@attalabs/vinaya 0.26.0 → 0.27.0

package/dist/checks/bin/check-evidence-fresh.js

@@ -3,7 +3,7 @@ import { createRequire } from "node:module";
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/checks/bin/check-evidence-fresh.ts
-import { execFileSync as execFileSync3 } from "node:child_process";
+import { execFileSync as execFileSync4 } from "node:child_process";
 // ../../packages/aeg-core/src/gate-audience.ts
 var GATE_AUDIENCE = {
   "check-branch-topology": { shippedAs: "branch-topology", ring: 0 },
@@ -303,7 +303,7 @@ function issueListByLabelArgs(owner, repo, label) {
     "--state",
     "all",
     "--json",
-    "number,title,body,state,labels,milestone",
+    "number,title,body,state,labels,milestone,stateReason",
     "--limit",
     "200"
   ];
@@ -649,14 +649,19 @@ function resolveTaskIssueRef(title, labels) {
 var INTENTS_HEADING = /^#{1,6}\s*Tranche intents\s*$/im;
 var NEXT_HEADING = /^#{1,6}\s+\S/m;
 var INTENT_BULLET = /^-\s+([a-z0-9][a-z0-9-]*)\s*:\s*(.+)$/i;
-function intentGoalForSlug(description, slug) {
-  const text = stripCode(description, { inlineSpans: "keep" });
+function intentsSection(text) {
   const start = text.match(INTENTS_HEADING);
   if (!start || start.index === undefined)
-    return "";
+    return null;
   const rest = text.slice(start.index + start[0].length);
   const next = rest.match(NEXT_HEADING);
-  const section = rest.slice(0, next && next.index !== undefined ? next.index : rest.length);
+  return rest.slice(0, next && next.index !== undefined ? next.index : rest.length);
+}
+function intentGoalForSlug(description, slug) {
+  const text = stripCode(description, { inlineSpans: "keep" });
+  const section = intentsSection(text);
+  if (section === null)
+    return "";
   for (const line of section.split(`
 `)) {
     const trimmed = line.trim();
@@ -1948,6 +1953,7 @@ function parseInlineFieldList(section) {
 // ../../packages/aeg-core/src/verdict-extraction.ts
 var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
 var OBJECTIVES_VERSION_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Objectives version:\s*([0-9a-f]{64})(?![A-Za-z0-9])/im;
+var RULING_ORDINAL_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Ruling ordinal:\s*(\d+)(?!\d)/im;
 function firstFiveLines(comment) {
   return comment.split(`
 `).slice(0, 5).join(`
@@ -1961,6 +1967,15 @@ function extractObjectivesVersion(comment) {
   const m = firstFiveLines(comment).match(OBJECTIVES_VERSION_PATTERN);
   return m ? m[1].toLowerCase() : null;
 }
+function firstSevenLines(comment) {
+  return comment.split(`
+`).slice(0, 7).join(`
+`);
+}
+function extractRulingOrdinal(comment) {
+  const m = firstSevenLines(comment).match(RULING_ORDINAL_PATTERN);
+  return m ? Number.parseInt(m[1], 10) : null;
+}
 function extractVerdict(comments, valuePattern, missingLabel) {
   const candidates = comments.filter((c) => valuePattern.test(c));
   if (candidates.length === 0) {
@@ -1968,6 +1983,7 @@ function extractVerdict(comments, valuePattern, missingLabel) {
       value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
       headSha: null,
       objectivesVersion: null,
+      rulingOrdinal: null,
       danglingNote: `no ${missingLabel} verdict comment found on this PR`
     };
   }
@@ -1978,6 +1994,7 @@ function extractVerdict(comments, valuePattern, missingLabel) {
       value: `the most recent ${missingLabel} comment's VERDICT line is not within its first five lines — DANGLING, see below`,
       headSha: null,
       objectivesVersion: null,
+      rulingOrdinal: null,
       danglingNote: `the most recent ${missingLabel} verdict comment carries a VERDICT-shaped line outside the first-five-line read window`
     };
   }
@@ -1985,6 +2002,7 @@ function extractVerdict(comments, valuePattern, missingLabel) {
     value: m[1].toUpperCase().replace(/[_-]/g, " "),
     headSha: extractHeadSha(latest),
     objectivesVersion: extractObjectivesVersion(latest),
+    rulingOrdinal: extractRulingOrdinal(latest),
     danglingNote: null
   };
 }
@@ -2346,6 +2364,9 @@ import { createHash as createHash2 } from "node:crypto";
 var HEADING_RE = /^##[ \t]*Objectives[ \t]*$/im;
 var NEXT_HEADING_RE = /^##[ \t]/m;
 var OBJECTIVE_LINE_RE = /^O(\d+)\.[ \t]*(.*)$/;
+function maskedForHeadingSearch(body) {
+  return maskDetailsBlocks(maskCode(body));
+}
 function hasBacktickedPath(text) {
   let i = 0;
   while (i < text.length) {
@@ -2368,16 +2389,22 @@ function stripObjectiveBackticks(text) {
 function wordCount(text) {
   return text.split(/\s+/).filter((w) => /[a-z]/i.test(w)).length;
 }
-function objectivesSectionText(body) {
-  const heading = HEADING_RE.exec(body);
+function objectivesSectionBounds(body) {
+  const masked = maskedForHeadingSearch(body);
+  const heading = HEADING_RE.exec(masked);
   if (!heading)
     return null;
-  const afterHeading = body.slice(heading.index + heading[0].length);
+  const start = heading.index + heading[0].length;
+  const afterHeading = masked.slice(start);
   const next = NEXT_HEADING_RE.exec(afterHeading);
-  return next ? afterHeading.slice(0, next.index) : afterHeading;
+  return { start, end: next ? start + next.index : body.length };
+}
+function objectivesSectionText(body) {
+  const bounds = objectivesSectionBounds(body);
+  return bounds === null ? null : body.slice(bounds.start, bounds.end);
 }
 function hasObjectivesHeading(body) {
-  return HEADING_RE.test(body);
+  return HEADING_RE.test(maskedForHeadingSearch(body));
 }
 function objectivesOf(body) {
   const section = objectivesSectionText(body);
@@ -2437,6 +2464,15 @@ function isIssueNotFoundError(err) {
 `);
   return /could not resolve to an (?:issue|pull request)|\b404\b|not found/i.test(haystack);
 }
+function resolveObjectivesSource(prBody, issue, cutoverIssue) {
+  if (issue !== null && issue < cutoverIssue)
+    return { kind: "none" };
+  if (issue !== null)
+    return { kind: "issue", issue };
+  if (hasObjectivesHeading(prBody))
+    return { kind: "body" };
+  return { kind: "none" };
+}
 
 // ../../packages/aeg-core/src/premise-check.ts
 import { createHash as createHash3 } from "node:crypto";
@@ -2938,17 +2974,40 @@ function checkBriefSections(prBody, readTier, options = {}) {
   ];
   return { errors: results.flatMap((r) => r.errors) };
 }
-var AEG_BRIEF_V1_MARKER = "<!-- aeg:brief:v1 -->";
-function contentAfterTwoLines(body) {
-  const first = body.indexOf(`
-`);
-  if (first === -1)
-    return "";
-  const second = body.indexOf(`
-`, first + 1);
-  if (second === -1)
-    return "";
-  return body.slice(second + 1);
+function contentAfterNLines(body, n) {
+  let idx = -1;
+  for (let i = 0;i < n; i++) {
+    idx = body.indexOf(`
+`, idx + 1);
+    if (idx === -1)
+      return "";
+  }
+  return body.slice(idx + 1);
+}
+var BRIEF_MARKER_LINE_RE = /^<!-- aeg:brief:v(\d+) -->$/;
+function parseBriefMarkerVersion(firstLine) {
+  const m = BRIEF_MARKER_LINE_RE.exec(firstLine.trim());
+  if (!m)
+    return null;
+  const version = Number.parseInt(m[1], 10);
+  return Number.isInteger(version) && version >= 1 ? version : null;
+}
+function frozenBriefContent(body, version) {
+  return contentAfterNLines(body, version === 1 ? 2 : 3);
+}
+function resolveNewestFrozenBrief(comments, allowlist) {
+  let best = null;
+  for (const c of comments) {
+    if (!isPrincipal(c.author, allowlist))
+      continue;
+    const version = parseBriefMarkerVersion(c.body.split(`
+`)[0] ?? "");
+    if (version === null)
+      continue;
+    if (best === null || version > best.version)
+      best = { ...c, version };
+  }
+  return best === null ? null : { ...best, content: frozenBriefContent(best.body, best.version) };
 }
 // ../../packages/aeg-core/src/doctrine-portability.ts
 var DEFAULT_SHIPS_PREFIX = "aeg-root/";
@@ -3675,6 +3734,11 @@ function isBoundToObjectives(extraction, currentVersion) {
     return true;
   return extraction.objectivesVersion === currentVersion;
 }
+function isBoundToRulings(extraction, currentOrdinal) {
+  if (extraction.rulingOrdinal === null)
+    return currentOrdinal === 0;
+  return extraction.rulingOrdinal === currentOrdinal;
+}
 function checkReviewGate(input) {
   const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const waived = isWaiverLabelActorVerified({
@@ -3703,7 +3767,9 @@ function checkReviewGate(input) {
   const securityBound = isBoundToPatch(security, input.headSha, input.patchIdOf);
   const codeReviewObjectivesBound = isBoundToObjectives(codeReview, input.objectivesVersion);
   const securityObjectivesBound = isBoundToObjectives(security, input.objectivesVersion);
-  if (codeReviewClean && codeReviewBound && codeReviewObjectivesBound && securityClean && securityBound && securityObjectivesBound && mechanicalChecksClean) {
+  const codeReviewRulingsBound = isBoundToRulings(codeReview, input.rulingOrdinal);
+  const securityRulingsBound = isBoundToRulings(security, input.rulingOrdinal);
+  if (codeReviewClean && codeReviewBound && codeReviewObjectivesBound && codeReviewRulingsBound && securityClean && securityBound && securityObjectivesBound && securityRulingsBound && mechanicalChecksClean) {
     return {
       verdict: "pass",
       reason: `code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS, both covering head ${input.headSha}, and every reported mechanical check is green.`,
@@ -3717,6 +3783,8 @@ function checkReviewGate(input) {
     problems.push(`the newest code-review verdict covers ${codeReview.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
   } else if (!codeReviewObjectivesBound) {
     problems.push(`the newest code-review verdict was cast against objectives version ${codeReview.objectivesVersion ?? "none"}, the Issue's list is now ${input.objectivesVersion}`);
+  } else if (!codeReviewRulingsBound) {
+    problems.push(`the newest code-review verdict was cast against ruling ordinal ${codeReview.rulingOrdinal ?? "none"}, a newer ruling (ruling ${input.rulingOrdinal}) is now posted on this PR`);
   }
   if (!securityClean) {
     problems.push(`security-review verdict is not a clean PASS (found: ${security.value})`);
@@ -3724,6 +3792,8 @@ function checkReviewGate(input) {
     problems.push(`the newest security-review verdict covers ${security.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
   } else if (!securityObjectivesBound) {
     problems.push(`the newest security-review verdict was cast against objectives version ${security.objectivesVersion ?? "none"}, the Issue's list is now ${input.objectivesVersion}`);
+  } else if (!securityRulingsBound) {
+    problems.push(`the newest security-review verdict was cast against ruling ordinal ${security.rulingOrdinal ?? "none"}, a newer ruling (ruling ${input.rulingOrdinal}) is now posted on this PR`);
   }
   if (!mechanicalChecksClean) {
     problems.push(reportedMechanicalChecks.length === 0 ? "no mechanical checks have reported for this head yet" : `mechanical check(s) not green: ${reportedMechanicalChecks.filter((c) => c.bucket !== "pass").map((c) => `${c.name} (${c.bucket})`).join(", ")}`);
@@ -3740,6 +3810,24 @@ var DEFAULT_RELEASE_ACTOR = "github-actions[bot]";
 function isChangesetsReleasePr(branch, author, expectedAuthor) {
   return branch === CHANGESET_RELEASE_BRANCH && author === expectedAuthor;
 }
+// ../../packages/aeg-core/src/ruling-ordinal.ts
+var RULING_MARKER_ORDINAL = /^<!-- aeg:principal:ruling:\d+-(\d+) -->$/;
+function newestPrincipalRulingOrdinal(comments, allowlist) {
+  let best = 0;
+  for (const c of comments) {
+    if (!isPrincipal(c.author, allowlist))
+      continue;
+    const firstLine = (c.body.split(`
+`)[0] ?? "").trim();
+    const m = RULING_MARKER_ORDINAL.exec(firstLine);
+    if (!m)
+      continue;
+    const k = Number.parseInt(m[1], 10);
+    if (k > best)
+      best = k;
+  }
+  return best;
+}
 // ../../packages/aeg-core/src/markdown-table.ts
 function splitRow(line) {
   const trimmed = line.trim().replace(/^\|/, "").replace(/\|$/, "");
@@ -4974,6 +5062,478 @@ var ForgeWriteEventSchema = z.discriminatedUnion("event", [
   z.object({ ...forgeWriteShared, event: z.literal("written"), comment_ids: z.array(z.string()) }).strict()
 ]);
 var LogEventSchema = z.union([DispatchEventSchema, DevReviewLoopEventSchema, ForgeWriteEventSchema]);
+// src/checks/registry.ts
+import { existsSync as existsSync2 } from "node:fs";
+import { join as join2 } from "node:path";
+
+// src/lib/package-root.ts
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+function packageRoot(moduleUrl) {
+  let dir = dirname(fileURLToPath(moduleUrl));
+  while (!existsSync(join(dir, "package.json"))) {
+    if (existsSync(join(dir, ".git")))
+      break;
+    const parent = dirname(dir);
+    if (parent === dir)
+      break;
+    dir = parent;
+  }
+  return dir;
+}
+
+// src/checks/registry.ts
+var DIST_BIN_DIR = join2(packageRoot(import.meta.url), "dist", "checks", "bin");
+var SRC_BIN_DIR = join2(packageRoot(import.meta.url), "src", "checks", "bin");
+var BIN_DIR = existsSync2(DIST_BIN_DIR) ? DIST_BIN_DIR : SRC_BIN_DIR;
+var BIN_EXT = BIN_DIR === DIST_BIN_DIR ? ".js" : ".ts";
+function bin(name) {
+  return join2(BIN_DIR, `${name}${BIN_EXT}`);
+}
+var REGISTRY = [
+  [
+    {
+      name: "brief-shape",
+      run: bin("check-brief-shape"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {
+        PR_BODY: { optional: true },
+        BRANCH: { optional: true },
+        PR_NUMBER: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "pr-report-density",
+      run: bin("check-pr-report-density"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {
+        PR_BODY: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "doc-coverage",
+      run: bin("check-doc-coverage"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {
+        BASE_SHA: { optional: true },
+        PR_BODY: { optional: true },
+        PR_BODY_FILE: { optional: true },
+        PR_NUMBER: { optional: true },
+        GITHUB_REPOSITORY: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "coherence",
+      run: bin("check-coherence"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: {
+        AEG_REPO: { optional: true },
+        BRANCH: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "pr-premise-reassert",
+      run: bin("check-pr-premise-reassert"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {
+        PR_BODY: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "dispatch-readiness",
+      run: bin("check-dispatch-readiness"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: {
+        AEG_REPO: { optional: true },
+        BRANCH: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true },
+        PREMISE_FILE: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "closes-n",
+      run: bin("check-closes-n"),
+      scope: "diff",
+      timeoutMs: 15000,
+      requiresOpenPr: true,
+      env: {
+        BRANCH: { optional: true },
+        PR_BODY: { optional: true },
+        AEG_REPO: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    1
+  ],
+  [
+    {
+      name: "single-plan-pr",
+      run: bin("check-single-plan-pr"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {
+        BASE_SHA: { optional: true },
+        PR_NUMBER: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "surface-scope",
+      run: bin("check-surface-scope"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {
+        AEG_REPO: { optional: true },
+        BASE_SHA: { optional: true },
+        BRANCH: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "test-plan",
+      run: bin("check-test-plan"),
+      scope: "diff",
+      timeoutMs: 15000,
+      requiresOpenPr: true,
+      env: {
+        PR_BODY: { optional: true },
+        BRANCH: { optional: true }
+      }
+    },
+    1
+  ],
+  [
+    {
+      name: "body-bare-digits",
+      run: bin("check-body-bare-digits"),
+      scope: "diff",
+      timeoutMs: 15000,
+      requiresOpenPr: true,
+      ownWorkflow: true,
+      env: {
+        PR_BODY: { optional: true },
+        PR_NUMBER: { optional: true },
+        GITHUB_REPOSITORY: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    1
+  ],
+  [
+    {
+      name: "token-report",
+      run: bin("check-token-report"),
+      scope: "diff",
+      timeoutMs: 15000,
+      requiresOpenPr: true,
+      env: {
+        PR_BODY: { optional: true },
+        BRANCH: { optional: true },
+        CLAUDE_PROJECT_DIR: { optional: true },
+        CLAUDE_CODE_SESSION_ID: { optional: true }
+      }
+    },
+    1
+  ],
+  [
+    {
+      name: "no-disk-state",
+      run: bin("check-no-disk-state"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: { BASE_SHA: { optional: true } }
+    },
+    0
+  ],
+  [
+    {
+      name: "registry-gates",
+      run: bin("check-registry-gates"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: {
+        AEG_REPO: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "review-gate",
+      run: bin("check-review-gate"),
+      scope: "full",
+      timeoutMs: 30000,
+      ownWorkflow: true,
+      env: {
+        PR_NUMBER: { optional: true },
+        GITHUB_REPOSITORY: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    1
+  ],
+  [
+    {
+      name: "branch-topology",
+      run: bin("check-branch-topology"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: {
+        BRANCH: { optional: true },
+        AEG_REPO: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "dead-branch-push",
+      run: bin("check-dead-branch-push"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: {
+        BRANCH: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "first-push-dispatch",
+      run: bin("check-first-push-dispatch"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: {
+        BRANCH: { optional: true },
+        AEG_REPO: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "doc-coverage-push",
+      run: bin("check-doc-coverage-push"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {
+        OVERRIDE_DOCS: { optional: true },
+        BASE_SHA: { optional: true },
+        PR_BODY: { optional: true },
+        PR_BODY_FILE: { optional: true },
+        PR_LABELS: { optional: true },
+        WAIVER_LABEL_ACTOR: { optional: true },
+        GITHUB_REPOSITORY: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "issue-assignment",
+      run: bin("check-issue-assignment"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: {
+        AEG_REPO: { optional: true },
+        BRANCH: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "evidence-fresh",
+      run: bin("check-evidence-fresh"),
+      scope: "diff",
+      timeoutMs: 15000,
+      requiresOpenPr: true,
+      env: {
+        PR_NUMBER: { optional: true },
+        PR_BODY: { optional: true },
+        BASE_SHA: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    1
+  ],
+  [
+    {
+      name: "reader-resolvable-prose",
+      run: bin("check-reader-resolvable-prose"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: {},
+      include: [
+        "aeg-root/**/*.md",
+        "apps/cli/src/**",
+        ".github/workflows/**",
+        ".vinaya/**",
+        "apps/cli/README.md",
+        "packages/sources/README.md"
+      ]
+    },
+    0
+  ],
+  [
+    {
+      name: "retired-vocabulary",
+      run: bin("check-retired-vocabulary"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: {},
+      include: ["aeg-root/**/*.md"]
+    },
+    0
+  ],
+  [
+    {
+      name: "doctrine-portability",
+      run: bin("check-doctrine-portability"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: { BASE_SHA: { optional: true } },
+      include: ["aeg-root/**/*.md"]
+    },
+    0
+  ],
+  [
+    {
+      name: "doctrine-no-procedures",
+      run: bin("check-doctrine-no-procedures"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: {},
+      include: ["aeg-root/**/*.md"]
+    },
+    0
+  ],
+  [
+    {
+      name: "exec-bits",
+      run: bin("check-exec-bits"),
+      scope: "diff",
+      timeoutMs: 30000,
+      env: {}
+    },
+    0
+  ],
+  [
+    {
+      name: "workspace-escape",
+      run: bin("check-workspace-escape"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: {},
+      include: ["aeg-root/**/*.md"]
+    },
+    0
+  ],
+  [
+    {
+      name: "changeset-coverage",
+      run: bin("check-changeset-coverage"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {}
+    },
+    0
+  ],
+  [
+    {
+      name: "quoted-command",
+      run: bin("check-quoted-command"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {}
+    },
+    0
+  ],
+  [
+    {
+      name: "main-branch-refusal",
+      run: bin("check-main-branch-refusal"),
+      scope: "full",
+      timeoutMs: 15000,
+      env: { VINAYA_PUSH_REFS: { optional: true } }
+    },
+    0
+  ],
+  [
+    {
+      name: "token-collection-wired",
+      run: bin("check-token-collection-wired"),
+      scope: "full",
+      timeoutMs: 15000,
+      env: {
+        CLAUDE_PROJECT_DIR: { optional: true },
+        CLAUDE_CODE_SESSION_ID: { optional: true }
+      }
+    },
+    0
+  ]
+];
+function coreCheckRegistry() {
+  return REGISTRY.map(([spec]) => spec);
+}
+var CORE_CHECK_RING = Object.fromEntries(REGISTRY.map(([spec, ring]) => [spec.name, ring]));
+
 // src/checks/contract.ts
 var CHECK_SCHEMA_VERSION = 1;
 function emitCheckError(error) {
@@ -5001,8 +5561,8 @@ function summariseNumstat(numstat) {
     deleted += Number(d) || 0;
   }
   const files = `${rows.length} file${rows.length === 1 ? "" : "s"} changed`;
-  const bin = binary > 0 ? `, ${binary} binary` : "";
-  return `${files}, ${added} insertion${added === 1 ? "" : "s"}(+), ${deleted} deletion${deleted === 1 ? "" : "s"}(-)${bin}`;
+  const bin2 = binary > 0 ? `, ${binary} binary` : "";
+  return `${files}, ${added} insertion${added === 1 ? "" : "s"}(+), ${deleted} deletion${deleted === 1 ? "" : "s"}(-)${bin2}`;
 }
 var EVIDENCE_SUMMARY_PREFIX = "Summary: ";
 
@@ -5059,28 +5619,11 @@ function summaryLineIndex(maskedRegion) {
   return index === -1 ? null : index;
 }
 
-// src/lib/package-root.ts
-import { existsSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-function packageRoot(moduleUrl) {
-  let dir = dirname(fileURLToPath(moduleUrl));
-  while (!existsSync(join(dir, "package.json"))) {
-    if (existsSync(join(dir, ".git")))
-      break;
-    const parent = dirname(dir);
-    if (parent === dir)
-      break;
-    dir = parent;
-  }
-  return dir;
-}
-
 // src/lib/config.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, realpathSync, writeFileSync } from "node:fs";
+import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync2, realpathSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname as dirname2, join as join2, resolve } from "node:path";
+import { dirname as dirname2, join as join3, resolve } from "node:path";
 import { z as z2 } from "zod";
 
 // src/lib/agent-vendors.ts
@@ -5234,16 +5777,16 @@ var VinayaConfigSchema = z2.object({
     agent: z2.enum(["claude", "codex", "gemini"]).optional()
   }).optional()
 });
-var GLOBAL_VINAYA_HOME = join2(homedir(), ".vinaya");
-var GLOBAL_CONFIG_PATH = join2(GLOBAL_VINAYA_HOME, "config.json");
+var GLOBAL_VINAYA_HOME = join3(homedir(), ".vinaya");
+var GLOBAL_CONFIG_PATH = join3(GLOBAL_VINAYA_HOME, "config.json");
 var LOCAL_CONFIG_FILENAME = "vinaya.config.json";
 function findLocalConfig() {
   let dir = process.cwd();
   while (true) {
-    const candidate = join2(dir, LOCAL_CONFIG_FILENAME);
-    if (existsSync2(candidate))
+    const candidate = join3(dir, LOCAL_CONFIG_FILENAME);
+    if (existsSync3(candidate))
       return candidate;
-    if (existsSync2(join2(dir, ".git")))
+    if (existsSync3(join3(dir, ".git")))
       return null;
     const parent = dirname2(dir);
     if (parent === dir)
@@ -5255,7 +5798,7 @@ function configPath() {
   const local = findLocalConfig();
   if (local)
     return local;
-  if (existsSync2(GLOBAL_CONFIG_PATH))
+  if (existsSync3(GLOBAL_CONFIG_PATH))
     return GLOBAL_CONFIG_PATH;
   return null;
 }
@@ -5383,7 +5926,7 @@ function loadConfig() {
     return null;
   }
 }
-var TOKENS_COLLECT_TRUST_PATH = join2(GLOBAL_VINAYA_HOME, "tokens-collect-trust.json");
+var TOKENS_COLLECT_TRUST_PATH = join3(GLOBAL_VINAYA_HOME, "tokens-collect-trust.json");
 
 // src/commands/tokens.ts
 var USAGE = [
@@ -5406,6 +5949,10 @@ var USAGE = [
 `);
 
 // src/commands/pr-report.ts
+var BODY_READING_CHECK_NAMES = new Set(coreCheckRegistry().filter((spec) => {
+  const decl = spec.env?.PR_BODY;
+  return decl === true || typeof decl === "object" && decl !== null && "optional" in decl;
+}).map((spec) => spec.name));
 var FAILING_STATUSES = new Set(["fail", "error", "timeout"]);
 function extractAgentCommandLines(prBody) {
   const located = locateTestPlanSection(prBody);
@@ -5441,10 +5988,36 @@ var TOKEN_ROW_REMEDY = [
 `);
 var USAGE2 = "Usage: vinaya pr report [--write <body-file> | --push <pr>] [--phase <phase>] [--role <role>] " + "[--model <id>] [--transcript <path>]";
 
+// src/lib/patch-id.ts
+import { execFileSync as execFileSync3 } from "node:child_process";
+function patchIdAt(base, sha) {
+  try {
+    execFileSync3("git", ["fetch", "--quiet", "origin", sha], { stdio: ["ignore", "ignore", "ignore"] });
+  } catch {}
+  try {
+    const diff = execFileSync3("git", ["diff", `origin/${base}...${sha}`], {
+      encoding: "utf8",
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    if (diff === "")
+      return null;
+    const out = execFileSync3("git", ["patch-id", "--stable"], {
+      input: diff,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+    const id = out.split(/\s+/)[0] ?? "";
+    return id === "" ? null : id;
+  } catch {
+    return null;
+  }
+}
+
 // src/checks/evidence-fresh-logic.ts
 var HEAD_LINE = /^Head:\s*([0-9a-f]{7,40})\s*$/m;
 var FENCE = /```[^\n]*\n?([\s\S]*?)```/g;
-function compareEvidenceBlock(resolved, resolvedHead, actualNumstat, expectedGroupCCommandLines) {
+function compareEvidenceBlock(resolved, resolvedHead, actualNumstat, expectedGroupCCommandLines, patchIdOf) {
   const region = resolved.region;
   const headMatch = region.match(HEAD_LINE);
   const fences = [...region.matchAll(FENCE)].map((m) => (m[1] ?? "").trim());
@@ -5461,7 +6034,16 @@ function compareEvidenceBlock(resolved, resolvedHead, actualNumstat, expectedGro
   const actual = actualNumstat.trim();
   const errors = [];
   if (storedHead !== resolvedHead) {
-    errors.push(`evidence-fresh: Group B is stale — the block's Head (${storedHead}) does not match the PR's real head (${resolvedHead}). Re-run `.concat("`vinaya pr report --write` against the current head, commit, and push again."));
+    let samePatch = false;
+    if (patchIdOf) {
+      const storedPatchId = patchIdOf(storedHead);
+      const resolvedPatchId = patchIdOf(resolvedHead);
+      samePatch = storedPatchId !== null && resolvedPatchId !== null && storedPatchId === resolvedPatchId;
+    }
+    if (!samePatch) {
+      const patchNote = patchIdOf ? ", and the patch changed" : "";
+      errors.push(`evidence-fresh: Group B is stale — the block's Head (${storedHead}) does not match the PR's real head (${resolvedHead})${patchNote}. Re-run \`vinaya pr report --write\` against the current head, commit, and push again.`);
+    }
   }
   if (storedNumstat !== actual) {
     errors.push([
@@ -5519,7 +6101,7 @@ function compareEvidenceBlock(resolved, resolvedHead, actualNumstat, expectedGro
 var CHECK_NAME = "evidence-fresh";
 function git(args) {
   try {
-    return execFileSync3("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync4("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch {
     return "";
   }
@@ -5538,7 +6120,7 @@ class GitCommandError extends Error {
 }
 function gitStrict(args) {
   try {
-    return execFileSync3("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync4("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (err) {
     const stderr = err.stderr;
     throw new GitCommandError(args, String(stderr ?? err.message).trim() || "non-zero exit");
@@ -5554,13 +6136,16 @@ function resolveMergeBase(head) {
   }
   throw new UnresolvableMergeBaseError(tried);
 }
-function fetchHeadSha(prNumber) {
+function fetchPrRefs(prNumber) {
   try {
-    const out = execFileSync3("gh", ["pr", "view", String(prNumber), "--json", "headRefOid", "-q", ".headRefOid"], {
+    const out = execFileSync4("gh", ["pr", "view", String(prNumber), "--json", "headRefOid,baseRefName"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
-    }).trim();
-    return out || null;
+    });
+    const parsed = JSON.parse(out);
+    if (!parsed.headRefOid || !parsed.baseRefName)
+      return null;
+    return { head: parsed.headRefOid, base: parsed.baseRefName };
   } catch {
     return null;
   }
@@ -5588,17 +6173,18 @@ function main() {
   if (!prNumberStr) {
     process.exit(0);
   }
-  const resolvedHead = fetchHeadSha(Number(prNumberStr));
-  if (resolvedHead === null) {
+  const prRefs = fetchPrRefs(Number(prNumberStr));
+  if (prRefs === null) {
     emitCheckError({
       schema: CHECK_SCHEMA_VERSION,
       check: CHECK_NAME,
       severity: "error",
-      message: `evidence-fresh: could not resolve PR #${prNumberStr}'s head via \`gh pr view --json headRefOid\`.`,
+      message: `evidence-fresh: could not resolve PR #${prNumberStr}'s head and base via \`gh pr view --json headRefOid,baseRefName\`.`,
       agent_recovery_prompt: "Confirm `gh auth status` passes and PR_NUMBER is correct, then re-run `vinaya check evidence-fresh`."
     });
     process.exit(1);
   }
+  const resolvedHead = prRefs.head;
   let base;
   let actualNumstat;
   try {
@@ -5615,7 +6201,8 @@ function main() {
     process.exit(1);
   }
   const expectedGroupCCommandLines = extractAgentCommandLines(body).map(agentCommandText);
-  const result = compareEvidenceBlock(resolved, resolvedHead, actualNumstat, expectedGroupCCommandLines);
+  const patchIdOf = (sha) => patchIdAt(prRefs.base, sha);
+  const result = compareEvidenceBlock(resolved, resolvedHead, actualNumstat, expectedGroupCCommandLines, patchIdOf);
   if (result.status === "fail") {
     for (const message of result.errors) {
       emitCheckError({