@attalabs/vinaya 0.25.0 → 0.27.0

package/dist/checks/bin/check-review-gate.js

@@ -3,7 +3,7 @@ import { createRequire } from "node:module";
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/checks/bin/check-review-gate.ts
-import { execFileSync as execFileSync3 } from "node:child_process";
+import { execFileSync as execFileSync4 } from "node:child_process";
 // ../../packages/aeg-core/src/gate-audience.ts
 var GATE_AUDIENCE = {
   "check-branch-topology": { shippedAs: "branch-topology", ring: 0 },
@@ -27,6 +27,15 @@ var GATE_AUDIENCE = {
     internal: "A composite that shells this repo's own `typecheck`/`lint`/`test`/`build` scripts by name. Those names are this monorepo's toolchain (bun + turbo + biome), not an adopter's; the shipped equivalent of its intent is `vinaya check --all`, which is portable by construction."
   }
 };
+var NON_GATE_BINS = [
+  "archive-task",
+  "assign-task-issue",
+  "dead-branch-audit",
+  "eval-agent-compliance",
+  "open-issue",
+  "open-pr",
+  "report-tokens"
+];
 function isShipped(a) {
   return "shippedAs" in a;
 }
@@ -294,7 +303,7 @@ function issueListByLabelArgs(owner, repo, label) {
     "--state",
     "all",
     "--json",
-    "number,title,body,state,labels,milestone",
+    "number,title,body,state,labels,milestone,stateReason",
     "--limit",
     "200"
   ];
@@ -387,7 +396,7 @@ var LABELS = [
     id: "vinaya/needs:brief-correction",
     category: "needs",
     form: "literal",
-    carries: "Waiting on the Brief Author — the brief contradicts the surface it describes."
+    carries: "Waiting on the Planner — the brief contradicts the surface it describes."
   },
   {
     key: "waiver-docs",
@@ -640,14 +649,19 @@ function resolveTaskIssueRef(title, labels) {
 var INTENTS_HEADING = /^#{1,6}\s*Tranche intents\s*$/im;
 var NEXT_HEADING = /^#{1,6}\s+\S/m;
 var INTENT_BULLET = /^-\s+([a-z0-9][a-z0-9-]*)\s*:\s*(.+)$/i;
-function intentGoalForSlug(description, slug) {
-  const text = stripCode(description, { inlineSpans: "keep" });
+function intentsSection(text) {
   const start = text.match(INTENTS_HEADING);
   if (!start || start.index === undefined)
-    return "";
+    return null;
   const rest = text.slice(start.index + start[0].length);
   const next = rest.match(NEXT_HEADING);
-  const section = rest.slice(0, next && next.index !== undefined ? next.index : rest.length);
+  return rest.slice(0, next && next.index !== undefined ? next.index : rest.length);
+}
+function intentGoalForSlug(description, slug) {
+  const text = stripCode(description, { inlineSpans: "keep" });
+  const section = intentsSection(text);
+  if (section === null)
+    return "";
   for (const line of section.split(`
 `)) {
     const trimmed = line.trim();
@@ -1939,6 +1953,7 @@ function parseInlineFieldList(section) {
 // ../../packages/aeg-core/src/verdict-extraction.ts
 var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
 var OBJECTIVES_VERSION_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Objectives version:\s*([0-9a-f]{64})(?![A-Za-z0-9])/im;
+var RULING_ORDINAL_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Ruling ordinal:\s*(\d+)(?!\d)/im;
 function firstFiveLines(comment) {
   return comment.split(`
 `).slice(0, 5).join(`
@@ -1952,6 +1967,15 @@ function extractObjectivesVersion(comment) {
   const m = firstFiveLines(comment).match(OBJECTIVES_VERSION_PATTERN);
   return m ? m[1].toLowerCase() : null;
 }
+function firstSevenLines(comment) {
+  return comment.split(`
+`).slice(0, 7).join(`
+`);
+}
+function extractRulingOrdinal(comment) {
+  const m = firstSevenLines(comment).match(RULING_ORDINAL_PATTERN);
+  return m ? Number.parseInt(m[1], 10) : null;
+}
 function extractVerdict(comments, valuePattern, missingLabel) {
   const candidates = comments.filter((c) => valuePattern.test(c));
   if (candidates.length === 0) {
@@ -1959,6 +1983,7 @@ function extractVerdict(comments, valuePattern, missingLabel) {
       value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
       headSha: null,
       objectivesVersion: null,
+      rulingOrdinal: null,
       danglingNote: `no ${missingLabel} verdict comment found on this PR`
     };
   }
@@ -1969,6 +1994,7 @@ function extractVerdict(comments, valuePattern, missingLabel) {
       value: `the most recent ${missingLabel} comment's VERDICT line is not within its first five lines — DANGLING, see below`,
       headSha: null,
       objectivesVersion: null,
+      rulingOrdinal: null,
       danglingNote: `the most recent ${missingLabel} verdict comment carries a VERDICT-shaped line outside the first-five-line read window`
     };
   }
@@ -1976,6 +2002,7 @@ function extractVerdict(comments, valuePattern, missingLabel) {
     value: m[1].toUpperCase().replace(/[_-]/g, " "),
     headSha: extractHeadSha(latest),
     objectivesVersion: extractObjectivesVersion(latest),
+    rulingOrdinal: extractRulingOrdinal(latest),
     danglingNote: null
   };
 }
@@ -2337,6 +2364,9 @@ import { createHash as createHash2 } from "node:crypto";
 var HEADING_RE = /^##[ \t]*Objectives[ \t]*$/im;
 var NEXT_HEADING_RE = /^##[ \t]/m;
 var OBJECTIVE_LINE_RE = /^O(\d+)\.[ \t]*(.*)$/;
+function maskedForHeadingSearch(body) {
+  return maskDetailsBlocks(maskCode(body));
+}
 function hasBacktickedPath(text) {
   let i = 0;
   while (i < text.length) {
@@ -2359,16 +2389,22 @@ function stripObjectiveBackticks(text) {
 function wordCount(text) {
   return text.split(/\s+/).filter((w) => /[a-z]/i.test(w)).length;
 }
-function objectivesSectionText(body) {
-  const heading = HEADING_RE.exec(body);
+function objectivesSectionBounds(body) {
+  const masked = maskedForHeadingSearch(body);
+  const heading = HEADING_RE.exec(masked);
   if (!heading)
     return null;
-  const afterHeading = body.slice(heading.index + heading[0].length);
+  const start = heading.index + heading[0].length;
+  const afterHeading = masked.slice(start);
   const next = NEXT_HEADING_RE.exec(afterHeading);
-  return next ? afterHeading.slice(0, next.index) : afterHeading;
+  return { start, end: next ? start + next.index : body.length };
+}
+function objectivesSectionText(body) {
+  const bounds = objectivesSectionBounds(body);
+  return bounds === null ? null : body.slice(bounds.start, bounds.end);
 }
 function hasObjectivesHeading(body) {
-  return HEADING_RE.test(body);
+  return HEADING_RE.test(maskedForHeadingSearch(body));
 }
 function objectivesOf(body) {
   const section = objectivesSectionText(body);
@@ -2394,7 +2430,7 @@ function objectivesOf(body) {
       continue;
     }
     if (hasBacktickedPath(text) && wordCount(stripObjectiveBackticks(text)) < MIN_WORDS_OUTSIDE_BACKTICKS) {
-      errors.push(`O${n} is little more than a file path — an objective states an observable outcome, never a bare path (the Brief Author maps it to files).`);
+      errors.push(`O${n} is little more than a file path — an objective states an observable outcome, never a bare path (the Planner maps it to files).`);
       continue;
     }
     objectives.push({ id: `O${n}`, text });
@@ -2428,6 +2464,15 @@ function isIssueNotFoundError(err) {
 `);
   return /could not resolve to an (?:issue|pull request)|\b404\b|not found/i.test(haystack);
 }
+function resolveObjectivesSource(prBody, issue, cutoverIssue) {
+  if (issue !== null && issue < cutoverIssue)
+    return { kind: "none" };
+  if (issue !== null)
+    return { kind: "issue", issue };
+  if (hasObjectivesHeading(prBody))
+    return { kind: "body" };
+  return { kind: "none" };
+}
 
 // ../../packages/aeg-core/src/premise-check.ts
 import { createHash as createHash3 } from "node:crypto";
@@ -2606,18 +2651,14 @@ function checkTestPlanExclusivity(prBody) {
 function checkPrincipalPlaceholder(prBody) {
   const region = testPlanRegion(prBody);
   const lineRe = /^-\s*\[[ xX]\]\s*\*{2}\[principal\]\*{2}(.*)$/gim;
+  const errors = [];
   for (const m of region.matchAll(lineRe)) {
     const content = m[1] ?? "";
     if (/^\s*None\b/i.test(content)) {
-      return {
-        status: "fail",
-        errors: [
-          'brief-validation Test Plan shape: a `**[principal]**` checkbox item is a "None" placeholder — if there is no principal-runnable surface, omit the item entirely; an untickable placeholder box blocks the merge gate forever.'
-        ]
-      };
+      errors.push(`brief-validation Test Plan shape: a \`**[principal]**\` checkbox item is a "None" placeholder ("${content.trim()}") — if there is no principal-runnable surface, omit the item entirely; an untickable placeholder box blocks the merge gate forever.`);
     }
   }
-  return { status: "pass", errors: [] };
+  return errors.length > 0 ? { status: "fail", errors } : { status: "pass", errors: [] };
 }
 function checkSurfaceMap(prBody) {
   return headingCheck(prBody, "(?:technical\\s+)?surface map", "Technical surface map");
@@ -2933,6 +2974,41 @@ function checkBriefSections(prBody, readTier, options = {}) {
   ];
   return { errors: results.flatMap((r) => r.errors) };
 }
+function contentAfterNLines(body, n) {
+  let idx = -1;
+  for (let i = 0;i < n; i++) {
+    idx = body.indexOf(`
+`, idx + 1);
+    if (idx === -1)
+      return "";
+  }
+  return body.slice(idx + 1);
+}
+var BRIEF_MARKER_LINE_RE = /^<!-- aeg:brief:v(\d+) -->$/;
+function parseBriefMarkerVersion(firstLine) {
+  const m = BRIEF_MARKER_LINE_RE.exec(firstLine.trim());
+  if (!m)
+    return null;
+  const version = Number.parseInt(m[1], 10);
+  return Number.isInteger(version) && version >= 1 ? version : null;
+}
+function frozenBriefContent(body, version) {
+  return contentAfterNLines(body, version === 1 ? 2 : 3);
+}
+function resolveNewestFrozenBrief(comments, allowlist) {
+  let best = null;
+  for (const c of comments) {
+    if (!isPrincipal(c.author, allowlist))
+      continue;
+    const version = parseBriefMarkerVersion(c.body.split(`
+`)[0] ?? "");
+    if (version === null)
+      continue;
+    if (best === null || version > best.version)
+      best = { ...c, version };
+  }
+  return best === null ? null : { ...best, content: frozenBriefContent(best.body, best.version) };
+}
 // ../../packages/aeg-core/src/doctrine-portability.ts
 var DEFAULT_SHIPS_PREFIX = "aeg-root/";
 var STATIC_PORTABLE_PREFIXES = [
@@ -3175,6 +3251,66 @@ function checkIssueObjectives(body, issueNumber) {
     return { status: "pass", errors: [] };
   return { status: "fail", errors: result.errors.map((e) => `issue-validation objectives: ${e}`) };
 }
+function topLevelSectionText(body, headingName) {
+  const headingRe = new RegExp(`^##[ \\t]*${headingName}[ \\t]*$`, "im");
+  const heading = headingRe.exec(body);
+  if (!heading)
+    return null;
+  const afterHeading = body.slice(heading.index + heading[0].length);
+  const next = /^##[ \t]/m.exec(afterHeading);
+  return next ? afterHeading.slice(0, next.index) : afterHeading;
+}
+function looksLikeFilePath(entry2) {
+  const stripped = entry2.replace(/\/\*\*?$/, "");
+  const lastSegment = stripped.split("/").pop() ?? stripped;
+  const extMatch = /\.[A-Za-z0-9]{1,6}$/.exec(lastSegment);
+  return extMatch !== null && extMatch.index > 0;
+}
+function splitGlobList(raw) {
+  return raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+}
+function parseIssueSurface(body) {
+  const section = topLevelSectionText(body, "Surface");
+  if (section === null)
+    return { ok: false, errors: ["no `## Surface` heading found in the body."] };
+  const inLine = /^in:\s*(.+)$/im.exec(section);
+  const outLine = /^out:\s*(.+)$/im.exec(section);
+  const errors = [];
+  if (!inLine)
+    errors.push("`## Surface` has no `in:` line.");
+  if (!outLine)
+    errors.push("`## Surface` has no `out:` line.");
+  if (errors.length > 0)
+    return { ok: false, errors };
+  const inGlobs = splitGlobList(inLine[1]);
+  const outGlobs = splitGlobList(outLine[1]);
+  for (const g of [...inGlobs, ...outGlobs]) {
+    if (looksLikeFilePath(g)) {
+      errors.push(`\`${g}\` in \`## Surface\` looks like a file path — Surface entries are directory-level globs, never file paths.`);
+    }
+  }
+  if (inGlobs.length === 0)
+    errors.push("`## Surface`'s `in:` line resolved to zero globs.");
+  if (errors.length > 0)
+    return { ok: false, errors };
+  return { ok: true, value: { in: inGlobs, out: outGlobs } };
+}
+function globCoversPath(glob, path) {
+  const g = glob.replace(/\/\*\*?$/, "").replace(/\/+$/, "");
+  const p = path.replace(/\/+$/, "");
+  return g === p || g.startsWith(`${p}/`) || p.startsWith(`${g}/`);
+}
+function checkSurfaceScope(changedFiles, outGlobs) {
+  if (outGlobs.length === 0)
+    return { ok: true };
+  const violations = [];
+  for (const file of changedFiles) {
+    const glob = outGlobs.find((g) => globCoversPath(g, file));
+    if (glob)
+      violations.push({ file, glob });
+  }
+  return violations.length > 0 ? { ok: false, violations } : { ok: true };
+}
 function isTaskIssueLabelSet(labels) {
   return hasLabel("tranche", labels);
 }
@@ -3239,6 +3375,8 @@ function checkProjectsRegistered(body, _labels, registeredNames) {
   }
   return errors.length > 0 ? { status: "fail", errors } : { status: "pass", errors: [] };
 }
+var DOC_PATH_RE = /(?:(?:aeg-root|apps|packages|specs|docs|tools|\.claude|\.github)\/[\w./@-]*\.(?:md|mdx)|\.claude\/(?:skills|rules)\/[\w./-]+|\b(?:docs-index|decisions|projects|state-machine|enforcement|process|README|CLAUDE)\.md\b|\b[\w-]+-(?:spec|decisions|backlog)\.md\b)/i;
+var DOC_PATH_RE_GLOBAL = new RegExp(DOC_PATH_RE.source, "gi");
 
 // ../../packages/aeg-core/src/coherence-checks.ts
 var COHERENCE_ENFORCED_FROM = "2026-07-01";
@@ -3596,6 +3734,11 @@ function isBoundToObjectives(extraction, currentVersion) {
     return true;
   return extraction.objectivesVersion === currentVersion;
 }
+function isBoundToRulings(extraction, currentOrdinal) {
+  if (extraction.rulingOrdinal === null)
+    return currentOrdinal === 0;
+  return extraction.rulingOrdinal === currentOrdinal;
+}
 function checkReviewGate(input) {
   const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const waived = isWaiverLabelActorVerified({
@@ -3624,7 +3767,9 @@ function checkReviewGate(input) {
   const securityBound = isBoundToPatch(security, input.headSha, input.patchIdOf);
   const codeReviewObjectivesBound = isBoundToObjectives(codeReview, input.objectivesVersion);
   const securityObjectivesBound = isBoundToObjectives(security, input.objectivesVersion);
-  if (codeReviewClean && codeReviewBound && codeReviewObjectivesBound && securityClean && securityBound && securityObjectivesBound && mechanicalChecksClean) {
+  const codeReviewRulingsBound = isBoundToRulings(codeReview, input.rulingOrdinal);
+  const securityRulingsBound = isBoundToRulings(security, input.rulingOrdinal);
+  if (codeReviewClean && codeReviewBound && codeReviewObjectivesBound && codeReviewRulingsBound && securityClean && securityBound && securityObjectivesBound && securityRulingsBound && mechanicalChecksClean) {
     return {
       verdict: "pass",
       reason: `code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS, both covering head ${input.headSha}, and every reported mechanical check is green.`,
@@ -3638,6 +3783,8 @@ function checkReviewGate(input) {
     problems.push(`the newest code-review verdict covers ${codeReview.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
   } else if (!codeReviewObjectivesBound) {
     problems.push(`the newest code-review verdict was cast against objectives version ${codeReview.objectivesVersion ?? "none"}, the Issue's list is now ${input.objectivesVersion}`);
+  } else if (!codeReviewRulingsBound) {
+    problems.push(`the newest code-review verdict was cast against ruling ordinal ${codeReview.rulingOrdinal ?? "none"}, a newer ruling (ruling ${input.rulingOrdinal}) is now posted on this PR`);
   }
   if (!securityClean) {
     problems.push(`security-review verdict is not a clean PASS (found: ${security.value})`);
@@ -3645,6 +3792,8 @@ function checkReviewGate(input) {
     problems.push(`the newest security-review verdict covers ${security.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
   } else if (!securityObjectivesBound) {
     problems.push(`the newest security-review verdict was cast against objectives version ${security.objectivesVersion ?? "none"}, the Issue's list is now ${input.objectivesVersion}`);
+  } else if (!securityRulingsBound) {
+    problems.push(`the newest security-review verdict was cast against ruling ordinal ${security.rulingOrdinal ?? "none"}, a newer ruling (ruling ${input.rulingOrdinal}) is now posted on this PR`);
   }
   if (!mechanicalChecksClean) {
     problems.push(reportedMechanicalChecks.length === 0 ? "no mechanical checks have reported for this head yet" : `mechanical check(s) not green: ${reportedMechanicalChecks.filter((c) => c.bucket !== "pass").map((c) => `${c.name} (${c.bucket})`).join(", ")}`);
@@ -3661,6 +3810,24 @@ var DEFAULT_RELEASE_ACTOR = "github-actions[bot]";
 function isChangesetsReleasePr(branch, author, expectedAuthor) {
   return branch === CHANGESET_RELEASE_BRANCH && author === expectedAuthor;
 }
+// ../../packages/aeg-core/src/ruling-ordinal.ts
+var RULING_MARKER_ORDINAL = /^<!-- aeg:principal:ruling:\d+-(\d+) -->$/;
+function newestPrincipalRulingOrdinal(comments, allowlist) {
+  let best = 0;
+  for (const c of comments) {
+    if (!isPrincipal(c.author, allowlist))
+      continue;
+    const firstLine = (c.body.split(`
+`)[0] ?? "").trim();
+    const m = RULING_MARKER_ORDINAL.exec(firstLine);
+    if (!m)
+      continue;
+    const k = Number.parseInt(m[1], 10);
+    if (k > best)
+      best = k;
+  }
+  return best;
+}
 // ../../packages/aeg-core/src/markdown-table.ts
 function splitRow(line) {
   const trimmed = line.trim().replace(/^\|/, "").replace(/\|$/, "");
@@ -3768,16 +3935,33 @@ function checkG1(rows, existsFn) {
   return { check: "G1", status: findings.length > 0 ? "fail" : "pass", findings };
 }
 var SCAFFOLD_PLACEHOLDER = "[undocumented — fill in why]";
+var NON_GATE_BIN_NAMES = NON_GATE_BINS;
+var TWIN_CANDIDATE_EXCEPTIONS = {
+  "apps/cli/src/checks/bin/check-dead-branch-push.ts": 'Ring 0 "Pushing to a branch whose pull request already resolved" (implementation: check-push-target.ts)',
+  "apps/cli/src/checks/bin/check-issue-assignment.ts": `Ring 0 "A task branch's first push (Issue self-assignment)" (implementation: assign-task-issue.ts)`,
+  "apps/cli/src/checks/bin/check-closes-n.ts": 'Ring 1 "Closes linkage" (implementation: verify-coherence.ts)'
+};
+var NON_GATE_HOOK_SCRIPTS = [".claude/hooks/track-transcript.sh"];
 function checkG2(rows, candidateFiles) {
   const implementations = new Set(rows.map((r) => r.implementation).filter((p) => p !== ""));
+  const claimedNames = new Set(rows.flatMap((r) => claimedCheckNames(r.implementation)));
   const findings = [];
   for (const path of candidateFiles) {
-    if (!implementations.has(path)) {
-      findings.push({
-        path,
-        reason: `"${path}" is not named as the implementation of any row in enforcement.md's ring tables`
-      });
-    }
+    if (implementations.has(path))
+      continue;
+    if (path.startsWith(AEG_CORE_BIN_PATH_PREFIX) && NON_GATE_BIN_NAMES.includes(basenameNoExt(path)))
+      continue;
+    if (NON_GATE_HOOK_SCRIPTS.includes(path))
+      continue;
+    if (path in TWIN_CANDIDATE_EXCEPTIONS)
+      continue;
+    const candidateNames = claimedCheckNames(path);
+    if (candidateNames.length > 0 && candidateNames.some((n) => claimedNames.has(n)))
+      continue;
+    findings.push({
+      path,
+      reason: `"${path}" is not named as the implementation of any row in enforcement.md's ring tables`
+    });
   }
   for (const row of rows) {
     const carriesPlaceholder = [row.summary, row.description, row.spec].some((cell) => cell === SCAFFOLD_PLACEHOLDER);
@@ -3789,7 +3973,7 @@ function checkG2(rows, candidateFiles) {
       });
     }
   }
-  return { check: "G2", status: findings.length > 0 ? "info" : "pass", findings };
+  return { check: "G2", status: findings.length > 0 ? "fail" : "pass", findings };
 }
 function checkG3(ring0Rows, crossingFiles) {
   const ring0Implementations = new Set(ring0Rows.map((r) => r.implementation));
@@ -4665,7 +4849,6 @@ function findWorkspaceEscapes(files, knownPaths, workspaceDirs = DEFAULT_WORKSPA
 import { z } from "zod";
 var ROLE_VALUES = [
   "planner",
-  "brief-author",
   "developer",
   "code-reviewer",
   "security",
@@ -4739,18 +4922,20 @@ var dispatchShared = {
   round: z.number().int().optional(),
   effect_id: z.string()
 };
+var dispatchUsageField = z.object({ input: z.number().nonnegative(), output: z.number().nonnegative() }).strict().nullable();
 var DispatchEventSchema = z.discriminatedUnion("event", [
   z.object({ ...dispatchShared, event: z.literal("dispatched"), prompt_hash: z.string() }).strict(),
   z.object({
     ...dispatchShared,
     event: z.literal("outcome_received"),
     outcome: DispatchOutcomeSchema,
-    usage: z.object({ input: z.number().nonnegative(), output: z.number().nonnegative() }).strict().nullable()
+    usage: dispatchUsageField
   }).strict(),
   z.object({
     ...dispatchShared,
     event: z.literal("dispatch_failed"),
-    reason: z.enum(["timeout", "crash", "refused", "unattributed_write"])
+    reason: z.enum(["timeout", "crash", "refused", "unattributed_write"]),
+    usage: dispatchUsageField
   }).strict()
 ]);
 var loopShared = {
@@ -5193,12 +5378,40 @@ function loadConfig() {
 }
 var TOKENS_COLLECT_TRUST_PATH = join(GLOBAL_VINAYA_HOME, "tokens-collect-trust.json");
 
+// src/lib/patch-id.ts
+import { execFileSync as execFileSync3 } from "node:child_process";
+function patchIdAt(base, sha) {
+  try {
+    execFileSync3("git", ["fetch", "--quiet", "origin", sha], { stdio: ["ignore", "ignore", "ignore"] });
+  } catch {}
+  try {
+    const diff = execFileSync3("git", ["diff", `origin/${base}...${sha}`], {
+      encoding: "utf8",
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    if (diff === "")
+      return null;
+    const out = execFileSync3("git", ["patch-id", "--stable"], {
+      input: diff,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+    const id = out.split(/\s+/)[0] ?? "";
+    return id === "" ? null : id;
+  } catch {
+    return null;
+  }
+}
+
+// src/lib/review-gate-check-name.ts
+var REVIEW_GATE_CHECK_RUN_NAME = "vinaya review gate";
+
 // src/checks/bin/check-review-gate.ts
 var CHECK_NAME = "review-gate";
-var OWN_CHECK_RUN_NAME = "vinaya review gate";
 function fetchPr(prNumber) {
   try {
-    const out = execFileSync3("gh", ["pr", "view", String(prNumber), "--json", "number,comments,labels,headRefName,headRefOid,baseRefName,body"], {
+    const out = execFileSync4("gh", ["pr", "view", String(prNumber), "--json", "number,comments,labels,headRefName,headRefOid,baseRefName,body"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -5208,27 +5421,28 @@ function fetchPr(prNumber) {
   }
 }
 function fetchIssueBodyForObjectives(issueNumber) {
-  return execFileSync3("gh", ["issue", "view", String(issueNumber), "--json", "body", "--jq", ".body"], {
+  return execFileSync4("gh", ["issue", "view", String(issueNumber), "--json", "body", "--jq", ".body"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
 }
 function resolveObjectivesVersion(pr) {
   const { issue } = extractIssue(pr.body);
-  if (issue !== null && issue < OBJECTIVES_SINCE_ISSUE)
+  const source = resolveObjectivesSource(pr.body, issue, OBJECTIVES_SINCE_ISSUE);
+  if (source.kind === "none")
     return null;
-  if (issue !== null) {
+  if (source.kind === "issue") {
     let issueBody;
     try {
-      issueBody = fetchIssueBodyForObjectives(issue);
+      issueBody = fetchIssueBodyForObjectives(source.issue);
     } catch (err) {
       if (isIssueNotFoundError(err)) {
         emitCheckError({
           schema: CHECK_SCHEMA_VERSION,
           check: CHECK_NAME,
           severity: "error",
-          message: `review-gate severity:infra — Issue #${issue} does not resolve via \`gh issue view\` — cannot verify the objectives-version binding for a PR whose linked Issue is at/above the objectives cutover.`,
-          agent_recovery_prompt: `Restore Issue #${issue}, fix \`Closes #N\` to name a real Issue, or have a principal apply the \`vinaya/waiver:review\` label, then re-run \`vinaya check review-gate\`.`
+          message: `review-gate severity:infra — Issue #${source.issue} does not resolve via \`gh issue view\` — cannot verify the objectives-version binding for a PR whose linked Issue is at/above the objectives cutover.`,
+          agent_recovery_prompt: `Restore Issue #${source.issue}, fix \`Closes #N\` to name a real Issue, or have a principal apply the \`vinaya/waiver:review\` label, then re-run \`vinaya check review-gate\`.`
         });
         process.exit(1);
       }
@@ -5236,7 +5450,7 @@ function resolveObjectivesVersion(pr) {
         schema: CHECK_SCHEMA_VERSION,
         check: CHECK_NAME,
         severity: "error",
-        message: `review-gate severity:infra — could not fetch Issue #${issue}'s body via \`gh issue view\` to resolve its objectives version: ${err.message}`,
+        message: `review-gate severity:infra — could not fetch Issue #${source.issue}'s body via \`gh issue view\` to resolve its objectives version: ${err.message}`,
         agent_recovery_prompt: "Confirm `gh auth status` passes and the Issue number is correct, then re-run `vinaya check review-gate`."
       });
       process.exit(1);
@@ -5247,32 +5461,29 @@ function resolveObjectivesVersion(pr) {
         schema: CHECK_SCHEMA_VERSION,
         check: CHECK_NAME,
         severity: "error",
-        message: `review-gate severity:infra — Issue #${issue}'s \`## Objectives\` section does not parse (${parsed.errors.join("; ")}) — cannot verify the objectives-version binding.`,
-        agent_recovery_prompt: `Fix Issue #${issue}'s \`## Objectives\` section, or have a principal apply the \`vinaya/waiver:review\` label, then re-run \`vinaya check review-gate\`.`
+        message: `review-gate severity:infra — Issue #${source.issue}'s \`## Objectives\` section does not parse (${parsed.errors.join("; ")}) — cannot verify the objectives-version binding.`,
+        agent_recovery_prompt: `Fix Issue #${source.issue}'s \`## Objectives\` section, or have a principal apply the \`vinaya/waiver:review\` label, then re-run \`vinaya check review-gate\`.`
       });
       process.exit(1);
     }
     return objectivesVersion(parsed.objectives);
   }
-  if (hasObjectivesHeading(pr.body)) {
-    const own = objectivesOf(pr.body);
-    if (!own.ok) {
-      emitCheckError({
-        schema: CHECK_SCHEMA_VERSION,
-        check: CHECK_NAME,
-        severity: "error",
-        message: `review-gate severity:infra — this PR body's own \`## Objectives\` section does not parse (${own.errors.join("; ")}) — cannot verify the objectives-version binding.`,
-        agent_recovery_prompt: "Fix the PR body's `## Objectives` section, or have a principal apply the `vinaya/waiver:review` label, then re-run `vinaya check review-gate`."
-      });
-      process.exit(1);
-    }
-    return objectivesVersion(own.objectives);
+  const own = objectivesOf(pr.body);
+  if (!own.ok) {
+    emitCheckError({
+      schema: CHECK_SCHEMA_VERSION,
+      check: CHECK_NAME,
+      severity: "error",
+      message: `review-gate severity:infra — this PR body's own \`## Objectives\` section does not parse (${own.errors.join("; ")}) — cannot verify the objectives-version binding.`,
+      agent_recovery_prompt: "Fix the PR body's `## Objectives` section, or have a principal apply the `vinaya/waiver:review` label, then re-run `vinaya check review-gate`."
+    });
+    process.exit(1);
   }
-  return null;
+  return objectivesVersion(own.objectives);
 }
 function shaFromLsRemote(branch) {
   try {
-    const out = execFileSync3("git", ["ls-remote", "origin", `refs/heads/${branch}`], {
+    const out = execFileSync4("git", ["ls-remote", "origin", `refs/heads/${branch}`], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     }).trim();
@@ -5284,7 +5495,7 @@ function shaFromLsRemote(branch) {
 }
 function shaFromGhApi(branch) {
   try {
-    const out = execFileSync3("gh", ["api", `repos/{owner}/{repo}/git/ref/heads/${branch}`, "--jq", ".object.sha"], {
+    const out = execFileSync4("gh", ["api", `repos/{owner}/{repo}/git/ref/heads/${branch}`, "--jq", ".object.sha"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     }).trim();
@@ -5301,29 +5512,6 @@ function resolveTrueHeadSha(pr) {
   }
   return trueSha;
 }
-function patchIdAt(base, sha) {
-  try {
-    execFileSync3("git", ["fetch", "--quiet", "origin", sha], { stdio: ["ignore", "ignore", "ignore"] });
-  } catch {}
-  try {
-    const diff = execFileSync3("git", ["diff", `origin/${base}...${sha}`], {
-      encoding: "utf8",
-      maxBuffer: 64 * 1024 * 1024,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    if (diff === "")
-      return null;
-    const out = execFileSync3("git", ["patch-id", "--stable"], {
-      input: diff,
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
-    const id = out.split(/\s+/)[0] ?? "";
-    return id === "" ? null : id;
-  } catch {
-    return null;
-  }
-}
 function bucketFor(run2) {
   if (run2.status !== "completed")
     return "pending";
@@ -5341,7 +5529,7 @@ function bucketFor(run2) {
 }
 function fetchMechanicalChecks(headSha) {
   try {
-    const out = execFileSync3("gh", [
+    const out = execFileSync4("gh", [
       "api",
       `repos/{owner}/{repo}/commits/${headSha}/check-runs`,
       "--paginate",
@@ -5356,14 +5544,14 @@ function fetchMechanicalChecks(headSha) {
       if (!seen || run2.id > seen.id)
         latestByName.set(run2.name, run2);
     }
-    return Array.from(latestByName.values()).filter((r) => r.name !== OWN_CHECK_RUN_NAME).map((r) => ({ name: r.name, bucket: bucketFor(r) }));
+    return Array.from(latestByName.values()).filter((r) => r.name !== REVIEW_GATE_CHECK_RUN_NAME).map((r) => ({ name: r.name, bucket: bucketFor(r) }));
   } catch {
     return null;
   }
 }
 function fetchWaiverLabelActor(prNumber, label2) {
   try {
-    const out = execFileSync3("gh", ["api", `repos/{owner}/{repo}/issues/${prNumber}/timeline`, "--paginate"], {
+    const out = execFileSync4("gh", ["api", `repos/{owner}/{repo}/issues/${prNumber}/timeline`, "--paginate"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -5431,7 +5619,8 @@ function main() {
     mechanicalChecks,
     headSha,
     patchIdOf: (sha) => patchIdAt(pr.baseRefName, sha),
-    objectivesVersion: waived ? null : resolveObjectivesVersion(pr)
+    objectivesVersion: waived ? null : resolveObjectivesVersion(pr),
+    rulingOrdinal: newestPrincipalRulingOrdinal(pr.comments.map((c) => ({ body: c.body, author: c.author?.login ?? null })), principalAllowlist)
   });
   if (result.verdict === "fail") {
     emitCheckError({