@attalabs/vinaya 0.24.0 → 0.24.1

package/aeg-root/enforcement.md

@@ -144,7 +144,7 @@ Every pull request, on open and on every push, re-runs the same checks in CI:
 | doctrine-portability | Ever shipped doctrine that named a file only you could see? | ci | Re-checks that shipped doctrine doesn't cite a path that exists only in the authoring repository. | A cited path's top segment judged against an allow-list: the caller-supplied ships prefix itself (`<doctrineRoot>/`, `aeg-root/` by default — doctrine citing its own tree, wherever that tree actually lives for the caller, checked dynamically so a non-default `doctrineRoot` never falsely flags an adopter's own self-citations), plus a fixed set of static portable prefixes (`roles/`, `contracts/`, `skills/`, and adopter-owned `.github/`, `.vinaya/`, `.claude/`, `.git/`, `.husky/`) — an unclassified prefix is a finding, never a silent pass, so a never-seen author-repo directory (e.g. a build artifact under `apps/*/dist/`) cannot slip through the way it would under a deny-list. Zero I/O in `@attalabs/aeg-core`'s `checkDoctrinePortability`; the bin supplies the only I/O, reading `<doctrineRoot>/**` twice — once from the working tree, once from `BASE_SHA` (`origin/main` by default) via `git show`/`git ls-tree` — and reports only citations present in the former and absent from the latter, so day-one install of an unfixed backlog never turns every adopter's CI red. Registered in `coreCheckRegistry()`, report-only like `reader-resolvable-prose`/`retired-vocabulary`. **Line-scoped under `--diff-only`** (this task): a finding prints only when its own line falls inside a changed hunk of that file's diff against the base. A full sweep is unchanged and still reports every finding in the tree. The hunk parser lives in exactly one place — the shared diff-evidence helper both this and every sibling sweep call — never a second regex per check. Without this, a diff that touched one line of a long doctrine page reported that page's whole standing backlog as if this PR had caused it, and a real new finding was indistinguishable from inherited noise. Registered with `include: ['aeg-root/**/*.md']` (task 12) — pinning/documentation only today, since `runner.ts`'s `shouldSkip` returns before consulting `include` for a `scope: 'full'` entry (out of that task's surface); a future `runner.ts` change extending `--diff-only` skipping to `scope: 'full'` finds this already declared. | product | `apps/cli/src/checks/bin/check-doctrine-portability.ts` |
 | doctrine-no-procedures | Ever pasted a copy-paste runbook into doctrine, and it rotted the moment the real command changed? | ci | Re-checks that doctrine (`roles/*.md`, `contracts/*.md`, …) describes commands rather than scripting them (task 9/task 10's rule). | A fenced code block anywhere under `<doctrineRoot>/**/*.md`, tagged with no language or an explicit `sh`/`bash`/`shell`/`console`, containing two or more lines that each start with a shell command word (`export`/`bun`/`gh`/`git`/`grep`/`sed`/`cat`/`diff`/`vinaya`) is a finding — a runbook, not an illustration. A block tagged with any other language (` ```ts `, ` ```json `, …) is never a candidate at all, however many command-word-shaped lines it contains — a two-line ` ```ts ` excerpt whose lines both start with `export` is TypeScript, not shell. Two further exemptions: a block sitting inside the existing `AEG:VENDOR-EXAMPLE` anchor pair (`tranche-model.md` §12's one sanctioned fenced home for a real command sequence), and any file under a `templates/` directory. Zero I/O in `@attalabs/aeg-core`'s `checkDoctrineNoProcedures`; the bin supplies the only I/O, walking `<doctrineRoot>` once. Unlike its sibling `doctrine-portability` above, this is **blocking, not baseline** (`severity: error`, exit 1 on any finding) — a fresh rule with an expected-zero corpus after this task's own sweep-and-fix, not a 200+-finding backlog needing a report-only rollout. Registered in `coreCheckRegistry()`. Registered with `include: ['aeg-root/**/*.md']` (task 12) — pinning/documentation only today, since `runner.ts`'s `shouldSkip` returns before consulting `include` for a `scope: 'full'` entry (out of that task's surface); a future `runner.ts` change extending `--diff-only` skipping to `scope: 'full'` finds this already declared. | product | `apps/cli/src/checks/bin/check-doctrine-no-procedures.ts` |
 | No new on-disk state | Ever had a file and the forge disagree about the same fact? | ci | Blocks a diff that creates a new on-disk state file duplicating what the forge already derives. | No live per-tranche topology file appears under `aeg-root/tranches/` (a top-level file there fails on add or edit; under `completed/**` only genuinely NEW files are refused, so the legacy archives stay editable), and no new `*.tokens.md` appears anywhere — token figures live in the PR body, and the ledger row is appended post-merge. Status-aware (`git diff --name-status`), never fired by a deletion; a rename counts as an addition at its new path. The registered `no-disk-state` check runs the same `isNewDiskStateFile` predicate at ring 0 (the managed hooks) and here; this row names the standalone CLI shim of that gate. | product | `packages/aeg-core/bin/check-no-disk-state.ts` |
-| workspace-escape | Ever deleted a package only to break a sibling's tests through a path nobody's dependency graph saw? | ci | Re-checks that no source file's constructed filesystem reference reaches outside its own workspace package, or points at a path that does not exist. | Every `readFileSync`/`readFile` call with a literal relative-path argument, and every `new URL('…', import.meta.url)`, across every `.ts`/`.tsx` file under `apps/*`/`packages/*` — resolved against the citing file's own directory and judged against its own two-segment workspace-package prefix (`apps/<name>`, `packages/<name>`), never against `import`/`require` module specifiers (the dependency graph already owns those). Zero I/O in `@attalabs/aeg-core`'s `findWorkspaceEscapes`; the bin supplies the only I/O, walking the working tree once for source content and once for the existence-check universe (files AND directories, so a reference to a directory itself resolves as existing). Registered in `coreCheckRegistry()` (task 17), report-only like `reader-resolvable-prose`/`retired-vocabulary`/`doctrine-portability` — this repo's own corpus carries one pre-existing genuine escape (`packages/sources/src/commands-router-coverage.test.ts` reaching into `apps/cli/src/index.ts`, structurally the same incident this check exists to catch), and a blocking check on day one would fail this repo's own CI on that finding before a separate task has triaged fixing it. **Line-scoped under `--diff-only`** (this task): a finding prints only when its own line falls inside a changed hunk of that file's diff against the base. A full sweep is unchanged and still reports every finding in the tree. The hunk parser lives in exactly one place — the shared diff-evidence helper both this and every sibling sweep call — never a second regex per check. Without this, a diff that touched one line of a long doctrine page reported that page's whole standing backlog as if this PR had caused it, and a real new finding was indistinguishable from inherited noise. Registered with `include: ['aeg-root/**/*.md']` (task 12) — pinning/documentation only today, since `runner.ts`'s `shouldSkip` returns before consulting `include` for a `scope: 'full'` entry (out of that task's surface); a future `runner.ts` change extending `--diff-only` skipping to `scope: 'full'` finds this already declared. (this sweep's real domain is `apps`/`packages`, not `aeg-root` — named per the Issue's own list; harmless either way while `include` has no runtime effect on a `scope: 'full'` entry.) | product | `apps/cli/src/checks/bin/check-workspace-escape.ts` |
+| workspace-escape | Ever deleted a package only to break a sibling's tests through a path nobody's dependency graph saw? | ci | Re-checks that no source file's constructed filesystem reference reaches outside its own workspace package, or points at a path that does not exist. | Every `readFileSync`/`readFile` call with a literal relative-path argument, and every `new URL('…', import.meta.url)`, across every `.ts`/`.tsx` file under `apps/*`/`packages/*` — resolved against the citing file's own directory and judged against its own two-segment workspace-package prefix (`apps/<name>`, `packages/<name>`), never against `import`/`require` module specifiers (the dependency graph already owns those). Zero I/O in `@attalabs/aeg-core`'s `findWorkspaceEscapes`; the bin supplies the only I/O, walking the working tree once for source content and once for the existence-check universe (files AND directories, so a reference to a directory itself resolves as existing). Registered in `coreCheckRegistry()` (task 17), report-only like `reader-resolvable-prose`/`retired-vocabulary`/`doctrine-portability`. `*.test.ts`/`*.test.tsx` files are excluded from the swept surface entirely (O2, found live 2026-09-04) — this repo's own corpus carried a genuine escape at `packages/sources/src/commands-router-coverage.test.ts` reaching into `apps/cli/src/index.ts`, structurally the same incident this check exists to catch, until that exclusion silenced it alongside `workspace-escape.test.ts`'s own fixture-string false positive; report-only severity stays regardless, since an ordinary (non-test) source file's constructed reference can still exist with nobody having triaged it yet. **Line-scoped under `--diff-only`** (this task): a finding prints only when its own line falls inside a changed hunk of that file's diff against the base. A full sweep is unchanged and still reports every finding in the tree. The hunk parser lives in exactly one place — the shared diff-evidence helper both this and every sibling sweep call — never a second regex per check. Without this, a diff that touched one line of a long doctrine page reported that page's whole standing backlog as if this PR had caused it, and a real new finding was indistinguishable from inherited noise. Registered with `include: ['aeg-root/**/*.md']` (task 12) — pinning/documentation only today, since `runner.ts`'s `shouldSkip` returns before consulting `include` for a `scope: 'full'` entry (out of that task's surface); a future `runner.ts` change extending `--diff-only` skipping to `scope: 'full'` finds this already declared. (this sweep's real domain is `apps`/`packages`, not `aeg-root` — named per the Issue's own list; harmless either way while `include` has no runtime effect on a `scope: 'full'` entry.) | product | `apps/cli/src/checks/bin/check-workspace-escape.ts` |
 | changeset-coverage | Ever shipped a change to a published package and the release train never picked it up? | ci | Re-checks that a diff touching a published package's own shipped files also carries a changeset in the same diff. | For each member of `.changeset/config.json`'s `fixed` group, a changed path counts as SHIPPED iff it falls under that member's own `package.json` `files` allowlist, read live from every workspace member's own manifest — never a hardcoded path list, never a directory heuristic. A diff that hits at least one shipped path with no `.changeset/*.md` entry (excluding `README.md`) in the same diff is a finding, naming the shipped paths hit. The Changesets-release branch itself is exempt by construction (its diff IS the changesets being consumed) — the exemption reuses `@attalabs/aeg-core`'s own release-branch constant, the same one `body-bare-digits`'s Changesets-release exemption is keyed on, rather than inventing a second branch-name special-case; unlike that check it never live-fetches a PR author, since a report-only, always-exit-`0` check has no gate for a spoofed branch name to bypass. Written after four separate published-package pull requests, over the course of one day, each merged with no changeset and caught only by a human after the fact — the obligation existed in no enforceable place before this check: not in `roles/developer.md`'s deliverable conventions (now amended alongside this row), not in any registered check. Zero I/O in the pure predicate (`changeset-coverage-logic.ts`); the bin supplies the only I/O — reading the config, every fixed-group member's own manifest, and the diff. Registered in `coreCheckRegistry()`, report-only like `reader-resolvable-prose`/`retired-vocabulary`/`doctrine-portability`/`workspace-escape` above — graduating to a blocking check, and any waiver-label escape that would need, is a later, separately-dispatched decision once the false-positive rate is observed; v1 carries no such escape. | product | `apps/cli/src/checks/bin/check-changeset-coverage.ts` |
 | quoted-command | Ever read a doc that quoted a command as "what runs today", and the command changed underneath it? | ci | Re-checks that a doc's explicitly marked quote of a command or config line still matches, verbatim, the file it names as its source. | Marker-based only, by explicit Principal decision, not inferred from command-looking spans: a doc opts a span in with `<!-- AEG:QUOTES-FILE:START:<path> -->…<!-- AEG:QUOTES-FILE:END -->` (the same invisible-on-render, code-blind HTML-comment idiom `anchored-region.ts` uses for its own seven PR/Issue-body fields, reusing that file's masking primitive rather than a second parser — but a distinct marker kind, since the cited path is free text, not one of that file's seven closed field names). An adopter-facing command in a README with no marker is instruction, not a claim, and is never flagged — inference over command-looking spans was explicitly rejected as the false-positive shape that gets a gate disabled. `findCitedQuotes` sweeps the identical `ships`/`reader-facing` corpus `reader-resolvable-prose` sweeps (never a second notion of "governed doc"); `evaluateCitedQuotes` then checks each marked span against its cited file's live content, wherever that file lives in the repo, naming both sides in a finding — what the doc claims, and which file no longer contains it verbatim. Zero I/O in `@attalabs/aeg-core`'s pure predicate (`quoted-command.ts`), corpus-tested against the real `aeg-root/**` tree; the bin supplies the only I/O. Ships with one real, live annotation (this very paragraph's own sibling callout above, quoting the CI invocation this page names) rather than only synthetic fixtures. Written after a measured incident: a CI invocation was pinned to a version in one pull request; this page quoted the pre-pin form verbatim as current fact; every registered check passed, `doctor` reported healthy, security passed, and a code-review agent found the drift only after independent re-derivation. Registered in `coreCheckRegistry()`, report-only like `reader-resolvable-prose`/`retired-vocabulary`/`doctrine-portability`/`workspace-escape`/`changeset-coverage` above — graduating to a blocking check is a later, separately-dispatched decision once the false-positive rate is observed against real adopter corpora; v1 carries no waiver escape. | product | `apps/cli/src/checks/bin/check-quoted-command.ts` |
 | token-report | Ever seen a cost figure nobody could trace to a source? | ci | Re-checks that a PR's "Token report" section actually carries real numeric Tokens in/out figures, on any host this repo can prove is metering-capable. | The presence and shape of the `## Token report` block `roles/developer.md` requires every self-metering role to paste at turn-end — never whether the reported figures are TRUE, which CI structurally cannot recompute (the same bounded honesty this page's `evidence-fresh` row states for its own Group B). Runs `resolveMeteringCapability` (task 1's probe, `@attalabs/aeg-core`) fresh in THIS process; an incapable verdict (any reason) passes silently — the sanctioned operator-metered case, same discipline `token-collection-wired` above already applies. **Ring derived mechanically as `1`, not chosen** (a 2026-08-29 amendment correcting the original brief rationale's now-retracted ring-0/1 instruction): `requiresOpenPr: true` makes this check CI-only by `CoreCheckRing`'s own derivation rule, since the PR body it reads does not exist before a PR does. A probe that itself fails to run (an unexpected `exists`/`readFile` throw the probe does not catch) is never read as a clean incapable verdict: the bin lets it propagate uncaught, which the runner surfaces as `status: 'error'`, distinct from the `status: 'pass'` a real incapable verdict produces. | product | `apps/cli/src/checks/bin/check-token-report.ts` |

package/aeg-root/roles/developer.md

@@ -103,7 +103,7 @@ Items 3, 5, and 7 read live forge state. Item 6 checks the brief's own Step 0 te
 
 **Worktree discipline.** Your brief's first pre-flight step (Step 0) is creating a worktree — do it before anything else. If dispatched by an automation layer, you work in the worktree it created at `.worktrees/task/<tranche>/<n>/`. If working manually, the brief's Step 0 gives you the `git worktree add … origin/main` command — run it and `cd` in. Never branch from a local checkout that may be behind.
 
-**Commit per Part, push once.** Commit after each numbered Part in the brief — small, one logical change per commit, so the history reads as a narrative of how you approached the problem. Push exactly once, immediately before `pr create` — not after every commit. Run each Part's own affected suite (`bunx turbo test --affected`) before committing it, never the full suite; the full `bun run test` run is CI's to run, on your one push, not the Developer's to run locally. A regeneration or evidence run (`vinaya pr report --write`/`--push`) passes `--force` to its own test invocation. A verdict binds to the head it judged; a push landing after the newest verdict's judged head voids it and is named as such: `vinaya review status` prints `push after verdict — re-review required`, and merge waits on a fresh review round.
+**Commit per Part, push once.** Commit after each numbered Part in the brief — small, one logical change per commit, so the history reads as a narrative of how you approached the problem. Push exactly once, immediately before `pr create` — not after every commit. The pre-push hook itself runs the affected test suite (`bunx turbo test --affected`) on that one push and refuses it on failure; you do not additionally run it yourself per Part. A regeneration or evidence run (`vinaya pr report --write`/`--push`) passes `--force` to its own test invocation. A verdict binds to the head it judged; a push landing after the newest verdict's judged head voids it and is named as such: `vinaya review status` prints `push after verdict — re-review required`, and merge waits on a fresh review round.
 
 **Opening the PR with a complete description.** The PR description must (1) **carry the report only** — `pr create` posts the brief as its own comment marked `aeg:brief`, once; that comment is the brief's permanent, durable home, and the Reviewer and Archivist read it there; (2) follow the canonical form in [§ PR body — canonical form](#pr-body--canonical-form) below — that section holds the verbatim copy-pasteable template, including the **exact `Tier:` field syntax** the `verify-docs` gate requires; (3) reference the task's Issue (`Closes #N`) so the merge auto-closes it. The description is not optional — the reviews depend on it. Opening the PR is itself the `in-flight → in-review` transition; you write no status field. **The body is authored once, at open.** After the PR is open, you never hand-edit it again — not to append a response to a review round, not to record a decision, not for any reason. Two writes are sanctioned after open, both machine-regenerated, never typed: the Evidence block, and one appended row in the Token report for a re-entry turn (see [§ Evidence is emitted, never typed](#evidence-is-emitted-never-typed)). Everything else a review round produces — your response to findings, re-run `[agent]` evidence, any disclosure the brief didn't anticipate — is a PR comment.
 

package/dist/checks/bin/check-changeset-coverage.js

@@ -4948,6 +4948,13 @@ function git(args) {
     return "";
   }
 }
+function currentBranch() {
+  return git(["symbolic-ref", "--quiet", "--short", "HEAD"]);
+}
+function defaultBranch() {
+  const ref = git(["symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD"]);
+  return ref.startsWith("origin/") ? ref.slice("origin/".length) : "";
+}
 function toPosix(p) {
   return p.split("\\").join("/");
 }
@@ -5004,6 +5011,11 @@ function fixedGroupNames(root) {
 }
 function main() {
   const root = repoRoot() ?? process.cwd();
+  const current = currentBranch();
+  const base = defaultBranch();
+  if (current !== "" && current === base) {
+    process.exit(0);
+  }
   const changedAbs = resolveChangedFiles();
   if (changedAbs === null) {
     emitCheckError({

package/dist/checks/bin/check-registry-gates.js

@@ -4858,7 +4858,7 @@ var REGISTRY = [
       run: bin("check-main-branch-refusal"),
       scope: "full",
       timeoutMs: 15000,
-      env: {}
+      env: { VINAYA_PUSH_REFS: { optional: true } }
     },
     0
   ],

package/dist/checks/bin/check-workspace-escape.js

@@ -4877,6 +4877,9 @@ var CHECK_NAME = "workspace-escape";
 var WORKSPACE_DIRS = ["apps", "packages"];
 var SOURCE_EXTENSIONS = [".ts", ".tsx"];
 var EXCLUDED_DIRS = new Set(["node_modules", "dist", ".turbo", ".next", ".git"]);
+function isTestFile(path) {
+  return /\.test\.tsx?$/.test(path);
+}
 function collectAllPaths(dir, out = []) {
   let entries;
   try {
@@ -4903,7 +4906,7 @@ function collectAllPaths(dir, out = []) {
 function main() {
   const allPaths = WORKSPACE_DIRS.flatMap((d) => collectAllPaths(d)).map((p) => p.split("\\").join("/"));
   const knownPaths = new Set(allPaths);
-  const sourceFiles = allPaths.filter((p) => SOURCE_EXTENSIONS.some((ext) => p.endsWith(ext))).map((p) => ({ path: p, content: readFileSync3(p, "utf8") }));
+  const sourceFiles = allPaths.filter((p) => SOURCE_EXTENSIONS.some((ext) => p.endsWith(ext))).filter((p) => !isTestFile(p)).map((p) => ({ path: p, content: readFileSync3(p, "utf8") }));
   const findings = findWorkspaceEscapes(sourceFiles, knownPaths, WORKSPACE_DIRS);
   const reportable = findingsInThisDiff(findings);
   console.log(`${CHECK_NAME}: ${sourceFiles.length} source file(s) scanned under ${WORKSPACE_DIRS.join("/")}; ${findings.length} finding(s), ${reportable.length} in this diff`);
@@ -4921,4 +4924,9 @@ function main() {
   }
   process.exit(0);
 }
-main();
+if (__require.main == __require.module) {
+  main();
+}
+export {
+  isTestFile
+};

package/dist/index.js

@@ -3309,7 +3309,7 @@ function renderSection6(facts) {
       "   Files:",
       ...files.map((f) => `   - ${f.path}`),
       "",
-      `   Run \`bunx turbo test --affected\` before committing this Part; touches ${pkg}.`
+      `   Touches ${pkg}. The pre-push hook runs the affected suite on your one push and refuses it on failure — do not run it yourself per Part.`
     ].join(`
 `));
     n++;
@@ -3335,7 +3335,7 @@ function renderSection8() {
   return [
     "## 8. Verification before claiming done",
     "",
-    "- `bunx turbo test --affected --force` (the command and its output are attested in the Evidence block).",
+    "- The pre-push hook already ran the affected suite on your one push and refused it on failure — do not additionally run it yourself; `vinaya pr report --write`/`--push` separately re-runs it with `--force` to attest the command and its output in the Evidence block.",
     "- The full `bun run test` suite is CI's to run, on the one push — never run it locally.",
     "- Every blast-radius consumer named in §4, re-verified by name.",
     '- `roles/developer.md`\'s tier checklist genuinely satisfied, and `PR_BODY="$(cat <body-file>)" bun packages/aeg-core/bin/verify-docs.ts --pr` green.'
@@ -3911,7 +3911,7 @@ ${vinayaSetupSteps(selfHost, "pull-request")}${adopterSetupStep(ciSetup)}      #
           GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: \${{ github.event.pull_request.number }}
         run: |
-          DELIM="PR_BODY_$(date +%s%N)"
+          DELIM="PR_BODY_$(openssl rand -hex 16)"
           echo "PR_BODY<<$DELIM" >> "$GITHUB_ENV"
           gh pr view "$PR_NUMBER" --json body --jq .body >> "$GITHUB_ENV"
           echo "$DELIM" >> "$GITHUB_ENV"
@@ -4081,13 +4081,26 @@ jobs:
           # lookup vinaya-review-verdict.yml's own retrigger step runs.
           set -o pipefail
           RUN_TITLE="Vinaya Review Gate PR #$PR_NUMBER @ $HEAD_SHA"
+          # O7 (found live 2026-09-04): dropped \`select(.status == "completed")\`
+          # — two retriggers for the same head race the SAME required run
+          # (PR #401, PR #409: runs 33841069791/33841065139), and the loser's
+          # query landed while the winner's \`gh run rerun\` had already
+          # flipped the run to \`in_progress\`. Requiring \`completed\` made
+          # that run invisible to the loser entirely — not "already handled,
+          # skip", but "nothing matched, give up" — so when that in-flight
+          # attempt itself later failed, nothing retried it again and the
+          # gate stayed red until a hand rerun. Matching on title+event alone
+          # (any status) lets the loser find the SAME run mid-run and try
+          # \`gh run rerun\` on it too; the existing "declined (already
+          # queued)" fallback below already handles that outcome harmlessly
+          # — it is not a new failure mode, only a query that used to see
+          # nothing at all now sees the run and takes the same safe no-op.
           RUN_ID=$(gh api --paginate \\
             "repos/\${{ github.repository }}/actions/workflows/vinaya-review.yml/runs?event=pull_request_target&per_page=100" \\
             | jq -sr --arg title "$RUN_TITLE" '
                 [.[].workflow_runs[]
                  | select(.display_title == $title)
                  | select(.event == "pull_request_target")
-                 | select(.status == "completed")
                  | select(.conclusion != "cancelled")
                  | .id][0] // empty')
           if [ -z "$RUN_ID" ]; then
@@ -4164,7 +4177,7 @@ ${vinayaSetupSteps(selfHost, "trusted")}      # PR_BODY is what makes body-bare-
           GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: \${{ github.event.pull_request.number }}
         run: |
-          DELIM="PR_BODY_$(date +%s%N)"
+          DELIM="PR_BODY_$(openssl rand -hex 16)"
           echo "PR_BODY<<$DELIM" >> "$GITHUB_ENV"
           gh pr view "$PR_NUMBER" --json body --jq .body >> "$GITHUB_ENV"
           echo "$DELIM" >> "$GITHUB_ENV"
@@ -4285,13 +4298,26 @@ ${vinayaSetupSteps(selfHost, "trusted")}      - name: Review gate (verdict evalu
           # query matches that immutable display_title exactly.
           set -o pipefail
           RUN_TITLE="Vinaya Review Gate PR #$PR_NUMBER @ $HEAD_SHA"
+          # O7 (found live 2026-09-04): dropped \`select(.status == "completed")\`
+          # — two retriggers for the same head race the SAME required run
+          # (PR #401, PR #409: runs 33841069791/33841065139), and the loser's
+          # query landed while the winner's \`gh run rerun\` had already
+          # flipped the run to \`in_progress\`. Requiring \`completed\` made
+          # that run invisible to the loser entirely — not "already handled,
+          # skip", but "nothing matched, give up" — so when that in-flight
+          # attempt itself later failed, nothing retried it again and the
+          # gate stayed red until a hand rerun. Matching on title+event alone
+          # (any status) lets the loser find the SAME run mid-run and try
+          # \`gh run rerun\` on it too; the existing "declined (already
+          # queued)" fallback below already handles that outcome harmlessly
+          # — it is not a new failure mode, only a query that used to see
+          # nothing at all now sees the run and takes the same safe no-op.
           RUN_ID=$(gh api --paginate \\
             "repos/\${{ github.repository }}/actions/workflows/vinaya-review.yml/runs?event=pull_request_target&per_page=100" \\
             | jq -sr --arg title "$RUN_TITLE" '
                 [.[].workflow_runs[]
                  | select(.display_title == $title)
                  | select(.event == "pull_request_target")
-                 | select(.status == "completed")
                  | select(.conclusion != "cancelled")
                  | .id][0] // empty')
           if [ -z "$RUN_ID" ]; then
@@ -4429,8 +4455,13 @@ ${hookRun(selfHost, "check --all --local")}`;
     return base;
   return `${base}
 # Ring 0: the affected test suite. A failing test refuses the push with
-# its own output (#407, O4).
-bunx turbo test --affected || exit 1`;
+# its own output (#407, O4). --concurrency=1 (O9, found live 2026-09-04):
+# a local machine already running other work (another worktree's own
+# build/test, an IDE indexer) alongside this hook's parallel package
+# suites was measured pushing a git-clone-heavy fixture test past its
+# timeout under real contention — CI's own runner is dedicated and keeps
+# turbo.json's default concurrency; only this hook invocation is serialized.
+bunx turbo test --affected --concurrency=1 || exit 1`;
 }
 function commitMsgBody(selfHost) {
   return `# Vinaya commit-message gate. Validates the message's first line against
@@ -7931,7 +7962,7 @@ var REGISTRY = [
       run: bin("check-main-branch-refusal"),
       scope: "full",
       timeoutMs: 15000,
-      env: {}
+      env: { VINAYA_PUSH_REFS: { optional: true } }
     },
     0
   ],
@@ -9719,7 +9750,7 @@ async function runDoctor(args, deps) {
   findings.push(...diagnoseTestCi(repo.repoRoot));
   const healthy = findings.every((f) => f.severity === "ok" || f.severity === "info");
   if (jsonOutput) {
-    printJson({ healthy, findings });
+    printJson({ healthy, findings, doctrineInfo });
   } else {
     printReport(findings, healthy, doctrineInfo);
   }
@@ -11929,16 +11960,17 @@ async function buildReport(opts = {}) {
   const groupA = opts.groupA ?? computeGroupA();
   const gateRunner = opts.gateRunner ?? runRealGates;
   const gateResult = await gateRunner();
+  const outcomes = gateResult.outcomes.filter((o) => o.name !== "evidence-fresh");
   const groupC = opts.groupC ?? computeGroupC(opts.body ?? process.env.PR_BODY ?? "");
-  const blockInner = buildBlockInner(groupA, gateResult.outcomes, groupC);
+  const blockInner = buildBlockInner(groupA, outcomes, groupC);
   const block = `${EVIDENCE_START}
 ${blockInner}
 ${EVIDENCE_END}`;
   return {
     block,
     blockInner,
-    gatesFailed: gateResult.failed || groupCFailed(groupC),
-    gateOutcomes: gateResult.outcomes,
+    gatesFailed: anyGateFailed(outcomes) || groupCFailed(groupC),
+    gateOutcomes: outcomes,
     groupC
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@attalabs/vinaya",
-  "version": "0.24.0",
+  "version": "0.24.1",
   "description": "Vinaya — Agentic Engineering Harness. Deterministic checks every AI coding agent must satisfy before merge.",
   "type": "module",
   "license": "Apache-2.0",
@@ -41,7 +41,7 @@
     "bundle-doctrine": "bun scripts/bundle-doctrine.ts",
     "bundle-studio": "bun scripts/bundle-studio.ts",
     "prepack": "bun scripts/build.ts && bun scripts/bundle-doctrine.ts && bun scripts/bundle-studio.ts",
-    "test": "bun test",
+    "test": "bun test --timeout=30000",
     "typecheck": "tsc --noEmit",
     "lint": "biome check src tests scripts",
     "verify-published-lifecycle": "bun scripts/verify-published-lifecycle.ts"