@attalabs/vinaya 0.24.1 → 0.26.0

package/dist/checks/bin/check-registry-gates.js

@@ -29,6 +29,15 @@ var GATE_AUDIENCE = {
     internal: "A composite that shells this repo's own `typecheck`/`lint`/`test`/`build` scripts by name. Those names are this monorepo's toolchain (bun + turbo + biome), not an adopter's; the shipped equivalent of its intent is `vinaya check --all`, which is portable by construction."
   }
 };
+var NON_GATE_BINS = [
+  "archive-task",
+  "assign-task-issue",
+  "dead-branch-audit",
+  "eval-agent-compliance",
+  "open-issue",
+  "open-pr",
+  "report-tokens"
+];
 function isShipped(a) {
   return "shippedAs" in a;
 }
@@ -389,7 +398,7 @@ var LABELS = [
     id: "vinaya/needs:brief-correction",
     category: "needs",
     form: "literal",
-    carries: "Waiting on the Brief Author — the brief contradicts the surface it describes."
+    carries: "Waiting on the Planner — the brief contradicts the surface it describes."
   },
   {
     key: "waiver-docs",
@@ -1940,13 +1949,18 @@ function parseInlineFieldList(section) {
 }
 // ../../packages/aeg-core/src/verdict-extraction.ts
 var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
-function firstThreeLines(comment) {
+var OBJECTIVES_VERSION_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Objectives version:\s*([0-9a-f]{64})(?![A-Za-z0-9])/im;
+function firstFiveLines(comment) {
   return comment.split(`
-`).slice(0, 3).join(`
+`).slice(0, 5).join(`
 `);
 }
 function extractHeadSha(comment) {
-  const m = firstThreeLines(comment).match(HEAD_SHA_PATTERN);
+  const m = firstFiveLines(comment).match(HEAD_SHA_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
+function extractObjectivesVersion(comment) {
+  const m = firstFiveLines(comment).match(OBJECTIVES_VERSION_PATTERN);
   return m ? m[1].toLowerCase() : null;
 }
 function extractVerdict(comments, valuePattern, missingLabel) {
@@ -1955,21 +1969,24 @@ function extractVerdict(comments, valuePattern, missingLabel) {
     return {
       value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
       headSha: null,
+      objectivesVersion: null,
       danglingNote: `no ${missingLabel} verdict comment found on this PR`
     };
   }
   const latest = candidates[candidates.length - 1];
-  const m = firstThreeLines(latest).match(valuePattern);
+  const m = firstFiveLines(latest).match(valuePattern);
   if (!m) {
     return {
-      value: `the most recent ${missingLabel} comment's VERDICT line is not within its first three lines — DANGLING, see below`,
+      value: `the most recent ${missingLabel} comment's VERDICT line is not within its first five lines — DANGLING, see below`,
       headSha: null,
-      danglingNote: `the most recent ${missingLabel} verdict comment carries a VERDICT-shaped line outside the first-three-line read window`
+      objectivesVersion: null,
+      danglingNote: `the most recent ${missingLabel} verdict comment carries a VERDICT-shaped line outside the first-five-line read window`
     };
   }
   return {
     value: m[1].toUpperCase().replace(/[_-]/g, " "),
     headSha: extractHeadSha(latest),
+    objectivesVersion: extractObjectivesVersion(latest),
     danglingNote: null
   };
 }
@@ -2326,8 +2343,105 @@ function overrideActive(opts) {
     return true;
   return false;
 }
-// ../../packages/aeg-core/src/premise-check.ts
+// ../../packages/aeg-core/src/objectives.ts
 import { createHash as createHash2 } from "node:crypto";
+var HEADING_RE = /^##[ \t]*Objectives[ \t]*$/im;
+var NEXT_HEADING_RE = /^##[ \t]/m;
+var OBJECTIVE_LINE_RE = /^O(\d+)\.[ \t]*(.*)$/;
+function hasBacktickedPath(text) {
+  let i = 0;
+  while (i < text.length) {
+    const start = text.indexOf("`", i);
+    if (start === -1)
+      return false;
+    const end = text.indexOf("`", start + 1);
+    if (end === -1)
+      return false;
+    if (text.slice(start + 1, end).includes("/"))
+      return true;
+    i = end + 1;
+  }
+  return false;
+}
+var MIN_WORDS_OUTSIDE_BACKTICKS = 3;
+function stripObjectiveBackticks(text) {
+  return text.replace(/`[^`\n]*`/g, " ");
+}
+function wordCount(text) {
+  return text.split(/\s+/).filter((w) => /[a-z]/i.test(w)).length;
+}
+function objectivesSectionText(body) {
+  const heading = HEADING_RE.exec(body);
+  if (!heading)
+    return null;
+  const afterHeading = body.slice(heading.index + heading[0].length);
+  const next = NEXT_HEADING_RE.exec(afterHeading);
+  return next ? afterHeading.slice(0, next.index) : afterHeading;
+}
+function hasObjectivesHeading(body) {
+  return HEADING_RE.test(body);
+}
+function objectivesOf(body) {
+  const section = objectivesSectionText(body);
+  if (section === null) {
+    return { ok: false, errors: ["no `## Objectives` heading found in the body."] };
+  }
+  const lines = section.split(/\r?\n/).map((l) => l.trim()).filter((l) => l.length > 0);
+  if (lines.length === 0) {
+    return { ok: false, errors: ["the `## Objectives` section has no `O<n>.` lines."] };
+  }
+  const objectives = [];
+  const errors = [];
+  for (const line of lines) {
+    const m = OBJECTIVE_LINE_RE.exec(line);
+    if (!m) {
+      errors.push(`"${line}" is not a well-formed objective line — expected \`O<n>. <sentence>\`, e.g. \`O1. …\`.`);
+      continue;
+    }
+    const n = m[1];
+    const text = m[2].trim();
+    if (text.length === 0) {
+      errors.push(`O${n} has no sentence — every objective is one observable sentence.`);
+      continue;
+    }
+    if (hasBacktickedPath(text) && wordCount(stripObjectiveBackticks(text)) < MIN_WORDS_OUTSIDE_BACKTICKS) {
+      errors.push(`O${n} is little more than a file path — an objective states an observable outcome, never a bare path (the Planner maps it to files).`);
+      continue;
+    }
+    objectives.push({ id: `O${n}`, text });
+  }
+  for (let i = 0;i < objectives.length; i++) {
+    const expected = i + 1;
+    const actual = Number.parseInt(objectives[i].id.slice(1), 10);
+    if (actual !== expected) {
+      errors.push(`numbering is not contiguous from O1 — expected O${expected}, found ${objectives[i].id}.`);
+      break;
+    }
+  }
+  if (errors.length > 0)
+    return { ok: false, errors };
+  return { ok: true, objectives };
+}
+function normalizeText(text) {
+  return text.trim().replace(/\s+/g, " ");
+}
+function objectivesVersion(objectives) {
+  const normalized = objectives.map((o) => `${o.id} ${normalizeText(o.text)}`).join(`
+`);
+  return createHash2("sha256").update(normalized).digest("hex");
+}
+function isIssueNotFoundError(err) {
+  const stderr = err?.stderr;
+  const haystack = [
+    err?.message ?? "",
+    typeof stderr === "string" ? stderr : stderr?.toString() ?? ""
+  ].join(`
+`);
+  return /could not resolve to an (?:issue|pull request)|\b404\b|not found/i.test(haystack);
+}
+
+// ../../packages/aeg-core/src/premise-check.ts
+import { createHash as createHash3 } from "node:crypto";
 var ASSERTION_KINDS = new Set(["contains", "absent", "sha256"]);
 function isPremiseHeader(line) {
   const stripped = line.replace(/[*#]/g, "").trim();
@@ -2398,7 +2512,7 @@ function checkPremises(assertions, fileReader) {
     } else if (a.kind === "absent" && content.includes(a.value)) {
       failures.push(`premise-check: ${a.path} now contains "${a.value}", but the brief pinned it absent — the premise has moved; re-dig before proceeding.`);
     } else if (a.kind === "sha256") {
-      const actual = createHash2("sha256").update(content).digest("hex");
+      const actual = createHash3("sha256").update(content).digest("hex");
       if (actual !== a.value.toLowerCase()) {
         failures.push(`premise-check: ${a.path} sha256 mismatch (brief pinned ${a.value}, file is now ${actual}) — the file changed since this brief was authored; re-dig before proceeding.`);
       }
@@ -2503,18 +2617,14 @@ function checkTestPlanExclusivity(prBody) {
 function checkPrincipalPlaceholder(prBody) {
   const region = testPlanRegion(prBody);
   const lineRe = /^-\s*\[[ xX]\]\s*\*{2}\[principal\]\*{2}(.*)$/gim;
+  const errors = [];
   for (const m of region.matchAll(lineRe)) {
     const content = m[1] ?? "";
     if (/^\s*None\b/i.test(content)) {
-      return {
-        status: "fail",
-        errors: [
-          'brief-validation Test Plan shape: a `**[principal]**` checkbox item is a "None" placeholder — if there is no principal-runnable surface, omit the item entirely; an untickable placeholder box blocks the merge gate forever.'
-        ]
-      };
+      errors.push(`brief-validation Test Plan shape: a \`**[principal]**\` checkbox item is a "None" placeholder ("${content.trim()}") — if there is no principal-runnable surface, omit the item entirely; an untickable placeholder box blocks the merge gate forever.`);
     }
   }
-  return { status: "pass", errors: [] };
+  return errors.length > 0 ? { status: "fail", errors } : { status: "pass", errors: [] };
 }
 function checkSurfaceMap(prBody) {
   return headingCheck(prBody, "(?:technical\\s+)?surface map", "Technical surface map");
@@ -2759,8 +2869,55 @@ function checkDefeatCases(prBody) {
     ]
   };
 }
+var PART_CITATION_RE = /Part\s+\d+\s*\(([^)]*)\)/gi;
+var OBJECTIVE_REF_RE = /O(\d+)/g;
+function citedObjectiveIds(section6) {
+  const ids = new Set;
+  for (const m of section6.matchAll(PART_CITATION_RE)) {
+    for (const r of m[1].matchAll(OBJECTIVE_REF_RE))
+      ids.add(Number.parseInt(r[1], 10));
+  }
+  return ids;
+}
+function checkObjectivesCopy(prBody, issueObjectives) {
+  const parsed = objectivesOf(prBody);
+  if (!parsed.ok) {
+    return { status: "fail", errors: parsed.errors.map((e) => `brief-validation objectives copy: ${e}`) };
+  }
+  if (objectivesVersion(parsed.objectives) !== objectivesVersion(issueObjectives)) {
+    return {
+      status: "fail",
+      errors: [
+        "brief-validation objectives copy: the brief's `## Objectives` section does not match the Issue's — copy the Issue's `## Objectives` section (aeg-root/roles/developer.md)."
+      ]
+    };
+  }
+  return { status: "pass", errors: [] };
+}
+function checkObjectivesCoverage(prBody) {
+  const parsed = objectivesOf(prBody);
+  if (!parsed.ok) {
+    return { status: "fail", errors: parsed.errors.map((e) => `brief-validation objectives coverage: ${e}`) };
+  }
+  const declaredIds = new Set(parsed.objectives.map((o) => Number.parseInt(o.id.slice(1), 10)));
+  const section6 = extractNumberedSection(prBody, 6) ?? "";
+  const cited = citedObjectiveIds(section6);
+  const maxDeclared = Math.max(...declaredIds, 0);
+  const errors = [];
+  for (const id of declaredIds) {
+    if (!cited.has(id)) {
+      errors.push(`brief-validation objectives coverage: O${id} is not cited by any Part in §6 — every objective must be cited by at least one Part.`);
+    }
+  }
+  for (const id of cited) {
+    if (!declaredIds.has(id)) {
+      errors.push(`brief-validation objectives coverage: a Part in §6 cites O${id}, but the Objectives section ends at O${maxDeclared}.`);
+    }
+  }
+  return errors.length === 0 ? { status: "pass", errors: [] } : { status: "fail", errors };
+}
 function checkBriefSections(prBody, readTier, options = {}) {
-  const { requireClosesN = true, consumersOf = () => [] } = options;
+  const { requireClosesN = true, consumersOf = () => [], issueObjectives } = options;
   const results = [
     checkTierField(prBody, readTier),
     checkTestPlan(prBody),
@@ -2778,10 +2935,23 @@ function checkBriefSections(prBody, readTier, options = {}) {
     checkCommandsCarryOutput(prBody),
     checkConsumerTests(prBody, consumersOf),
     checkDefeatCases(prBody),
+    ...issueObjectives !== undefined ? [checkObjectivesCopy(prBody, issueObjectives), checkObjectivesCoverage(prBody)] : [],
     ...requireClosesN ? [checkClosesN(prBody)] : []
   ];
   return { errors: results.flatMap((r) => r.errors) };
 }
+var AEG_BRIEF_V1_MARKER = "<!-- aeg:brief:v1 -->";
+function contentAfterTwoLines(body) {
+  const first = body.indexOf(`
+`);
+  if (first === -1)
+    return "";
+  const second = body.indexOf(`
+`, first + 1);
+  if (second === -1)
+    return "";
+  return body.slice(second + 1);
+}
 // ../../packages/aeg-core/src/doctrine-portability.ts
 var DEFAULT_SHIPS_PREFIX = "aeg-root/";
 var STATIC_PORTABLE_PREFIXES = [
@@ -2976,14 +3146,14 @@ function checkSectionDensity(prBody, heading) {
     ]
   };
 }
-function checkSummaryDensity(prBody) {
-  return checkSectionDensity(prBody, "Summary");
+function checkDecisionsDensity(prBody) {
+  return checkSectionDensity(prBody, "Decisions");
 }
 function checkScopeDensity(prBody) {
   return checkSectionDensity(prBody, "Scope");
 }
 function checkPrReportDensity(prBody) {
-  const results = [checkSummaryDensity(prBody), checkScopeDensity(prBody)];
+  const results = [checkDecisionsDensity(prBody), checkScopeDensity(prBody)];
   return { errors: results.flatMap((r) => r.errors) };
 }
 // ../../packages/aeg-core/src/issue-validation.ts
@@ -3015,6 +3185,75 @@ function checkIssueRationale(body) {
   }
   return { status: errors.length > 0 ? "fail" : "pass", errors };
 }
+var OBJECTIVES_SINCE_ISSUE = 404;
+function checkIssueObjectives(body, issueNumber) {
+  if (issueNumber !== null && issueNumber < OBJECTIVES_SINCE_ISSUE)
+    return { status: "pass", errors: [] };
+  const result = objectivesOf(body);
+  if (result.ok)
+    return { status: "pass", errors: [] };
+  return { status: "fail", errors: result.errors.map((e) => `issue-validation objectives: ${e}`) };
+}
+function topLevelSectionText(body, headingName) {
+  const headingRe = new RegExp(`^##[ \\t]*${headingName}[ \\t]*$`, "im");
+  const heading = headingRe.exec(body);
+  if (!heading)
+    return null;
+  const afterHeading = body.slice(heading.index + heading[0].length);
+  const next = /^##[ \t]/m.exec(afterHeading);
+  return next ? afterHeading.slice(0, next.index) : afterHeading;
+}
+function looksLikeFilePath(entry2) {
+  const stripped = entry2.replace(/\/\*\*?$/, "");
+  const lastSegment = stripped.split("/").pop() ?? stripped;
+  const extMatch = /\.[A-Za-z0-9]{1,6}$/.exec(lastSegment);
+  return extMatch !== null && extMatch.index > 0;
+}
+function splitGlobList(raw) {
+  return raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+}
+function parseIssueSurface(body) {
+  const section = topLevelSectionText(body, "Surface");
+  if (section === null)
+    return { ok: false, errors: ["no `## Surface` heading found in the body."] };
+  const inLine = /^in:\s*(.+)$/im.exec(section);
+  const outLine = /^out:\s*(.+)$/im.exec(section);
+  const errors = [];
+  if (!inLine)
+    errors.push("`## Surface` has no `in:` line.");
+  if (!outLine)
+    errors.push("`## Surface` has no `out:` line.");
+  if (errors.length > 0)
+    return { ok: false, errors };
+  const inGlobs = splitGlobList(inLine[1]);
+  const outGlobs = splitGlobList(outLine[1]);
+  for (const g of [...inGlobs, ...outGlobs]) {
+    if (looksLikeFilePath(g)) {
+      errors.push(`\`${g}\` in \`## Surface\` looks like a file path — Surface entries are directory-level globs, never file paths.`);
+    }
+  }
+  if (inGlobs.length === 0)
+    errors.push("`## Surface`'s `in:` line resolved to zero globs.");
+  if (errors.length > 0)
+    return { ok: false, errors };
+  return { ok: true, value: { in: inGlobs, out: outGlobs } };
+}
+function globCoversPath(glob, path) {
+  const g = glob.replace(/\/\*\*?$/, "").replace(/\/+$/, "");
+  const p = path.replace(/\/+$/, "");
+  return g === p || g.startsWith(`${p}/`) || p.startsWith(`${g}/`);
+}
+function checkSurfaceScope(changedFiles, outGlobs) {
+  if (outGlobs.length === 0)
+    return { ok: true };
+  const violations = [];
+  for (const file of changedFiles) {
+    const glob = outGlobs.find((g) => globCoversPath(g, file));
+    if (glob)
+      violations.push({ file, glob });
+  }
+  return violations.length > 0 ? { ok: false, violations } : { ok: true };
+}
 function isTaskIssueLabelSet(labels) {
   return hasLabel("tranche", labels);
 }
@@ -3079,6 +3318,8 @@ function checkProjectsRegistered(body, _labels, registeredNames) {
   }
   return errors.length > 0 ? { status: "fail", errors } : { status: "pass", errors: [] };
 }
+var DOC_PATH_RE = /(?:(?:aeg-root|apps|packages|specs|docs|tools|\.claude|\.github)\/[\w./@-]*\.(?:md|mdx)|\.claude\/(?:skills|rules)\/[\w./-]+|\b(?:docs-index|decisions|projects|state-machine|enforcement|process|README|CLAUDE)\.md\b|\b[\w-]+-(?:spec|decisions|backlog)\.md\b)/i;
+var DOC_PATH_RE_GLOBAL = new RegExp(DOC_PATH_RE.source, "gi");
 
 // ../../packages/aeg-core/src/coherence-checks.ts
 var COHERENCE_ENFORCED_FROM = "2026-07-01";
@@ -3276,7 +3517,8 @@ function checkR1(issuesBySlug, grandfatheredIssues, registeredNames = []) {
         continue;
       const errors = [
         ...checkIssueRationale(issue.body).errors,
-        ...checkProjectsRegistered(issue.body, issue.labels, registeredNames).errors
+        ...checkProjectsRegistered(issue.body, issue.labels, registeredNames).errors,
+        ...checkIssueObjectives(issue.body, issue.number).errors
       ];
       if (errors.length === 0)
         continue;
@@ -3391,6 +3633,27 @@ function checkClosesN2(branch, prBody, trancheFiles, taskIssueRefs) {
   }
   return { ok: true, expectedIssue };
 }
+// ../../packages/aeg-core/src/archive-task.ts
+function closesRefs(text) {
+  return [...new Set([...text.matchAll(/Closes #(\d+)/gi)].map((m) => Number(m[1])))];
+}
+function extractIssue(body) {
+  const stripped = stripCode(body);
+  const bodyNums = closesRefs(stripped);
+  const anchored = anchoredRegion(stripped, "CLOSES");
+  if (anchored !== null) {
+    const anchorNums = closesRefs(anchored);
+    if (anchorNums.length === 0)
+      return { issue: null, extraIssues: bodyNums, outsideHeader: false };
+    const issue2 = anchorNums[0];
+    return { issue: issue2, extraIssues: bodyNums.filter((n) => n !== issue2), outsideHeader: false };
+  }
+  const headerNums = closesRefs(headerRegion(stripped));
+  if (bodyNums.length === 0)
+    return { issue: null, extraIssues: [], outsideHeader: false };
+  const issue = headerNums.length > 0 ? headerNums[0] : bodyNums[0];
+  return { issue, extraIssues: bodyNums.filter((n) => n !== issue), outsideHeader: headerNums.length === 0 };
+}
 // ../../packages/aeg-core/src/review-gate.ts
 function isBoundToHead(extraction, headSha) {
   if (!extraction.headSha)
@@ -3409,6 +3672,11 @@ function isBoundByPatchIdentity(extraction, headSha, patchIdOf) {
 function isBoundToPatch(extraction, headSha, patchIdOf) {
   return isBoundToHead(extraction, headSha) || isBoundByPatchIdentity(extraction, headSha, patchIdOf);
 }
+function isBoundToObjectives(extraction, currentVersion) {
+  if (currentVersion === null)
+    return true;
+  return extraction.objectivesVersion === currentVersion;
+}
 function checkReviewGate(input) {
   const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const waived = isWaiverLabelActorVerified({
@@ -3435,7 +3703,9 @@ function checkReviewGate(input) {
   const securityClean = security.value === "PASS";
   const codeReviewBound = isBoundToPatch(codeReview, input.headSha, input.patchIdOf);
   const securityBound = isBoundToPatch(security, input.headSha, input.patchIdOf);
-  if (codeReviewClean && codeReviewBound && securityClean && securityBound && mechanicalChecksClean) {
+  const codeReviewObjectivesBound = isBoundToObjectives(codeReview, input.objectivesVersion);
+  const securityObjectivesBound = isBoundToObjectives(security, input.objectivesVersion);
+  if (codeReviewClean && codeReviewBound && codeReviewObjectivesBound && securityClean && securityBound && securityObjectivesBound && mechanicalChecksClean) {
     return {
       verdict: "pass",
       reason: `code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS, both covering head ${input.headSha}, and every reported mechanical check is green.`,
@@ -3447,11 +3717,15 @@ function checkReviewGate(input) {
     problems.push(`code-reviewer verdict is not a clean APPROVE (found: ${codeReview.value})`);
   } else if (!codeReviewBound) {
     problems.push(`the newest code-review verdict covers ${codeReview.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  } else if (!codeReviewObjectivesBound) {
+    problems.push(`the newest code-review verdict was cast against objectives version ${codeReview.objectivesVersion ?? "none"}, the Issue's list is now ${input.objectivesVersion}`);
   }
   if (!securityClean) {
     problems.push(`security-review verdict is not a clean PASS (found: ${security.value})`);
   } else if (!securityBound) {
     problems.push(`the newest security-review verdict covers ${security.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  } else if (!securityObjectivesBound) {
+    problems.push(`the newest security-review verdict was cast against objectives version ${security.objectivesVersion ?? "none"}, the Issue's list is now ${input.objectivesVersion}`);
   }
   if (!mechanicalChecksClean) {
     problems.push(reportedMechanicalChecks.length === 0 ? "no mechanical checks have reported for this head yet" : `mechanical check(s) not green: ${reportedMechanicalChecks.filter((c) => c.bucket !== "pass").map((c) => `${c.name} (${c.bucket})`).join(", ")}`);
@@ -3575,16 +3849,33 @@ function checkG1(rows, existsFn) {
   return { check: "G1", status: findings.length > 0 ? "fail" : "pass", findings };
 }
 var SCAFFOLD_PLACEHOLDER = "[undocumented — fill in why]";
+var NON_GATE_BIN_NAMES = NON_GATE_BINS;
+var TWIN_CANDIDATE_EXCEPTIONS = {
+  "apps/cli/src/checks/bin/check-dead-branch-push.ts": 'Ring 0 "Pushing to a branch whose pull request already resolved" (implementation: check-push-target.ts)',
+  "apps/cli/src/checks/bin/check-issue-assignment.ts": `Ring 0 "A task branch's first push (Issue self-assignment)" (implementation: assign-task-issue.ts)`,
+  "apps/cli/src/checks/bin/check-closes-n.ts": 'Ring 1 "Closes linkage" (implementation: verify-coherence.ts)'
+};
+var NON_GATE_HOOK_SCRIPTS = [".claude/hooks/track-transcript.sh"];
 function checkG2(rows, candidateFiles) {
   const implementations = new Set(rows.map((r) => r.implementation).filter((p) => p !== ""));
+  const claimedNames = new Set(rows.flatMap((r) => claimedCheckNames(r.implementation)));
   const findings = [];
   for (const path of candidateFiles) {
-    if (!implementations.has(path)) {
-      findings.push({
-        path,
-        reason: `"${path}" is not named as the implementation of any row in enforcement.md's ring tables`
-      });
-    }
+    if (implementations.has(path))
+      continue;
+    if (path.startsWith(AEG_CORE_BIN_PATH_PREFIX) && NON_GATE_BIN_NAMES.includes(basenameNoExt(path)))
+      continue;
+    if (NON_GATE_HOOK_SCRIPTS.includes(path))
+      continue;
+    if (path in TWIN_CANDIDATE_EXCEPTIONS)
+      continue;
+    const candidateNames = claimedCheckNames(path);
+    if (candidateNames.length > 0 && candidateNames.some((n) => claimedNames.has(n)))
+      continue;
+    findings.push({
+      path,
+      reason: `"${path}" is not named as the implementation of any row in enforcement.md's ring tables`
+    });
   }
   for (const row of rows) {
     const carriesPlaceholder = [row.summary, row.description, row.spec].some((cell) => cell === SCAFFOLD_PLACEHOLDER);
@@ -3596,7 +3887,7 @@ function checkG2(rows, candidateFiles) {
       });
     }
   }
-  return { check: "G2", status: findings.length > 0 ? "info" : "pass", findings };
+  return { check: "G2", status: findings.length > 0 ? "fail" : "pass", findings };
 }
 function checkG3(ring0Rows, crossingFiles) {
   const ring0Implementations = new Set(ring0Rows.map((r) => r.implementation));
@@ -3687,55 +3978,20 @@ function checkG6(rows, registeredCheckNames) {
   }
   return { check: "G6", status: findings.length > 0 ? "fail" : "pass", findings };
 }
-// ../../packages/aeg-core/src/dead-branch-push-guard.ts
-function checkDeadBranchPush(input) {
-  const { branch, prState, prNumber } = input;
-  if (prState === "MERGED") {
-    return {
-      verdict: "refuse",
-      reason: `Branch \`${branch}\` already has a MERGED PR (#${prNumber}) — this branch's work is done. Push a new task branch instead of pushing onto an already-resolved one.`
-    };
-  }
-  if (prState === "CLOSED") {
-    return {
-      verdict: "refuse",
-      reason: `Branch \`${branch}\` has a CLOSED PR (#${prNumber}) that was never merged — pushing here would resurrect abandoned/rejected work. Open a new task branch instead.`
-    };
-  }
-  if (prState === "OPEN") {
-    return {
-      verdict: "allow",
-      reason: `Branch \`${branch}\` has an OPEN PR (#${prNumber}) — pushing more commits to it is normal.`
-    };
-  }
-  if (prState === "NONE") {
-    return {
-      verdict: "allow",
-      reason: `Branch \`${branch}\` has no PR yet — a brand-new task branch legitimately has none.`
-    };
-  }
-  return {
-    verdict: "allow",
-    reason: `Could not determine \`${branch}\`'s PR state (forge unreachable) — failing open rather than blocking the push on a transient issue.`
-  };
-}
-// ../../packages/aeg-core/src/baseline-capture.ts
-function captureBaseline(counts, capturedAt) {
-  return counts.map((c) => ({ tool: c.tool, findingCount: c.findingCount, capturedAt }));
+// ../../packages/aeg-core/src/reader-resolvable-prose.ts
+var PRODUCT_SLUG_SCOPE = [
+  "apps/cli/src",
+  ".github/workflows",
+  ".vinaya",
+  "apps/cli/README.md",
+  "packages/sources/README.md"
+];
+function isUnderOrEqual(path, prefix) {
+  return path === prefix || path.startsWith(`${prefix}/`);
 }
-function compareToBaseline(current, baseline) {
-  const perTool = current.map((c) => {
-    const baselineEntry = baseline.find((b) => b.tool === c.tool);
-    const baselineCount = baselineEntry ? baselineEntry.findingCount : c.findingCount;
-    return { tool: c.tool, baseline: baselineCount, current: c.findingCount, delta: c.findingCount - baselineCount };
-  });
-  return {
-    withinBudget: perTool.every((t) => t.delta <= 0),
-    delta: perTool.reduce((sum, t) => sum + t.delta, 0),
-    perTool
-  };
+function isProductScopeFile(path) {
+  return PRODUCT_SLUG_SCOPE.some((prefix) => isUnderOrEqual(path, prefix));
 }
-// ../../packages/aeg-core/src/reader-resolvable-prose.ts
 var SHIPS_PREFIX = "aeg-root/";
 function shipsArchivePrefix(shipsPrefix) {
   return `${shipsPrefix}tranches/completed/`;
@@ -3755,6 +4011,8 @@ function classifyProseFile(path, readerFacingPrefix, readerFacingSuffix, shipsPr
   }
   if (isSpecFile2(path) || isClaudeMdFile(path))
     return "internal";
+  if (isProductScopeFile(path))
+    return "product";
   return null;
 }
 var SWEPT_CLASSES = new Set(["ships", "reader-facing"]);
@@ -3767,6 +4025,9 @@ function stripNonProse(path, content) {
   }
   return content;
 }
+function stripNonProseForProduct(path, content) {
+  return path.endsWith(".md") ? stripNonProse(path, content) : content;
+}
 function lineAt(content, index) {
   let line = 1;
   for (let i = 0;i < index; i++) {
@@ -3791,12 +4052,19 @@ function checkUnresolvableReferences(files, readerFacingPrefix, readerFacingSuff
     { pattern: TRANCHE_SLUG_VN_PATTERN, what: "an internal tranche slug" },
     ...legacyPattern ? [{ pattern: legacyPattern, what: "an internal tranche slug", group: 2 }] : []
   ];
+  const productPatterns = [
+    { pattern: TRANCHE_SLUG_VN_PATTERN, what: "an internal tranche slug in product code" }
+  ];
   for (const file of files) {
     const cls = classifyProseFile(file.path, readerFacingPrefix, readerFacingSuffix, shipsPrefix);
-    if (!cls || !SWEPT_CLASSES.has(cls))
+    if (!cls || cls === "internal")
       continue;
-    const scrubbed = stripNonProse(file.path, file.content);
-    for (const { pattern, what, group } of patterns) {
+    if (cls !== "product" && !SWEPT_CLASSES.has(cls))
+      continue;
+    const blocking = cls === "product";
+    const scrubbed = blocking ? stripNonProseForProduct(file.path, file.content) : stripNonProse(file.path, file.content);
+    const patternsToRun = blocking ? productPatterns : patterns;
+    for (const { pattern, what, group } of patternsToRun) {
       pattern.lastIndex = 0;
       let match = pattern.exec(scrubbed);
       while (match !== null) {
@@ -3804,7 +4072,8 @@ function checkUnresolvableReferences(files, readerFacingPrefix, readerFacingSuff
         findings.push({
           file: file.path,
           line: lineAt(scrubbed, match.index),
-          message: `references ${what} ("${cited}") a reader outside this repo's tracker cannot resolve`
+          message: `references ${what} ("${cited}") a reader outside this repo's tracker cannot resolve`,
+          blocking
         });
         match = pattern.exec(scrubbed);
       }
@@ -3854,7 +4123,8 @@ function checkUndefinedVocabulary(files, glossaryTerms, readerFacingPrefix, read
       findings.push({
         file: file.path,
         line,
-        message: `uses coined term "${term}" without defining it inline or linking the glossary`
+        message: `uses coined term "${term}" without defining it inline or linking the glossary`,
+        blocking: false
       });
     }
   }
@@ -3877,6 +4147,7 @@ function parseGlossaryTerms(glossaryContent) {
   }
   return terms;
 }
+
 // ../../packages/aeg-core/src/quoted-command.ts
 var QUOTED_COMMAND_SHIPS_PREFIX = "aeg-root/";
 var QUOTED_COMMAND_SWEPT_CLASSES = new Set(["ships", "reader-facing"]);
@@ -3971,6 +4242,54 @@ function evaluateCitedQuotes(citedQuotes, citedFileContents) {
   }
   return findings;
 }
+// ../../packages/aeg-core/src/dead-branch-push-guard.ts
+function checkDeadBranchPush(input) {
+  const { branch, prState, prNumber } = input;
+  if (prState === "MERGED") {
+    return {
+      verdict: "refuse",
+      reason: `Branch \`${branch}\` already has a MERGED PR (#${prNumber}) — this branch's work is done. Push a new task branch instead of pushing onto an already-resolved one.`
+    };
+  }
+  if (prState === "CLOSED") {
+    return {
+      verdict: "refuse",
+      reason: `Branch \`${branch}\` has a CLOSED PR (#${prNumber}) that was never merged — pushing here would resurrect abandoned/rejected work. Open a new task branch instead.`
+    };
+  }
+  if (prState === "OPEN") {
+    return {
+      verdict: "allow",
+      reason: `Branch \`${branch}\` has an OPEN PR (#${prNumber}) — pushing more commits to it is normal.`
+    };
+  }
+  if (prState === "NONE") {
+    return {
+      verdict: "allow",
+      reason: `Branch \`${branch}\` has no PR yet — a brand-new task branch legitimately has none.`
+    };
+  }
+  return {
+    verdict: "allow",
+    reason: `Could not determine \`${branch}\`'s PR state (forge unreachable) — failing open rather than blocking the push on a transient issue.`
+  };
+}
+// ../../packages/aeg-core/src/baseline-capture.ts
+function captureBaseline(counts, capturedAt) {
+  return counts.map((c) => ({ tool: c.tool, findingCount: c.findingCount, capturedAt }));
+}
+function compareToBaseline(current, baseline) {
+  const perTool = current.map((c) => {
+    const baselineEntry = baseline.find((b) => b.tool === c.tool);
+    const baselineCount = baselineEntry ? baselineEntry.findingCount : c.findingCount;
+    return { tool: c.tool, baseline: baselineCount, current: c.findingCount, delta: c.findingCount - baselineCount };
+  });
+  return {
+    withinBudget: perTool.every((t) => t.delta <= 0),
+    delta: perTool.reduce((sum, t) => sum + t.delta, 0),
+    perTool
+  };
+}
 // ../../packages/aeg-core/src/retired-vocabulary.ts
 var RETIRED_PATTERNS = [
   String.raw`\bD-[0-9]{3}\b`,
@@ -4440,6 +4759,223 @@ function findWorkspaceEscapes(files, knownPaths, workspaceDirs = DEFAULT_WORKSPA
   }
   return findings;
 }
+// ../../packages/aeg-core/src/log/schema.ts
+import { z } from "zod";
+var ROLE_VALUES = [
+  "planner",
+  "developer",
+  "code-reviewer",
+  "security",
+  "principal",
+  "archivist",
+  "architect"
+];
+var RoleSchema = z.enum(ROLE_VALUES);
+var HOST_VALUES = ["hook", "ci", "cli", "loop"];
+var HostSchema = z.enum(HOST_VALUES);
+var RUN_ID_PATTERN = /^[A-Za-z0-9_.-]{1,128}$/;
+var HeaderMetaSchema = z.object({
+  schema: z.literal(1),
+  ts: z.string(),
+  run_id: z.string().regex(RUN_ID_PATTERN),
+  seq: z.number().int().nonnegative(),
+  repo: z.string().nullable(),
+  vinaya: z.string(),
+  doctrine: z.string(),
+  host: HostSchema,
+  machine: z.string()
+}).strict();
+var SubjectSchema = z.object({
+  issue: z.number().int().nullable(),
+  pr: z.number().int().optional(),
+  sha: z.string().optional(),
+  role: z.union([RoleSchema, z.literal("unattributed")]),
+  round: z.number().int().optional(),
+  objectives_version: z.string().optional()
+}).strict();
+var HeaderSchema = z.object({
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema
+}).strict();
+var envelopeTail = {
+  duration_ms: z.number().nonnegative().optional(),
+  payload: z.object({}).strict()
+};
+var DispatchOutcomeSchema = z.discriminatedUnion("type", [
+  z.object({ type: z.literal("pr_opened"), pr: z.number().int(), head: z.string() }).strict(),
+  z.object({
+    type: z.literal("round_pushed"),
+    pr: z.number().int(),
+    head: z.string(),
+    comment_id: z.number().int()
+  }).strict(),
+  z.object({
+    type: z.literal("verdict"),
+    verdict: z.enum(["APPROVE", "REQUEST CHANGES", "PASS", "FAIL"]),
+    head: z.string(),
+    comment_id: z.number().int(),
+    objectives: z.array(z.object({ id: z.string(), met: z.boolean() }).strict()),
+    findings: z.array(z.object({ id: z.string(), severity: z.string(), state: z.string().optional() }).strict())
+  }).strict(),
+  z.object({
+    type: z.literal("escalation"),
+    class: z.enum(["authority", "strategy", "product"]),
+    comment_id: z.number().int()
+  }).strict(),
+  z.object({ type: z.literal("brief"), comment_id: z.number().int(), hash: z.string() }).strict(),
+  z.object({ type: z.literal("plan"), issues: z.array(z.number().int()) }).strict(),
+  z.object({ type: z.literal("archive"), provenance_comment_id: z.number().int() }).strict()
+]);
+var dispatchShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z.literal("dispatch"),
+  ...envelopeTail,
+  target_role: RoleSchema,
+  model: z.string(),
+  round: z.number().int().optional(),
+  effect_id: z.string()
+};
+var dispatchUsageField = z.object({ input: z.number().nonnegative(), output: z.number().nonnegative() }).strict().nullable();
+var DispatchEventSchema = z.discriminatedUnion("event", [
+  z.object({ ...dispatchShared, event: z.literal("dispatched"), prompt_hash: z.string() }).strict(),
+  z.object({
+    ...dispatchShared,
+    event: z.literal("outcome_received"),
+    outcome: DispatchOutcomeSchema,
+    usage: dispatchUsageField
+  }).strict(),
+  z.object({
+    ...dispatchShared,
+    event: z.literal("dispatch_failed"),
+    reason: z.enum(["timeout", "crash", "refused", "unattributed_write"]),
+    usage: dispatchUsageField
+  }).strict()
+]);
+var loopShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z.literal("dev_review_loop"),
+  ...envelopeTail,
+  loop_id: z.string()
+};
+var DevReviewLoopEventSchema = z.discriminatedUnion("event", [
+  z.object({
+    ...loopShared,
+    event: z.literal("loop_started"),
+    task: z.number().int(),
+    policy: z.object({
+      max_rounds: z.number().int().nonnegative(),
+      reviewers: z.array(RoleSchema),
+      models: z.record(RoleSchema, z.string())
+    }).strict()
+  }).strict(),
+  z.object({ ...loopShared, event: z.literal("round_started"), round: z.number().int(), base_head: z.string() }).strict(),
+  z.object({
+    ...loopShared,
+    event: z.literal("gate_result_read"),
+    round: z.number().int(),
+    head: z.string(),
+    green: z.boolean()
+  }).strict(),
+  z.object({
+    ...loopShared,
+    event: z.literal("verdicts_read"),
+    round: z.number().int(),
+    head: z.string(),
+    all_approve: z.boolean(),
+    blockers: z.number().int().nonnegative()
+  }).strict(),
+  z.object({
+    ...loopShared,
+    event: z.literal("findings_compared"),
+    round: z.number().int(),
+    open: z.array(z.string()),
+    resolved: z.array(z.string()),
+    new: z.array(z.string()),
+    recurring: z.array(z.string())
+  }).strict(),
+  z.object({
+    ...loopShared,
+    event: z.literal("stop_condition_met"),
+    round: z.number().int(),
+    condition: z.enum([
+      "green",
+      "max_rounds",
+      "no_progress",
+      "escalated",
+      "principal_stop",
+      "confidence",
+      "reappearance"
+    ])
+  }).strict(),
+  z.object({
+    ...loopShared,
+    event: z.literal("paused"),
+    round: z.number().int(),
+    reason: z.enum(["escalation", "principal_item", "refreeze_needed"])
+  }).strict(),
+  z.object({
+    ...loopShared,
+    event: z.literal("resumed"),
+    round: z.number().int(),
+    by: z.literal("principal")
+  }).strict(),
+  z.object({
+    ...loopShared,
+    event: z.literal("round_ended"),
+    round: z.number().int(),
+    base_head: z.string(),
+    head: z.string(),
+    files_changed: z.number().int().nonnegative(),
+    insertions: z.number().int().nonnegative(),
+    deletions: z.number().int().nonnegative(),
+    wall_ms: z.number().nonnegative(),
+    outcome: z.enum(["green", "changes_requested", "escalated"])
+  }).strict(),
+  z.object({
+    ...loopShared,
+    event: z.literal("journal_finalized"),
+    rounds: z.number().int().nonnegative(),
+    total_wall_ms: z.number().nonnegative(),
+    time_to_green_ms: z.number().nonnegative().nullable(),
+    files_changed_total: z.number().int().nonnegative(),
+    final_head: z.string(),
+    result: z.enum(["merged_ready", "stopped"])
+  }).strict()
+]);
+var ForgeOpSchema = z.enum([
+  "pr.create",
+  "pr.comment",
+  "pr.body.replace",
+  "pr.refreeze",
+  "issue.create",
+  "issue.edit",
+  "issue.comment",
+  "milestone.create",
+  "milestone.edit",
+  "milestone.close",
+  "label.add",
+  "label.remove"
+]);
+var ForgeWriteTargetSchema = z.object({
+  issue: z.number().int().optional(),
+  pr: z.number().int().optional()
+}).strict();
+var forgeWriteShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z.literal("forge_write"),
+  ...envelopeTail,
+  op: ForgeOpSchema,
+  target: ForgeWriteTargetSchema
+};
+var ForgeWriteEventSchema = z.discriminatedUnion("event", [
+  z.object({ ...forgeWriteShared, event: z.literal("validated") }).strict(),
+  z.object({ ...forgeWriteShared, event: z.literal("refused"), reason: z.string() }).strict(),
+  z.object({ ...forgeWriteShared, event: z.literal("written"), comment_ids: z.array(z.string()) }).strict()
+]);
+var LogEventSchema = z.union([DispatchEventSchema, DevReviewLoopEventSchema, ForgeWriteEventSchema]);
 // src/checks/contract.ts
 var CHECK_SCHEMA_VERSION = 1;
 function emitCheckError(error) {
@@ -4486,7 +5022,9 @@ var REGISTRY = [
       env: {
         PR_BODY: { optional: true },
         BRANCH: { optional: true },
-        PR_NUMBER: { optional: true }
+        PR_NUMBER: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
       }
     },
     0
@@ -4536,6 +5074,18 @@ var REGISTRY = [
     },
     0
   ],
+  [
+    {
+      name: "pr-premise-reassert",
+      run: bin("check-pr-premise-reassert"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {
+        PR_BODY: { optional: true }
+      }
+    },
+    0
+  ],
   [
     {
       name: "dispatch-readiness",
@@ -4584,6 +5134,22 @@ var REGISTRY = [
     },
     0
   ],
+  [
+    {
+      name: "surface-scope",
+      run: bin("check-surface-scope"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {
+        AEG_REPO: { optional: true },
+        BASE_SHA: { optional: true },
+        BRANCH: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    0
+  ],
   [
     {
       name: "test-plan",
@@ -4625,6 +5191,7 @@ var REGISTRY = [
       requiresOpenPr: true,
       env: {
         PR_BODY: { optional: true },
+        BRANCH: { optional: true },
         CLAUDE_PROJECT_DIR: { optional: true },
         CLAUDE_CODE_SESSION_ID: { optional: true }
       }
@@ -4774,7 +5341,14 @@ var REGISTRY = [
       scope: "full",
       timeoutMs: 30000,
       env: {},
-      include: ["aeg-root/**/*.md"]
+      include: [
+        "aeg-root/**/*.md",
+        "apps/cli/src/**",
+        ".github/workflows/**",
+        ".vinaya/**",
+        "apps/cli/README.md",
+        "packages/sources/README.md"
+      ]
     },
     0
   ],
@@ -5040,13 +5614,13 @@ async function main() {
   const g3 = checkG3(ring0Rows, crossingFiles);
   const g5 = checkG5(roles, contracts);
   const g6 = checkG6(rows, new Set(coreCheckRegistry().map((s) => s.name)));
-  emitResult(g2, false);
   emitResult(g1, true);
+  emitResult(g2, true);
   emitResult(g3, true);
   emitResult(g4Result, true);
   emitResult(g5, true);
   emitResult(g6, true);
-  const blockingFailed = [g1, g3, g4Result, g5, g6].some((r) => r.status === "fail");
+  const blockingFailed = [g1, g2, g3, g4Result, g5, g6].some((r) => r.status === "fail");
   process.exit(blockingFailed ? 1 : 0);
 }
 main();