@attalabs/vinaya 0.25.0 → 0.26.0

package/dist/checks/bin/check-main-branch-refusal.js

@@ -27,6 +27,15 @@ var GATE_AUDIENCE = {
     internal: "A composite that shells this repo's own `typecheck`/`lint`/`test`/`build` scripts by name. Those names are this monorepo's toolchain (bun + turbo + biome), not an adopter's; the shipped equivalent of its intent is `vinaya check --all`, which is portable by construction."
   }
 };
+var NON_GATE_BINS = [
+  "archive-task",
+  "assign-task-issue",
+  "dead-branch-audit",
+  "eval-agent-compliance",
+  "open-issue",
+  "open-pr",
+  "report-tokens"
+];
 function isShipped(a) {
   return "shippedAs" in a;
 }
@@ -387,7 +396,7 @@ var LABELS = [
     id: "vinaya/needs:brief-correction",
     category: "needs",
     form: "literal",
-    carries: "Waiting on the Brief Author — the brief contradicts the surface it describes."
+    carries: "Waiting on the Planner — the brief contradicts the surface it describes."
   },
   {
     key: "waiver-docs",
@@ -2394,7 +2403,7 @@ function objectivesOf(body) {
       continue;
     }
     if (hasBacktickedPath(text) && wordCount(stripObjectiveBackticks(text)) < MIN_WORDS_OUTSIDE_BACKTICKS) {
-      errors.push(`O${n} is little more than a file path — an objective states an observable outcome, never a bare path (the Brief Author maps it to files).`);
+      errors.push(`O${n} is little more than a file path — an objective states an observable outcome, never a bare path (the Planner maps it to files).`);
       continue;
     }
     objectives.push({ id: `O${n}`, text });
@@ -2606,18 +2615,14 @@ function checkTestPlanExclusivity(prBody) {
 function checkPrincipalPlaceholder(prBody) {
   const region = testPlanRegion(prBody);
   const lineRe = /^-\s*\[[ xX]\]\s*\*{2}\[principal\]\*{2}(.*)$/gim;
+  const errors = [];
   for (const m of region.matchAll(lineRe)) {
     const content = m[1] ?? "";
     if (/^\s*None\b/i.test(content)) {
-      return {
-        status: "fail",
-        errors: [
-          'brief-validation Test Plan shape: a `**[principal]**` checkbox item is a "None" placeholder — if there is no principal-runnable surface, omit the item entirely; an untickable placeholder box blocks the merge gate forever.'
-        ]
-      };
+      errors.push(`brief-validation Test Plan shape: a \`**[principal]**\` checkbox item is a "None" placeholder ("${content.trim()}") — if there is no principal-runnable surface, omit the item entirely; an untickable placeholder box blocks the merge gate forever.`);
     }
   }
-  return { status: "pass", errors: [] };
+  return errors.length > 0 ? { status: "fail", errors } : { status: "pass", errors: [] };
 }
 function checkSurfaceMap(prBody) {
   return headingCheck(prBody, "(?:technical\\s+)?surface map", "Technical surface map");
@@ -2933,6 +2938,18 @@ function checkBriefSections(prBody, readTier, options = {}) {
   ];
   return { errors: results.flatMap((r) => r.errors) };
 }
+var AEG_BRIEF_V1_MARKER = "<!-- aeg:brief:v1 -->";
+function contentAfterTwoLines(body) {
+  const first = body.indexOf(`
+`);
+  if (first === -1)
+    return "";
+  const second = body.indexOf(`
+`, first + 1);
+  if (second === -1)
+    return "";
+  return body.slice(second + 1);
+}
 // ../../packages/aeg-core/src/doctrine-portability.ts
 var DEFAULT_SHIPS_PREFIX = "aeg-root/";
 var STATIC_PORTABLE_PREFIXES = [
@@ -3175,6 +3192,66 @@ function checkIssueObjectives(body, issueNumber) {
     return { status: "pass", errors: [] };
   return { status: "fail", errors: result.errors.map((e) => `issue-validation objectives: ${e}`) };
 }
+function topLevelSectionText(body, headingName) {
+  const headingRe = new RegExp(`^##[ \\t]*${headingName}[ \\t]*$`, "im");
+  const heading = headingRe.exec(body);
+  if (!heading)
+    return null;
+  const afterHeading = body.slice(heading.index + heading[0].length);
+  const next = /^##[ \t]/m.exec(afterHeading);
+  return next ? afterHeading.slice(0, next.index) : afterHeading;
+}
+function looksLikeFilePath(entry2) {
+  const stripped = entry2.replace(/\/\*\*?$/, "");
+  const lastSegment = stripped.split("/").pop() ?? stripped;
+  const extMatch = /\.[A-Za-z0-9]{1,6}$/.exec(lastSegment);
+  return extMatch !== null && extMatch.index > 0;
+}
+function splitGlobList(raw) {
+  return raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+}
+function parseIssueSurface(body) {
+  const section = topLevelSectionText(body, "Surface");
+  if (section === null)
+    return { ok: false, errors: ["no `## Surface` heading found in the body."] };
+  const inLine = /^in:\s*(.+)$/im.exec(section);
+  const outLine = /^out:\s*(.+)$/im.exec(section);
+  const errors = [];
+  if (!inLine)
+    errors.push("`## Surface` has no `in:` line.");
+  if (!outLine)
+    errors.push("`## Surface` has no `out:` line.");
+  if (errors.length > 0)
+    return { ok: false, errors };
+  const inGlobs = splitGlobList(inLine[1]);
+  const outGlobs = splitGlobList(outLine[1]);
+  for (const g of [...inGlobs, ...outGlobs]) {
+    if (looksLikeFilePath(g)) {
+      errors.push(`\`${g}\` in \`## Surface\` looks like a file path — Surface entries are directory-level globs, never file paths.`);
+    }
+  }
+  if (inGlobs.length === 0)
+    errors.push("`## Surface`'s `in:` line resolved to zero globs.");
+  if (errors.length > 0)
+    return { ok: false, errors };
+  return { ok: true, value: { in: inGlobs, out: outGlobs } };
+}
+function globCoversPath(glob, path) {
+  const g = glob.replace(/\/\*\*?$/, "").replace(/\/+$/, "");
+  const p = path.replace(/\/+$/, "");
+  return g === p || g.startsWith(`${p}/`) || p.startsWith(`${g}/`);
+}
+function checkSurfaceScope(changedFiles, outGlobs) {
+  if (outGlobs.length === 0)
+    return { ok: true };
+  const violations = [];
+  for (const file of changedFiles) {
+    const glob = outGlobs.find((g) => globCoversPath(g, file));
+    if (glob)
+      violations.push({ file, glob });
+  }
+  return violations.length > 0 ? { ok: false, violations } : { ok: true };
+}
 function isTaskIssueLabelSet(labels) {
   return hasLabel("tranche", labels);
 }
@@ -3239,6 +3316,8 @@ function checkProjectsRegistered(body, _labels, registeredNames) {
   }
   return errors.length > 0 ? { status: "fail", errors } : { status: "pass", errors: [] };
 }
+var DOC_PATH_RE = /(?:(?:aeg-root|apps|packages|specs|docs|tools|\.claude|\.github)\/[\w./@-]*\.(?:md|mdx)|\.claude\/(?:skills|rules)\/[\w./-]+|\b(?:docs-index|decisions|projects|state-machine|enforcement|process|README|CLAUDE)\.md\b|\b[\w-]+-(?:spec|decisions|backlog)\.md\b)/i;
+var DOC_PATH_RE_GLOBAL = new RegExp(DOC_PATH_RE.source, "gi");
 
 // ../../packages/aeg-core/src/coherence-checks.ts
 var COHERENCE_ENFORCED_FROM = "2026-07-01";
@@ -3768,16 +3847,33 @@ function checkG1(rows, existsFn) {
   return { check: "G1", status: findings.length > 0 ? "fail" : "pass", findings };
 }
 var SCAFFOLD_PLACEHOLDER = "[undocumented — fill in why]";
+var NON_GATE_BIN_NAMES = NON_GATE_BINS;
+var TWIN_CANDIDATE_EXCEPTIONS = {
+  "apps/cli/src/checks/bin/check-dead-branch-push.ts": 'Ring 0 "Pushing to a branch whose pull request already resolved" (implementation: check-push-target.ts)',
+  "apps/cli/src/checks/bin/check-issue-assignment.ts": `Ring 0 "A task branch's first push (Issue self-assignment)" (implementation: assign-task-issue.ts)`,
+  "apps/cli/src/checks/bin/check-closes-n.ts": 'Ring 1 "Closes linkage" (implementation: verify-coherence.ts)'
+};
+var NON_GATE_HOOK_SCRIPTS = [".claude/hooks/track-transcript.sh"];
 function checkG2(rows, candidateFiles) {
   const implementations = new Set(rows.map((r) => r.implementation).filter((p) => p !== ""));
+  const claimedNames = new Set(rows.flatMap((r) => claimedCheckNames(r.implementation)));
   const findings = [];
   for (const path of candidateFiles) {
-    if (!implementations.has(path)) {
-      findings.push({
-        path,
-        reason: `"${path}" is not named as the implementation of any row in enforcement.md's ring tables`
-      });
-    }
+    if (implementations.has(path))
+      continue;
+    if (path.startsWith(AEG_CORE_BIN_PATH_PREFIX) && NON_GATE_BIN_NAMES.includes(basenameNoExt(path)))
+      continue;
+    if (NON_GATE_HOOK_SCRIPTS.includes(path))
+      continue;
+    if (path in TWIN_CANDIDATE_EXCEPTIONS)
+      continue;
+    const candidateNames = claimedCheckNames(path);
+    if (candidateNames.length > 0 && candidateNames.some((n) => claimedNames.has(n)))
+      continue;
+    findings.push({
+      path,
+      reason: `"${path}" is not named as the implementation of any row in enforcement.md's ring tables`
+    });
   }
   for (const row of rows) {
     const carriesPlaceholder = [row.summary, row.description, row.spec].some((cell) => cell === SCAFFOLD_PLACEHOLDER);
@@ -3789,7 +3885,7 @@ function checkG2(rows, candidateFiles) {
       });
     }
   }
-  return { check: "G2", status: findings.length > 0 ? "info" : "pass", findings };
+  return { check: "G2", status: findings.length > 0 ? "fail" : "pass", findings };
 }
 function checkG3(ring0Rows, crossingFiles) {
   const ring0Implementations = new Set(ring0Rows.map((r) => r.implementation));
@@ -4665,7 +4761,6 @@ function findWorkspaceEscapes(files, knownPaths, workspaceDirs = DEFAULT_WORKSPA
 import { z } from "zod";
 var ROLE_VALUES = [
   "planner",
-  "brief-author",
   "developer",
   "code-reviewer",
   "security",
@@ -4739,18 +4834,20 @@ var dispatchShared = {
   round: z.number().int().optional(),
   effect_id: z.string()
 };
+var dispatchUsageField = z.object({ input: z.number().nonnegative(), output: z.number().nonnegative() }).strict().nullable();
 var DispatchEventSchema = z.discriminatedUnion("event", [
   z.object({ ...dispatchShared, event: z.literal("dispatched"), prompt_hash: z.string() }).strict(),
   z.object({
     ...dispatchShared,
     event: z.literal("outcome_received"),
     outcome: DispatchOutcomeSchema,
-    usage: z.object({ input: z.number().nonnegative(), output: z.number().nonnegative() }).strict().nullable()
+    usage: dispatchUsageField
   }).strict(),
   z.object({
     ...dispatchShared,
     event: z.literal("dispatch_failed"),
-    reason: z.enum(["timeout", "crash", "refused", "unattributed_write"])
+    reason: z.enum(["timeout", "crash", "refused", "unattributed_write"]),
+    usage: dispatchUsageField
   }).strict()
 ]);
 var loopShared = {
@@ -4926,7 +5023,7 @@ function main() {
       check: CHECK_NAME,
       severity: "error",
       message: `main-branch-refusal: HEAD is on \`${finding.defaultBranch}\`, this repo's default branch — work belongs in a worktree on its own branch, not committed directly here.`,
-      agent_recovery_prompt: `Move this work to a worktree instead of committing on \`${finding.defaultBranch}\`: \`git worktree add .worktrees/task/<tranche>/<n> -b task/<tranche>/<n> origin/${finding.defaultBranch}\`, \`cd\` into it, and redo the change there.`
+      agent_recovery_prompt: `Move this work to a worktree instead of committing on \`${finding.defaultBranch}\`: \`git worktree add .worktrees/task/<tranche>/<n> -b task/<tranche>/<n> --no-track origin/${finding.defaultBranch}\`, \`cd\` into it, run \`git config push.autoSetupRemote true\`, and redo the change there.`
     });
     process.exit(1);
   }

package/dist/checks/bin/check-no-disk-state.js

@@ -27,6 +27,15 @@ var GATE_AUDIENCE = {
     internal: "A composite that shells this repo's own `typecheck`/`lint`/`test`/`build` scripts by name. Those names are this monorepo's toolchain (bun + turbo + biome), not an adopter's; the shipped equivalent of its intent is `vinaya check --all`, which is portable by construction."
   }
 };
+var NON_GATE_BINS = [
+  "archive-task",
+  "assign-task-issue",
+  "dead-branch-audit",
+  "eval-agent-compliance",
+  "open-issue",
+  "open-pr",
+  "report-tokens"
+];
 function isShipped(a) {
   return "shippedAs" in a;
 }
@@ -387,7 +396,7 @@ var LABELS = [
     id: "vinaya/needs:brief-correction",
     category: "needs",
     form: "literal",
-    carries: "Waiting on the Brief Author — the brief contradicts the surface it describes."
+    carries: "Waiting on the Planner — the brief contradicts the surface it describes."
   },
   {
     key: "waiver-docs",
@@ -2394,7 +2403,7 @@ function objectivesOf(body) {
       continue;
     }
     if (hasBacktickedPath(text) && wordCount(stripObjectiveBackticks(text)) < MIN_WORDS_OUTSIDE_BACKTICKS) {
-      errors.push(`O${n} is little more than a file path — an objective states an observable outcome, never a bare path (the Brief Author maps it to files).`);
+      errors.push(`O${n} is little more than a file path — an objective states an observable outcome, never a bare path (the Planner maps it to files).`);
       continue;
     }
     objectives.push({ id: `O${n}`, text });
@@ -2606,18 +2615,14 @@ function checkTestPlanExclusivity(prBody) {
 function checkPrincipalPlaceholder(prBody) {
   const region = testPlanRegion(prBody);
   const lineRe = /^-\s*\[[ xX]\]\s*\*{2}\[principal\]\*{2}(.*)$/gim;
+  const errors = [];
   for (const m of region.matchAll(lineRe)) {
     const content = m[1] ?? "";
     if (/^\s*None\b/i.test(content)) {
-      return {
-        status: "fail",
-        errors: [
-          'brief-validation Test Plan shape: a `**[principal]**` checkbox item is a "None" placeholder — if there is no principal-runnable surface, omit the item entirely; an untickable placeholder box blocks the merge gate forever.'
-        ]
-      };
+      errors.push(`brief-validation Test Plan shape: a \`**[principal]**\` checkbox item is a "None" placeholder ("${content.trim()}") — if there is no principal-runnable surface, omit the item entirely; an untickable placeholder box blocks the merge gate forever.`);
     }
   }
-  return { status: "pass", errors: [] };
+  return errors.length > 0 ? { status: "fail", errors } : { status: "pass", errors: [] };
 }
 function checkSurfaceMap(prBody) {
   return headingCheck(prBody, "(?:technical\\s+)?surface map", "Technical surface map");
@@ -2933,6 +2938,18 @@ function checkBriefSections(prBody, readTier, options = {}) {
   ];
   return { errors: results.flatMap((r) => r.errors) };
 }
+var AEG_BRIEF_V1_MARKER = "<!-- aeg:brief:v1 -->";
+function contentAfterTwoLines(body) {
+  const first = body.indexOf(`
+`);
+  if (first === -1)
+    return "";
+  const second = body.indexOf(`
+`, first + 1);
+  if (second === -1)
+    return "";
+  return body.slice(second + 1);
+}
 // ../../packages/aeg-core/src/doctrine-portability.ts
 var DEFAULT_SHIPS_PREFIX = "aeg-root/";
 var STATIC_PORTABLE_PREFIXES = [
@@ -3175,6 +3192,66 @@ function checkIssueObjectives(body, issueNumber) {
     return { status: "pass", errors: [] };
   return { status: "fail", errors: result.errors.map((e) => `issue-validation objectives: ${e}`) };
 }
+function topLevelSectionText(body, headingName) {
+  const headingRe = new RegExp(`^##[ \\t]*${headingName}[ \\t]*$`, "im");
+  const heading = headingRe.exec(body);
+  if (!heading)
+    return null;
+  const afterHeading = body.slice(heading.index + heading[0].length);
+  const next = /^##[ \t]/m.exec(afterHeading);
+  return next ? afterHeading.slice(0, next.index) : afterHeading;
+}
+function looksLikeFilePath(entry2) {
+  const stripped = entry2.replace(/\/\*\*?$/, "");
+  const lastSegment = stripped.split("/").pop() ?? stripped;
+  const extMatch = /\.[A-Za-z0-9]{1,6}$/.exec(lastSegment);
+  return extMatch !== null && extMatch.index > 0;
+}
+function splitGlobList(raw) {
+  return raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+}
+function parseIssueSurface(body) {
+  const section = topLevelSectionText(body, "Surface");
+  if (section === null)
+    return { ok: false, errors: ["no `## Surface` heading found in the body."] };
+  const inLine = /^in:\s*(.+)$/im.exec(section);
+  const outLine = /^out:\s*(.+)$/im.exec(section);
+  const errors = [];
+  if (!inLine)
+    errors.push("`## Surface` has no `in:` line.");
+  if (!outLine)
+    errors.push("`## Surface` has no `out:` line.");
+  if (errors.length > 0)
+    return { ok: false, errors };
+  const inGlobs = splitGlobList(inLine[1]);
+  const outGlobs = splitGlobList(outLine[1]);
+  for (const g of [...inGlobs, ...outGlobs]) {
+    if (looksLikeFilePath(g)) {
+      errors.push(`\`${g}\` in \`## Surface\` looks like a file path — Surface entries are directory-level globs, never file paths.`);
+    }
+  }
+  if (inGlobs.length === 0)
+    errors.push("`## Surface`'s `in:` line resolved to zero globs.");
+  if (errors.length > 0)
+    return { ok: false, errors };
+  return { ok: true, value: { in: inGlobs, out: outGlobs } };
+}
+function globCoversPath(glob, path) {
+  const g = glob.replace(/\/\*\*?$/, "").replace(/\/+$/, "");
+  const p = path.replace(/\/+$/, "");
+  return g === p || g.startsWith(`${p}/`) || p.startsWith(`${g}/`);
+}
+function checkSurfaceScope(changedFiles, outGlobs) {
+  if (outGlobs.length === 0)
+    return { ok: true };
+  const violations = [];
+  for (const file of changedFiles) {
+    const glob = outGlobs.find((g) => globCoversPath(g, file));
+    if (glob)
+      violations.push({ file, glob });
+  }
+  return violations.length > 0 ? { ok: false, violations } : { ok: true };
+}
 function isTaskIssueLabelSet(labels) {
   return hasLabel("tranche", labels);
 }
@@ -3239,6 +3316,8 @@ function checkProjectsRegistered(body, _labels, registeredNames) {
   }
   return errors.length > 0 ? { status: "fail", errors } : { status: "pass", errors: [] };
 }
+var DOC_PATH_RE = /(?:(?:aeg-root|apps|packages|specs|docs|tools|\.claude|\.github)\/[\w./@-]*\.(?:md|mdx)|\.claude\/(?:skills|rules)\/[\w./-]+|\b(?:docs-index|decisions|projects|state-machine|enforcement|process|README|CLAUDE)\.md\b|\b[\w-]+-(?:spec|decisions|backlog)\.md\b)/i;
+var DOC_PATH_RE_GLOBAL = new RegExp(DOC_PATH_RE.source, "gi");
 
 // ../../packages/aeg-core/src/coherence-checks.ts
 var COHERENCE_ENFORCED_FROM = "2026-07-01";
@@ -3768,16 +3847,33 @@ function checkG1(rows, existsFn) {
   return { check: "G1", status: findings.length > 0 ? "fail" : "pass", findings };
 }
 var SCAFFOLD_PLACEHOLDER = "[undocumented — fill in why]";
+var NON_GATE_BIN_NAMES = NON_GATE_BINS;
+var TWIN_CANDIDATE_EXCEPTIONS = {
+  "apps/cli/src/checks/bin/check-dead-branch-push.ts": 'Ring 0 "Pushing to a branch whose pull request already resolved" (implementation: check-push-target.ts)',
+  "apps/cli/src/checks/bin/check-issue-assignment.ts": `Ring 0 "A task branch's first push (Issue self-assignment)" (implementation: assign-task-issue.ts)`,
+  "apps/cli/src/checks/bin/check-closes-n.ts": 'Ring 1 "Closes linkage" (implementation: verify-coherence.ts)'
+};
+var NON_GATE_HOOK_SCRIPTS = [".claude/hooks/track-transcript.sh"];
 function checkG2(rows, candidateFiles) {
   const implementations = new Set(rows.map((r) => r.implementation).filter((p) => p !== ""));
+  const claimedNames = new Set(rows.flatMap((r) => claimedCheckNames(r.implementation)));
   const findings = [];
   for (const path of candidateFiles) {
-    if (!implementations.has(path)) {
-      findings.push({
-        path,
-        reason: `"${path}" is not named as the implementation of any row in enforcement.md's ring tables`
-      });
-    }
+    if (implementations.has(path))
+      continue;
+    if (path.startsWith(AEG_CORE_BIN_PATH_PREFIX) && NON_GATE_BIN_NAMES.includes(basenameNoExt(path)))
+      continue;
+    if (NON_GATE_HOOK_SCRIPTS.includes(path))
+      continue;
+    if (path in TWIN_CANDIDATE_EXCEPTIONS)
+      continue;
+    const candidateNames = claimedCheckNames(path);
+    if (candidateNames.length > 0 && candidateNames.some((n) => claimedNames.has(n)))
+      continue;
+    findings.push({
+      path,
+      reason: `"${path}" is not named as the implementation of any row in enforcement.md's ring tables`
+    });
   }
   for (const row of rows) {
     const carriesPlaceholder = [row.summary, row.description, row.spec].some((cell) => cell === SCAFFOLD_PLACEHOLDER);
@@ -3789,7 +3885,7 @@ function checkG2(rows, candidateFiles) {
       });
     }
   }
-  return { check: "G2", status: findings.length > 0 ? "info" : "pass", findings };
+  return { check: "G2", status: findings.length > 0 ? "fail" : "pass", findings };
 }
 function checkG3(ring0Rows, crossingFiles) {
   const ring0Implementations = new Set(ring0Rows.map((r) => r.implementation));
@@ -4665,7 +4761,6 @@ function findWorkspaceEscapes(files, knownPaths, workspaceDirs = DEFAULT_WORKSPA
 import { z } from "zod";
 var ROLE_VALUES = [
   "planner",
-  "brief-author",
   "developer",
   "code-reviewer",
   "security",
@@ -4739,18 +4834,20 @@ var dispatchShared = {
   round: z.number().int().optional(),
   effect_id: z.string()
 };
+var dispatchUsageField = z.object({ input: z.number().nonnegative(), output: z.number().nonnegative() }).strict().nullable();
 var DispatchEventSchema = z.discriminatedUnion("event", [
   z.object({ ...dispatchShared, event: z.literal("dispatched"), prompt_hash: z.string() }).strict(),
   z.object({
     ...dispatchShared,
     event: z.literal("outcome_received"),
     outcome: DispatchOutcomeSchema,
-    usage: z.object({ input: z.number().nonnegative(), output: z.number().nonnegative() }).strict().nullable()
+    usage: dispatchUsageField
   }).strict(),
   z.object({
     ...dispatchShared,
     event: z.literal("dispatch_failed"),
-    reason: z.enum(["timeout", "crash", "refused", "unattributed_write"])
+    reason: z.enum(["timeout", "crash", "refused", "unattributed_write"]),
+    usage: dispatchUsageField
   }).strict()
 ]);
 var loopShared = {