@@ -5076,7 +5148,7 @@ function ghFetchTrustAnchorConfig() {
   const repo = trustAnchorRepo();
   if (!repo)
     throw new Error("could not resolve repo identity for the trust-anchor read");
-  return execFileSync2("gh", ["api", `repos/${repo}/contents/${LOCAL_CONFIG_FILENAME}`, "--jq", ".content"], {
+  return execFileSync3("gh", ["api", `repos/${repo}/contents/${LOCAL_CONFIG_FILENAME}`, "--jq", ".content"], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -5177,7 +5249,7 @@ function writeTokensCollectTrustStore(storePath, store) {
 var GIT_IDENTITY_TIMEOUT_MS = 5000;
 function gitCommonDir(cwd = process.cwd()) {
   try {
-    const raw = execFileSync2("git", ["rev-parse", "--git-common-dir"], {
+    const raw = execFileSync3("git", ["rev-parse", "--git-common-dir"], {
       cwd,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe"],
@@ -5196,7 +5268,7 @@ function repoLocalConfigDir() {
 }
 function gitBlobHash(absolutePath, cwd) {
   try {
-    const raw = execFileSync2("git", ["hash-object", absolutePath], {
+    const raw = execFileSync3("git", ["hash-object", absolutePath], {
       cwd,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe"],
@@ -5247,7 +5319,7 @@ function resolveManagedBlockPath(repoRoot, opPath) {
 }
 function gitCommonDir2(repoRoot) {
   try {
-    const commonDir = execFileSync3("git", ["-C", repoRoot, "rev-parse", "--git-common-dir"], {
+    const commonDir = execFileSync4("git", ["-C", repoRoot, "rev-parse", "--git-common-dir"], {
       encoding: "utf8"
     }).trim();
     if (commonDir === "")
@@ -5826,7 +5898,7 @@ function closeStdin() {
 }
 
 // src/commands/tokens.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
+import { execFileSync as execFileSync5 } from "node:child_process";
 import { resolve as resolvePath } from "node:path";
 var USAGE = [
   'Usage: vinaya tokens --phase "<task-id>: develop" --role Developer',
@@ -5981,7 +6053,7 @@ function realDeps() {
     ...hardenedMeteringDeps(),
     loadConfig,
     repoConfigDir: repoLocalConfigDir,
-    runScript: (interpreter, scriptAbsolutePath, cwd) => execFileSync4(interpreter, [scriptAbsolutePath], { cwd, encoding: "utf-8", timeout: COLLECT_COMMAND_TIMEOUT_MS }),
+    runScript: (interpreter, scriptAbsolutePath, cwd) => execFileSync5(interpreter, [scriptAbsolutePath], { cwd, encoding: "utf-8", timeout: COLLECT_COMMAND_TIMEOUT_MS }),
     warn: (message) => console.error(message),
     gitCommonDir,
     scriptContentHash: gitBlobHash,
@@ -6107,7 +6179,7 @@ function renderArchiveTokensLine(capability, phase, role) {
   return { line: formatTokensLine({ phase, role, summary: capability.summary }), dangling: null };
 }
 function sh(args, input) {
-  return execFileSync5(args[0], args.slice(1), { encoding: "utf8", input, env: process.env }).trim();
+  return execFileSync6(args[0], args.slice(1), { encoding: "utf8", input, env: process.env }).trim();
 }
 function shJson(args) {
   return JSON.parse(sh(args));
@@ -6321,7 +6393,7 @@ async function archiveTrancheCommand(args) {
 }
 
 // src/commands/audit.ts
-import { execFileSync as execFileSync6 } from "node:child_process";
+import { execFileSync as execFileSync7 } from "node:child_process";
 function ring2Accelerated2() {
   return loadConfig()?.rings?.ring2_asyncAudits === true;
 }
@@ -6340,7 +6412,7 @@ var DIRECT_PUSH_MARKER = `<!-- ${DIRECT_PUSH_LABEL} -->`;
 var DIRECT_PUSH_LABEL_DESCRIPTION = "A commit landed on main with no associated merged PR (ring-2 detection)";
 function shSoft(args, input) {
   try {
-    return execFileSync6(args[0], args.slice(1), {
+    return execFileSync7(args[0], args.slice(1), {
       encoding: "utf8",
       input,
       timeout: COMMAND_TIMEOUT_MS
@@ -6364,7 +6436,7 @@ function shSoftJson(args) {
   }
 }
 function sh2(args, input) {
-  return execFileSync6(args[0], args.slice(1), { encoding: "utf8", input }).trim();
+  return execFileSync7(args[0], args.slice(1), { encoding: "utf8", input }).trim();
 }
 function listTaskBranches() {
   const out = shSoft(["git", "ls-remote", "--heads", "origin", "task/*"]);
@@ -6625,7 +6697,7 @@ async function auditCommand(args) {
 
 // src/commands/brief.ts
 import { createHash as createHash3 } from "node:crypto";
-import { execFileSync as execFileSync8 } from "node:child_process";
+import { execFileSync as execFileSync9 } from "node:child_process";
 import { existsSync as existsSync7, readFileSync as readFileSync9, readdirSync as readdirSync5, writeFileSync as writeFileSync3 } from "node:fs";
 import { join as join9 } from "node:path";
 
@@ -7112,6 +7184,26 @@ var COMMANDS = [
       "Never reimplements or edits `init`/`init product`/`demo break`/`doctor` — it only calls their existing, unmodified entry points in sequence."
     ],
     status: "shipped"
+  },
+  {
+    name: "release",
+    description: "Run this repo's own publish sequence in one command, refusing to start unless every precondition holds",
+    flags: [
+      {
+        flag: "--dry-run",
+        description: "Run the preconditions only and print the plan; publishes nothing"
+      },
+      {
+        flag: "--allow-any-commit",
+        description: "Skip the check that HEAD's commit is a Version Packages commit"
+      }
+    ],
+    details: [
+      "Refuses unless HEAD is the default branch, the working tree is clean, HEAD equals `origin/<default>` (after `git fetch origin`), HEAD's commit subject starts with `Chore(release): Version packages` (unless `--allow-any-commit`), and `npm whoami` exits `0` — each its own refusal naming the fix.",
+      "Then streams `bun install --frozen-lockfile`, `bun run build`, `bun run changeset:publish`, and `git push origin --tags` — a real push, so the repo's own generated pre-push hook sees it exactly as any other push would. After it, prints `npm view <pkg> version` for every tag now on HEAD, noting registry lag on `@attalabs/vinaya` (observed ~20 minutes) when it still shows the previous version.",
+      'This is the one procedure named in `apps/cli/specs/self-hosting.md`, "How the published version is produced" — publishing itself stays manual and human-triggered; this command only removes the hand-typed four-step recipe.'
+    ],
+    status: "shipped"
   }
 ];
 // ../../packages/sources/src/doctrine-file-adapter.ts
@@ -7155,7 +7247,7 @@ var StateSourceConfigSchema = z2.discriminatedUnion("kind", [
   z2.object({ kind: z2.literal("file"), root: z2.string().optional() })
 ]);
 // src/checks/edge-resolve.ts
-import { execFileSync as execFileSync7 } from "node:child_process";
+import { execFileSync as execFileSync8 } from "node:child_process";
 var DIRECT_ISSUE_REF = /#(\d+)/;
 var issueCache = new Map;
 function fetchIssueState(num, repo) {
@@ -7164,7 +7256,7 @@ function fetchIssueState(num, repo) {
     return issueCache.get(key) ?? null;
   let out = null;
   try {
-    const raw = execFileSync7("gh", [
+    const raw = execFileSync8("gh", [
       "issue",
       "view",
       String(num),
@@ -7277,7 +7369,7 @@ var DOC_OWNERS_PATH2 = ".vinaya/doc-owners";
 var TEMPLATE_PATH = "aeg-root/templates/brief-template.md";
 function git(args) {
   try {
-    return execFileSync8("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync9("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return "";
   }
@@ -7304,7 +7396,7 @@ async function resolveToken() {
   if (process.env.GH_TOKEN)
     return process.env.GH_TOKEN;
   try {
-    return execFileSync8("gh", ["auth", "token"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
+    return execFileSync9("gh", ["auth", "token"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
   } catch {
     return null;
   }
@@ -7465,7 +7557,7 @@ ${result.missing.map((m) => `  - ${m}`).join(`
 }
 
 // src/commands/check.ts
-import { execFileSync as execFileSync9 } from "node:child_process";
+import { execFileSync as execFileSync10 } from "node:child_process";
 import { dirname as dirname5 } from "node:path";
 
 // src/checks/contract.ts
@@ -7870,7 +7962,7 @@ var REGISTRY = [
       run: bin("check-main-branch-refusal"),
       scope: "full",
       timeoutMs: 15000,
-      env: {}
+      env: { VINAYA_PUSH_REFS: { optional: true } }
     },
     0
   ],
@@ -8418,7 +8510,7 @@ async function buildRolePlan(configDir, configRoles) {
 // src/commands/check.ts
 function git2(args) {
   try {
-    return execFileSync9("git", args, { encoding: "utf8" }).trim();
+    return execFileSync10("git", args, { encoding: "utf8" }).trim();
   } catch {
     return "";
   }
@@ -8682,14 +8774,14 @@ function commitMsgCommand(args) {
 }
 
 // src/commands/demo.ts
-import { execFileSync as execFileSync10, spawnSync } from "node:child_process";
+import { execFileSync as execFileSync11, spawnSync } from "node:child_process";
 import { existsSync as existsSync10, readFileSync as readFileSync12, rmSync as rmSync2, unlinkSync, writeFileSync as writeFileSync4 } from "node:fs";
 import { isAbsolute as isAbsolute2, join as join12 } from "node:path";
 var DEMO_BRANCH_PREFIX = "vinaya/demo-break-";
 var FIXTURE_PATH = ".vinaya-demo-brief.md";
 var STATE_FILENAME = "vinaya-demo-state.json";
 function gitCapture(repoRoot, args) {
-  return execFileSync10("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+  return execFileSync11("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 function currentBranchName(repoRoot) {
   try {
@@ -8700,7 +8792,7 @@ function currentBranchName(repoRoot) {
 }
 function branchExists(repoRoot, name) {
   try {
-    execFileSync10("git", ["rev-parse", "--verify", "--quiet", `refs/heads/${name}`], {
+    execFileSync11("git", ["rev-parse", "--verify", "--quiet", `refs/heads/${name}`], {
       cwd: repoRoot,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -8902,7 +8994,7 @@ async function demoBreakCommand(args) {
 }
 
 // src/commands/doctor.ts
-import { execFileSync as execFileSync11 } from "node:child_process";
+import { execFileSync as execFileSync12 } from "node:child_process";
 import { existsSync as existsSync13, readdirSync as readdirSync7, readFileSync as readFileSync16, statSync as statSync2 } from "node:fs";
 import { delimiter, join as join15 } from "node:path";
 
@@ -9328,7 +9420,7 @@ function diagnoseCustomChecks(repoRoot, config) {
 }
 function listTrackedFiles(repoRoot) {
   try {
-    return execFileSync11("git", ["ls-files"], { cwd: repoRoot, encoding: "utf-8" }).split(`
+    return execFileSync12("git", ["ls-files"], { cwd: repoRoot, encoding: "utf-8" }).split(`
 `).map((s) => s.trim()).filter(Boolean);
   } catch {
     return [];
@@ -9593,10 +9685,15 @@ function symbolFor(severity) {
       return "✗";
   }
 }
-function printReport(findings, healthy) {
+function printReport(findings, healthy, doctrineInfo) {
   process.stdout.write(`vinaya doctor
 
 `);
+  if (doctrineInfo) {
+    process.stdout.write(`doctrine: ${doctrineInfo.root} (${doctrineInfo.source})
+
+`);
+  }
   for (const f of findings) {
     process.stdout.write(`${symbolFor(f.severity)} [${f.check}] ${f.message}
 `);
@@ -9612,6 +9709,7 @@ async function runDoctor(args, deps) {
     console.error("Error: not a git repository. Run `vinaya doctor` from inside your repo.");
     return 1;
   }
+  const doctrineInfo = resolveDoctrineRootInfo(undefined, repo.repoRoot);
   const configRead = readConfig(repo.repoRoot);
   const findings = [];
   let hasDrift = false;
@@ -9652,9 +9750,9 @@ async function runDoctor(args, deps) {
   findings.push(...diagnoseTestCi(repo.repoRoot));
   const healthy = findings.every((f) => f.severity === "ok" || f.severity === "info");
   if (jsonOutput) {
-    printJson({ healthy, findings });
+    printJson({ healthy, findings, doctrineInfo });
   } else {
-    printReport(findings, healthy);
+    printReport(findings, healthy, doctrineInfo);
   }
   return healthy ? 0 : 1;
 }
@@ -9978,10 +10076,10 @@ async function initProductCommand(args) {
 }
 
 // src/commands/issue.ts
-import { execFileSync as execFileSync13 } from "node:child_process";
+import { execFileSync as execFileSync14 } from "node:child_process";
 
 // src/lib/forge-write.ts
-import { execFileSync as execFileSync12 } from "node:child_process";
+import { execFileSync as execFileSync13 } from "node:child_process";
 import { existsSync as existsSync16, mkdtempSync, readdirSync as readdirSync8, rmSync as rmSync3, writeFileSync as writeFileSync7 } from "node:fs";
 import { readFileSync as readFileSync19 } from "node:fs";
 import { tmpdir } from "node:os";
@@ -10075,7 +10173,7 @@ function ensureTrancheLabelExists(slug) {
   const name = trancheLabel(slug);
   let existing;
   try {
-    const out = execFileSync12("gh", ["label", "list", "--json", "name", "--limit", "200"], {
+    const out = execFileSync13("gh", ["label", "list", "--json", "name", "--limit", "200"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -10088,7 +10186,7 @@ function ensureTrancheLabelExists(slug) {
   if (existing.some((l) => l.name === name))
     return;
   try {
-    execFileSync12("gh", ["label", "create", name, "--color", TRANCHE_LABEL_COLOR, "--description", `Tranche: ${slug}`], {
+    execFileSync13("gh", ["label", "create", name, "--color", TRANCHE_LABEL_COLOR, "--description", `Tranche: ${slug}`], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -10240,7 +10338,7 @@ function validateForgeWrite(input) {
 }
 function git3(args) {
   try {
-    return execFileSync12("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync13("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return "";
   }
@@ -10335,7 +10433,7 @@ function locateBodyOrRefuse(ghArgs, retryCommand) {
 function fetchForgeLabels(issueRef) {
   let out;
   try {
-    out = execFileSync13("gh", ["issue", "view", issueRef, "--json", "labels"], {
+    out = execFileSync14("gh", ["issue", "view", issueRef, "--json", "labels"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -10363,7 +10461,7 @@ function reportPass(json, command) {
 function runGhWrite(ghCmd, ghArgs, bodyResult, json) {
   const { finalArgs, cleanup: cleanup2 } = resolveShippableArgs(ghArgs, bodyResult);
   try {
-    const out = execFileSync13("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
+    const out = execFileSync14("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
     const url = out.trim();
     if (json)
       printJson({ validated: true, written: true, url });
@@ -10449,13 +10547,13 @@ function issueEditCommand(args) {
 }
 
 // src/commands/milestone.ts
-import { execFileSync as execFileSync14 } from "node:child_process";
+import { execFileSync as execFileSync15 } from "node:child_process";
 var RETRY_CREATE2 = "vinaya milestone create --title <title> --body-file <path>";
 var RETRY_ADOPT = "vinaya milestone adopt --target <title> --slug <slug> [--slug <slug> ...]";
 var RETRY_EDIT2 = "vinaya milestone edit <n> --body-file <path>";
 var RETRY_CLOSE = "vinaya milestone close --slug <slug>";
 function sh3(args, input) {
-  return execFileSync14(args[0], args.slice(1), {
+  return execFileSync15(args[0], args.slice(1), {
     encoding: "utf8",
     input,
     env: process.env,
@@ -10955,7 +11053,7 @@ ${registration}
 }
 
 // src/commands/pr.ts
-import { execFileSync as execFileSync15 } from "node:child_process";
+import { execFileSync as execFileSync16 } from "node:child_process";
 import { rmSync as rmSync4, writeFileSync as writeFileSync11 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
 import { join as join22 } from "node:path";
@@ -11250,7 +11348,7 @@ var RETRY_CREATE3 = "vinaya pr create --validate-only …";
 var RETRY_EDIT3 = "vinaya pr edit <n> --validate-only …";
 function git4(args) {
   try {
-    return execFileSync15("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync16("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return "";
   }
@@ -11284,7 +11382,7 @@ function reportPass2(json, command) {
 function runGhWrite2(ghCmd, ghArgs, bodyResult, json) {
   const { finalArgs, cleanup: cleanup2 } = resolveShippableArgs(ghArgs, bodyResult);
   try {
-    const out = execFileSync15("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
+    const out = execFileSync16("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
     const url = out.trim();
     if (json)
       printJson({ validated: true, written: true, url });
@@ -11299,7 +11397,7 @@ function runGhWrite2(ghCmd, ghArgs, bodyResult, json) {
 function fetchPrForgeContext(prRef) {
   let viewOut;
   try {
-    viewOut = execFileSync15("gh", ["pr", "view", prRef, "--json", "headRefName,files"], {
+    viewOut = execFileSync16("gh", ["pr", "view", prRef, "--json", "headRefName,files"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -11353,7 +11451,7 @@ ${brief}
   const tmp = join22(tmpdir2(), `vinaya-pr-create-brief-${process.pid}-${Date.now()}.md`);
   writeFileSync11(tmp, commentBody);
   try {
-    execFileSync15("gh", ["pr", "comment", prNumber, "--body-file", tmp], {
+    execFileSync16("gh", ["pr", "comment", prNumber, "--body-file", tmp], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -11476,7 +11574,7 @@ function prEditCommand(args) {
 }
 
 // src/commands/pr-report.ts
-import { execFileSync as execFileSync16, spawnSync as spawnSync2 } from "node:child_process";
+import { execFileSync as execFileSync17, spawnSync as spawnSync2 } from "node:child_process";
 import { existsSync as existsSync20, mkdtempSync as mkdtempSync2, readFileSync as readFileSync23, rmSync as rmSync5, writeFileSync as writeFileSync12 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join23 } from "node:path";
@@ -11484,14 +11582,14 @@ var EVIDENCE_START = "<!-- AEG:EVIDENCE:START -->";
 var EVIDENCE_END = "<!-- AEG:EVIDENCE:END -->";
 function git5(args) {
   try {
-    return execFileSync16("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync17("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return "";
   }
 }
 function gh(args) {
   try {
-    return execFileSync16("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync17("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (err) {
     const stderr = err.stderr;
     throw new Error(String(stderr ?? err.message).trim() || "gh command failed");
@@ -11510,7 +11608,7 @@ class GitCommandError extends Error {
 }
 function gitStrict(args) {
   try {
-    return execFileSync16("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync17("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (err) {
     const stderr = err.stderr;
     throw new GitCommandError(args, String(stderr ?? err.message).trim() || "non-zero exit");
@@ -11862,16 +11960,17 @@ async function buildReport(opts = {}) {
   const groupA = opts.groupA ?? computeGroupA();
   const gateRunner = opts.gateRunner ?? runRealGates;
   const gateResult = await gateRunner();
+  const outcomes = gateResult.outcomes.filter((o) => o.name !== "evidence-fresh");
   const groupC = opts.groupC ?? computeGroupC(opts.body ?? process.env.PR_BODY ?? "");
-  const blockInner = buildBlockInner(groupA, gateResult.outcomes, groupC);
+  const blockInner = buildBlockInner(groupA, outcomes, groupC);
   const block = `${EVIDENCE_START}
 ${blockInner}
 ${EVIDENCE_END}`;
   return {
     block,
     blockInner,
-    gatesFailed: gateResult.failed || groupCFailed(groupC),
-    gateOutcomes: gateResult.outcomes,
+    gatesFailed: anyGateFailed(outcomes) || groupCFailed(groupC),
+    gateOutcomes: outcomes,
     groupC
   };
 }
@@ -12028,7 +12127,7 @@ The AEG:EVIDENCE block was still written to ${writePath}.`);
 }
 
 // src/commands/pr-verify-evidence.ts
-import { execFileSync as execFileSync17 } from "node:child_process";
+import { execFileSync as execFileSync18 } from "node:child_process";
 
 // src/commands/pr-verify-evidence-logic.ts
 function publishedMergeBase(region) {
@@ -12115,10 +12214,10 @@ function renderVerdict(verdict) {
 
 // src/commands/pr-verify-evidence.ts
 function gh2(args) {
-  return execFileSync17("gh", args, { encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+  return execFileSync18("gh", args, { encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
 }
 function assertCleanWorktree() {
-  const dirty = execFileSync17("git", ["status", "--porcelain"], {
+  const dirty = execFileSync18("git", ["status", "--porcelain"], {
     encoding: "utf8",
     cwd: repoRoot2()
   }).trim();
@@ -12155,7 +12254,7 @@ function assertRepoRootCwd() {
   process.exit(2);
 }
 function repoRoot2() {
-  return execFileSync17("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
+  return execFileSync18("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
 }
 async function prVerifyEvidenceCommand(args) {
   const prRef = args[0] && !args[0].startsWith("-") ? args[0] : undefined;
@@ -12179,7 +12278,7 @@ async function prVerifyEvidenceCommand(args) {
     process.exit(1);
     return;
   }
-  const localHead = execFileSync17("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).trim();
+  const localHead = execFileSync18("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).trim();
   if (!forgeHead) {
     process.stderr.write(`pr verify-evidence: REFUSED — could not read #${prRef}'s head from the forge, so the verdict cannot be bound to a commit.
 `);
@@ -12202,7 +12301,7 @@ async function prVerifyEvidenceCommand(args) {
 }
 
 // src/commands/quickstart.ts
-import { execFileSync as execFileSync18 } from "node:child_process";
+import { execFileSync as execFileSync19 } from "node:child_process";
 import { existsSync as existsSync22, readFileSync as readFileSync25 } from "node:fs";
 import { join as join25 } from "node:path";
 
@@ -12402,7 +12501,7 @@ function realDeps7() {
   };
 }
 function execGit(repoRoot3, args) {
-  return execFileSync18("git", args, { cwd: repoRoot3, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+  return execFileSync19("git", args, { cwd: repoRoot3, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 function errorDetail(err) {
   const stderr = err.stderr;
@@ -12535,8 +12634,212 @@ async function quickstartCommand(args) {
   process.exit(await runQuickstart(args, realDeps7()));
 }
 
+// src/commands/release.ts
+import { execFileSync as execFileSync20 } from "node:child_process";
+function realDeps8() {
+  const git6 = (args) => {
+    try {
+      return execFileSync20("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    } catch {
+      return null;
+    }
+  };
+  return {
+    currentBranch() {
+      const branch = git6(["symbolic-ref", "--quiet", "--short", "HEAD"]);
+      return branch === null || branch === "" ? null : branch;
+    },
+    defaultBranch() {
+      const ref = git6(["symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD"]);
+      if (ref === null || !ref.startsWith("origin/"))
+        return null;
+      const branch = ref.slice("origin/".length);
+      return branch === "" ? null : branch;
+    },
+    fetchOrigin() {
+      try {
+        execFileSync20("git", ["fetch", "origin"], { stdio: "inherit" });
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    treeIsClean() {
+      const status = git6(["status", "--porcelain"]);
+      return status === "";
+    },
+    headSha() {
+      return git6(["rev-parse", "HEAD"]);
+    },
+    defaultBranchSha(defaultBranch) {
+      return git6(["rev-parse", `origin/${defaultBranch}`]);
+    },
+    headSubject() {
+      return git6(["log", "-1", "--format=%s"]) ?? "";
+    },
+    npmWhoami() {
+      try {
+        execFileSync20("npm", ["whoami"], { stdio: "ignore" });
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    runStreamed(cmd, args) {
+      execFileSync20(cmd, args, { stdio: "inherit" });
+    },
+    tagsAtHead() {
+      const tags = git6(["tag", "--points-at", "HEAD"]);
+      if (tags === null || tags === "")
+        return [];
+      return tags.split(`
+`).filter((t) => t.length > 0);
+    },
+    npmViewVersion(pkg) {
+      try {
+        const out = execFileSync20("npm", ["view", pkg, "version"], {
+          encoding: "utf8",
+          stdio: ["ignore", "pipe", "pipe"]
+        }).trim();
+        return out === "" ? null : out;
+      } catch {
+        return null;
+      }
+    },
+    log(message) {
+      process.stdout.write(`${message}
+`);
+    }
+  };
+}
+var RELEASE_PLAN = [
+  ["bun", "install", "--frozen-lockfile"],
+  ["bun", "run", "build"],
+  ["bun", "run", "changeset:publish"],
+  ["git", "push", "origin", "--tags"]
+];
+function parseTag(tag) {
+  const at = tag.lastIndexOf("@");
+  if (at <= 0)
+    return null;
+  return { pkg: tag.slice(0, at), version: tag.slice(at + 1) };
+}
+function runRelease(opts, deps) {
+  const current = deps.currentBranch();
+  const defaultBranch = deps.defaultBranch();
+  if (defaultBranch === null) {
+    return {
+      ok: false,
+      message: "vinaya release: could not determine this repo's default branch (no resolvable `origin/HEAD`) — run `git remote set-head origin -a` first."
+    };
+  }
+  if (current !== defaultBranch) {
+    return {
+      ok: false,
+      message: `vinaya release: HEAD is on \`${current ?? "(detached)"}\`, not the default branch \`${defaultBranch}\` — check out \`${defaultBranch}\` first.`
+    };
+  }
+  if (!deps.treeIsClean()) {
+    return {
+      ok: false,
+      message: "vinaya release: working tree is dirty — commit or stash your changes first."
+    };
+  }
+  if (!deps.fetchOrigin()) {
+    return {
+      ok: false,
+      message: "vinaya release: `git fetch origin` failed — check your network/auth and try again."
+    };
+  }
+  const head = deps.headSha();
+  const originSha = deps.defaultBranchSha(defaultBranch);
+  if (head === null || originSha === null || head !== originSha) {
+    return {
+      ok: false,
+      message: `vinaya release: HEAD does not equal \`origin/${defaultBranch}\` — run \`git pull --ff-only\` first.`
+    };
+  }
+  const subject = deps.headSubject();
+  if (!opts.allowAnyCommit && !subject.startsWith("Chore(release): Version packages")) {
+    return {
+      ok: false,
+      message: `vinaya release: HEAD's commit "${subject}" is not a Version Packages commit — merge the Version Packages PR first, or pass \`--allow-any-commit\`.`
+    };
+  }
+  if (!deps.npmWhoami()) {
+    return {
+      ok: false,
+      message: "vinaya release: `npm whoami` failed — run `npm login` first."
+    };
+  }
+  if (opts.dryRun) {
+    return { ok: true, dryRun: true, plan: RELEASE_PLAN };
+  }
+  const ranSteps = [];
+  let publishedAlready = false;
+  for (const step of RELEASE_PLAN) {
+    const [cmd, ...args] = step;
+    deps.log(`vinaya release: running \`${step.join(" ")}\``);
+    try {
+      deps.runStreamed(cmd, args);
+    } catch (error2) {
+      const reason = error2 instanceof Error ? error2.message : String(error2);
+      if (!publishedAlready) {
+        return { ok: false, message: `vinaya release: \`${step.join(" ")}\` failed — ${reason}` };
+      }
+      const recoveryCommand = RELEASE_PLAN.slice(ranSteps.length).map((s) => s.join(" ")).join(" && ");
+      return {
+        ok: false,
+        message: `vinaya release: \`${step.join(" ")}\` failed after publish already succeeded — packages are on the registry, the release is not finished. Ran: ${ranSteps.map((s) => s.join(" ")).join(", ") || "(nothing)"}. Failed: \`${step.join(" ")}\` — ${reason}. Finish by hand: \`${recoveryCommand}\``,
+        ranSteps: [...ranSteps],
+        failedStep: step,
+        recoveryCommand
+      };
+    }
+    deps.log(`vinaya release: \`${step.join(" ")}\` done`);
+    ranSteps.push(step);
+    if (cmd === "bun" && args.join(" ") === "run changeset:publish")
+      publishedAlready = true;
+  }
+  const published = [];
+  for (const tag of deps.tagsAtHead()) {
+    const parsed = parseTag(tag);
+    if (parsed === null)
+      continue;
+    const registryVersion = deps.npmViewVersion(parsed.pkg);
+    const lagExpected = parsed.pkg === "@attalabs/vinaya" && registryVersion !== parsed.version;
+    published.push({ tag, pkg: parsed.pkg, version: parsed.version, registryVersion, lagExpected });
+  }
+  return { ok: true, dryRun: false, published };
+}
+async function releaseCommand(args) {
+  const dryRun = args.includes("--dry-run");
+  const allowAnyCommit = args.includes("--allow-any-commit");
+  const deps = realDeps8();
+  const outcome = runRelease({ dryRun, allowAnyCommit }, deps);
+  if (!outcome.ok) {
+    console.error(outcome.message);
+    process.exit(1);
+  }
+  if (outcome.dryRun) {
+    deps.log("vinaya release --dry-run: preconditions pass. Plan:");
+    for (const step of outcome.plan)
+      deps.log(`  ${step.join(" ")}`);
+    process.exit(0);
+  }
+  for (const p of outcome.published) {
+    const registry = p.registryVersion ?? "(not found)";
+    if (p.lagExpected) {
+      deps.log(`${p.tag}: npm view reports \`${registry}\` — registry lag expected (~20 min)`);
+    } else {
+      deps.log(`${p.tag}: npm view reports \`${registry}\``);
+    }
+  }
+  process.exit(0);
+}
+
 // src/commands/review-post.ts
-import { execFileSync as execFileSync19 } from "node:child_process";
+import { execFileSync as execFileSync21 } from "node:child_process";
 import { readFileSync as readFileSync26, rmSync as rmSync6, writeFileSync as writeFileSync14 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
 import { join as join26 } from "node:path";
@@ -12925,7 +13228,7 @@ function normalizeSecurityVerdict(raw) {
 }
 function gh3(args) {
   try {
-    return execFileSync19("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync21("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (err) {
     const stderr = err.stderr;
     throw new Error(String(stderr ?? err.message).trim() || "gh command failed");
@@ -12945,7 +13248,7 @@ function resolveHeadRefName(pr) {
 }
 function shaFromLsRemote(branch) {
   try {
-    const out = execFileSync19("git", ["ls-remote", "origin", `refs/heads/${branch}`], {
+    const out = execFileSync21("git", ["ls-remote", "origin", `refs/heads/${branch}`], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     }).trim();
@@ -13007,13 +13310,13 @@ function fetchComments(pr) {
 }
 function computeChangedRanges(pr, judgedHead, resolvedHead) {
   try {
-    execFileSync19("git", ["fetch", "origin", resolvedHead], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    execFileSync21("git", ["fetch", "origin", resolvedHead], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (err) {
     refuseCmd(`Could not compute the round-two diff for PR ${pr}: \`git fetch origin ${resolvedHead}\` failed (${err instanceof Error ? err.message : String(err)}) — the PR's current head is not reachable from this worktree's origin remote.`, "Confirm the PR head is pushed to origin and reachable, then re-run.");
   }
   let out;
   try {
-    out = execFileSync19("git", ["diff", `${judgedHead}...${resolvedHead}`, "-U0"], {
+    out = execFileSync21("git", ["diff", `${judgedHead}...${resolvedHead}`, "-U0"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -13312,11 +13615,11 @@ Self-verification: clean — re-parsed VERDICT is bound to head ${headSha}.
 }
 
 // src/commands/review-status.ts
-import { execFileSync as execFileSync20 } from "node:child_process";
+import { execFileSync as execFileSync22 } from "node:child_process";
 var MAX_ROUNDS = 3;
 function fetchPr(prNumber) {
   try {
-    const out = execFileSync20("gh", ["pr", "view", prNumber, "--json", "comments,headRefOid,baseRefName"], {
+    const out = execFileSync22("gh", ["pr", "view", prNumber, "--json", "comments,headRefOid,baseRefName"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -13327,7 +13630,7 @@ function fetchPr(prNumber) {
 }
 function behindBy(base) {
   try {
-    const out = execFileSync20("git", ["rev-list", "--count", `HEAD..origin/${base}`], {
+    const out = execFileSync22("git", ["rev-list", "--count", `HEAD..origin/${base}`], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     }).trim();
@@ -13526,7 +13829,7 @@ async function runStudio(cwd, args, moduleUrl = import.meta.url) {
 // src/commands/upgrade.ts
 import { existsSync as existsSync24, readFileSync as readFileSync28, rmSync as rmSync7, writeFileSync as writeFileSync15 } from "node:fs";
 import { join as join28 } from "node:path";
-function realDeps8() {
+function realDeps9() {
   return {
     detectRepo: detectGitRepo,
     hookDirFor: resolveHookDir,
@@ -13921,16 +14224,16 @@ Vinaya upgraded.
   return 0;
 }
 async function upgradeCommand(args) {
-  process.exit(await runUpgrade(args, realDeps8()));
+  process.exit(await runUpgrade(args, realDeps9()));
 }
 
 // src/commands/waiver.ts
-import { execFileSync as execFileSync21 } from "node:child_process";
+import { execFileSync as execFileSync23 } from "node:child_process";
 function labelFor(kind) {
   return kind === "docs" ? WAIVER_LABEL : WAIVER_LABEL_REVIEW;
 }
 function gh4(args) {
-  return execFileSync21("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: process.env }).trim();
+  return execFileSync23("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: process.env }).trim();
 }
 function detectPrNumber() {
   try {
@@ -14030,8 +14333,8 @@ Reason: ${reason}`];
   }
   process.stdout.write(`Applying \`${label2}\` to PR #${prNumber} under your authenticated \`gh\` identity — vinaya never fabricates an actor.
 `);
-  execFileSync21("gh", editArgs, { stdio: "inherit", env: process.env });
-  execFileSync21("gh", commentArgs, { stdio: "inherit", env: process.env });
+  execFileSync23("gh", editArgs, { stdio: "inherit", env: process.env });
+  execFileSync23("gh", commentArgs, { stdio: "inherit", env: process.env });
   process.stdout.write(`
 ✓ Label applied and reason posted as a PR comment.
 `);
@@ -14227,6 +14530,10 @@ try {
       await waiverCommand(args);
       break;
     }
+    case "release": {
+      await releaseCommand(args);
+      break;
+    }
     case "quickstart": {
       await quickstartCommand(args);
       break;