@attalabs/vinaya 0.26.0 → 0.28.0

package/dist/checks/bin/check-doctrine-no-procedures.js

@@ -304,7 +304,7 @@ function issueListByLabelArgs(owner, repo, label) {
     "--state",
     "all",
     "--json",
-    "number,title,body,state,labels,milestone",
+    "number,title,body,state,labels,milestone,stateReason",
     "--limit",
     "200"
   ];
@@ -650,14 +650,19 @@ function resolveTaskIssueRef(title, labels) {
 var INTENTS_HEADING = /^#{1,6}\s*Tranche intents\s*$/im;
 var NEXT_HEADING = /^#{1,6}\s+\S/m;
 var INTENT_BULLET = /^-\s+([a-z0-9][a-z0-9-]*)\s*:\s*(.+)$/i;
-function intentGoalForSlug(description, slug) {
-  const text = stripCode(description, { inlineSpans: "keep" });
+function intentsSection(text) {
   const start = text.match(INTENTS_HEADING);
   if (!start || start.index === undefined)
-    return "";
+    return null;
   const rest = text.slice(start.index + start[0].length);
   const next = rest.match(NEXT_HEADING);
-  const section = rest.slice(0, next && next.index !== undefined ? next.index : rest.length);
+  return rest.slice(0, next && next.index !== undefined ? next.index : rest.length);
+}
+function intentGoalForSlug(description, slug) {
+  const text = stripCode(description, { inlineSpans: "keep" });
+  const section = intentsSection(text);
+  if (section === null)
+    return "";
   for (const line of section.split(`
 `)) {
     const trimmed = line.trim();
@@ -1949,6 +1954,9 @@ function parseInlineFieldList(section) {
 // ../../packages/aeg-core/src/verdict-extraction.ts
 var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
 var OBJECTIVES_VERSION_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Objectives version:\s*([0-9a-f]{64})(?![A-Za-z0-9])/im;
+var RULING_ORDINAL_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Ruling ordinal:\s*(\d+)(?!\d)/im;
+var BRIEF_HASH_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Brief hash:\s*([0-9a-f]{64})(?![A-Za-z0-9])/im;
+var POLICY_DIGEST_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Policy digest:\s*([0-9a-f]{64})(?![A-Za-z0-9])/im;
 function firstFiveLines(comment) {
   return comment.split(`
 `).slice(0, 5).join(`
@@ -1962,6 +1970,35 @@ function extractObjectivesVersion(comment) {
   const m = firstFiveLines(comment).match(OBJECTIVES_VERSION_PATTERN);
   return m ? m[1].toLowerCase() : null;
 }
+function firstSevenLines(comment) {
+  return comment.split(`
+`).slice(0, 7).join(`
+`);
+}
+function extractRulingOrdinal(comment) {
+  const m = firstSevenLines(comment).match(RULING_ORDINAL_PATTERN);
+  return m ? Number.parseInt(m[1], 10) : null;
+}
+function firstElevenLines(comment) {
+  return comment.split(`
+`).slice(0, 11).join(`
+`);
+}
+function extractBriefHash(comment) {
+  const m = firstElevenLines(comment).match(BRIEF_HASH_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
+function extractPolicyDigest(comment) {
+  const m = firstElevenLines(comment).match(POLICY_DIGEST_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
+var FINDING_SEVERITY_LINE = /^\d+\.\s+\[([A-Z][A-Z]*)\]\s+(.+?)\s+—/gm;
+function extractFindingSeverities(comment) {
+  return [...comment.matchAll(FINDING_SEVERITY_LINE)].map((m) => ({
+    severity: m[1],
+    location: m[2]
+  }));
+}
 function extractVerdict(comments, valuePattern, missingLabel) {
   const candidates = comments.filter((c) => valuePattern.test(c));
   if (candidates.length === 0) {
@@ -1969,6 +2006,10 @@ function extractVerdict(comments, valuePattern, missingLabel) {
       value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
       headSha: null,
       objectivesVersion: null,
+      rulingOrdinal: null,
+      briefHash: null,
+      policyDigest: null,
+      findingSeverities: [],
       danglingNote: `no ${missingLabel} verdict comment found on this PR`
     };
   }
@@ -1979,6 +2020,10 @@ function extractVerdict(comments, valuePattern, missingLabel) {
       value: `the most recent ${missingLabel} comment's VERDICT line is not within its first five lines — DANGLING, see below`,
       headSha: null,
       objectivesVersion: null,
+      rulingOrdinal: null,
+      briefHash: null,
+      policyDigest: null,
+      findingSeverities: [],
       danglingNote: `the most recent ${missingLabel} verdict comment carries a VERDICT-shaped line outside the first-five-line read window`
     };
   }
@@ -1986,6 +2031,10 @@ function extractVerdict(comments, valuePattern, missingLabel) {
     value: m[1].toUpperCase().replace(/[_-]/g, " "),
     headSha: extractHeadSha(latest),
     objectivesVersion: extractObjectivesVersion(latest),
+    rulingOrdinal: extractRulingOrdinal(latest),
+    briefHash: extractBriefHash(latest),
+    policyDigest: extractPolicyDigest(latest),
+    findingSeverities: extractFindingSeverities(latest),
     danglingNote: null
   };
 }
@@ -2321,6 +2370,53 @@ function evaluateC5(changed, docOwnersContent, prBody, fileExists, waiverActive,
   }
   return out;
 }
+// ../../packages/aeg-core/src/review-policy.ts
+var CODE_REVIEW_SEVERITY_ORDER = ["BLOCKER", "MAJOR", "MINOR"];
+var SECURITY_SEVERITY_ORDER = ["CRITICAL", "HIGH", "MEDIUM", "LOW"];
+var DEFAULT_MAX_ROUNDS = 3;
+var DEFAULT_REVIEW_POLICY = {
+  codeReviewThreshold: "BLOCKER",
+  securityThreshold: "HIGH",
+  maxRounds: DEFAULT_MAX_ROUNDS
+};
+var FILE_SHAPED_LOCATION = /\.[a-zA-Z0-9]{1,10}(:\d+)?\s*$/;
+var PROSE_LOCATION_PATTERNS = [/\bpr\s*body\b/i, /\bcomment\b/i];
+var ROLE_FILE_LOCATION = /(^|\/)aeg-root\/roles\//i;
+function isProseLocation(location) {
+  if (ROLE_FILE_LOCATION.test(location))
+    return true;
+  if (FILE_SHAPED_LOCATION.test(location))
+    return false;
+  return PROSE_LOCATION_PATTERNS.some((pattern) => pattern.test(location));
+}
+var PROSE_CAP_SEVERITY = "MINOR";
+function blockingSeverities(scale, threshold) {
+  const idx = scale.indexOf(threshold);
+  if (idx === -1) {
+    throw new Error(`blockingSeverities: threshold "${threshold}" is not one of ${scale.join(" > ")}`);
+  }
+  return scale.slice(0, idx + 1);
+}
+function evaluateReviewFindings(findings, scale, threshold) {
+  const blocking = new Set(blockingSeverities(scale, threshold));
+  const blockingFindings = findings.filter((f) => {
+    if (!scale.includes(f.severity)) {
+      throw new Error(`evaluateReviewFindings: severity "${f.severity}" is not one of ${scale.join(" > ")}`);
+    }
+    const effectiveSeverity = f.location !== undefined && isProseLocation(f.location) ? PROSE_CAP_SEVERITY : f.severity;
+    return blocking.has(effectiveSeverity);
+  });
+  return { outcome: blockingFindings.length > 0 ? "blocked" : "clean", blockingFindings };
+}
+function evaluateCodeReview(findings, policy) {
+  return evaluateReviewFindings(findings, CODE_REVIEW_SEVERITY_ORDER, policy.codeReviewThreshold);
+}
+function evaluateSecurityReview(findings, policy) {
+  return evaluateReviewFindings(findings, SECURITY_SEVERITY_ORDER, policy.securityThreshold);
+}
+function isKnownSeverity(scale, value) {
+  return scale.includes(value);
+}
 // ../../packages/aeg-core/src/pr-tier.ts
 var TIER_FIELD = /(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i;
 function readTierFromPrBody(prBody) {
@@ -2347,6 +2443,9 @@ import { createHash as createHash2 } from "node:crypto";
 var HEADING_RE = /^##[ \t]*Objectives[ \t]*$/im;
 var NEXT_HEADING_RE = /^##[ \t]/m;
 var OBJECTIVE_LINE_RE = /^O(\d+)\.[ \t]*(.*)$/;
+function maskedForHeadingSearch(body) {
+  return maskDetailsBlocks(maskCode(body));
+}
 function hasBacktickedPath(text) {
   let i = 0;
   while (i < text.length) {
@@ -2369,16 +2468,22 @@ function stripObjectiveBackticks(text) {
 function wordCount(text) {
   return text.split(/\s+/).filter((w) => /[a-z]/i.test(w)).length;
 }
-function objectivesSectionText(body) {
-  const heading = HEADING_RE.exec(body);
+function objectivesSectionBounds(body) {
+  const masked = maskedForHeadingSearch(body);
+  const heading = HEADING_RE.exec(masked);
   if (!heading)
     return null;
-  const afterHeading = body.slice(heading.index + heading[0].length);
+  const start = heading.index + heading[0].length;
+  const afterHeading = masked.slice(start);
   const next = NEXT_HEADING_RE.exec(afterHeading);
-  return next ? afterHeading.slice(0, next.index) : afterHeading;
+  return { start, end: next ? start + next.index : body.length };
+}
+function objectivesSectionText(body) {
+  const bounds = objectivesSectionBounds(body);
+  return bounds === null ? null : body.slice(bounds.start, bounds.end);
 }
 function hasObjectivesHeading(body) {
-  return HEADING_RE.test(body);
+  return HEADING_RE.test(maskedForHeadingSearch(body));
 }
 function objectivesOf(body) {
   const section = objectivesSectionText(body);
@@ -2438,6 +2543,15 @@ function isIssueNotFoundError(err) {
 `);
   return /could not resolve to an (?:issue|pull request)|\b404\b|not found/i.test(haystack);
 }
+function resolveObjectivesSource(prBody, issue, cutoverIssue) {
+  if (issue !== null && issue < cutoverIssue)
+    return { kind: "none" };
+  if (issue !== null)
+    return { kind: "issue", issue };
+  if (hasObjectivesHeading(prBody))
+    return { kind: "body" };
+  return { kind: "none" };
+}
 
 // ../../packages/aeg-core/src/premise-check.ts
 import { createHash as createHash3 } from "node:crypto";
@@ -2673,7 +2787,7 @@ function checkForField(prBody) {
     ]
   };
 }
-function checkClosesN(prBody) {
+function checkClosesNPresence(prBody) {
   const closesPattern = /(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s{0,8}:?\s{0,8}#\d+/i;
   if (closesPattern.test(stripCode(prBody))) {
     return { status: "pass", errors: [] };
@@ -2705,10 +2819,22 @@ var COMMIT_TYPES = [
   "Test"
 ];
 var COMMIT_TYPE_STYLE = new RegExp(`^(${COMMIT_TYPES.join("|")})(\\([a-z0-9-]+\\))?: \\S`);
+function checkForgeTitle(title) {
+  const taskStyle = /^\[[a-z0-9._-]+\] \S+ — \S/;
+  if (COMMIT_TYPE_STYLE.test(title) || taskStyle.test(title))
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      `brief-validation title: "${title}" matches neither title grammar — expected \`Type: description\` / \`Type(scope): description\` (commitlint types + Plan) or \`[tranche] id — description\` (task form).`
+    ]
+  };
+}
 var BRIEF_SHAPE_MARKERS = [checkSurfaceMap, checkDocUpdateList, checkStopConditions, checkAutonomyClause];
 var TASK_BRANCH_PATTERN = /^task\/[^/]+\/[^/]+$/;
+var TASK_ISSUE_BRANCH_PATTERN = /^task\/issue-\d+$/;
 function isTaskBranch(branch) {
-  return TASK_BRANCH_PATTERN.test(branch);
+  return TASK_BRANCH_PATTERN.test(branch) || TASK_ISSUE_BRANCH_PATTERN.test(branch);
 }
 function isBriefShaped(prBody) {
   const stripped = stripCode(prBody);
@@ -2830,8 +2956,9 @@ function packagesNamedIn(text) {
 }
 function hasTestPathForConsumer(text, consumerDir) {
   const escaped = consumerDir.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const re = new RegExp(`${escaped}\\/[\\w./-]*\\.test\\.[A-Za-z0-9]+`);
-  return re.test(text);
+  const filePathRe = new RegExp(`${escaped}\\/[\\w./-]*\\.test\\.[A-Za-z0-9]+`);
+  const testDirRe = new RegExp(`${escaped}\\/(?:[\\w-]+\\/)*(?:tests|specs)(?:\\/|\\b)`);
+  return filePathRe.test(text) || testDirRe.test(text);
 }
 function checkConsumerTests(prBody, consumersOf) {
   const section4 = extractNumberedSection(prBody, 4);
@@ -2935,21 +3062,44 @@ function checkBriefSections(prBody, readTier, options = {}) {
     checkConsumerTests(prBody, consumersOf),
     checkDefeatCases(prBody),
     ...issueObjectives !== undefined ? [checkObjectivesCopy(prBody, issueObjectives), checkObjectivesCoverage(prBody)] : [],
-    ...requireClosesN ? [checkClosesN(prBody)] : []
+    ...requireClosesN ? [checkClosesNPresence(prBody)] : []
   ];
   return { errors: results.flatMap((r) => r.errors) };
 }
-var AEG_BRIEF_V1_MARKER = "<!-- aeg:brief:v1 -->";
-function contentAfterTwoLines(body) {
-  const first = body.indexOf(`
-`);
-  if (first === -1)
-    return "";
-  const second = body.indexOf(`
-`, first + 1);
-  if (second === -1)
-    return "";
-  return body.slice(second + 1);
+function contentAfterNLines(body, n) {
+  let idx = -1;
+  for (let i = 0;i < n; i++) {
+    idx = body.indexOf(`
+`, idx + 1);
+    if (idx === -1)
+      return "";
+  }
+  return body.slice(idx + 1);
+}
+var BRIEF_MARKER_LINE_RE = /^<!-- aeg:brief:v(\d+) -->$/;
+function parseBriefMarkerVersion(firstLine) {
+  const m = BRIEF_MARKER_LINE_RE.exec(firstLine.trim());
+  if (!m)
+    return null;
+  const version = Number.parseInt(m[1], 10);
+  return Number.isInteger(version) && version >= 1 ? version : null;
+}
+function frozenBriefContent(body, version) {
+  return contentAfterNLines(body, version === 1 ? 2 : 3);
+}
+function resolveNewestFrozenBrief(comments, allowlist) {
+  let best = null;
+  for (const c of comments) {
+    if (!isPrincipal(c.author, allowlist))
+      continue;
+    const version = parseBriefMarkerVersion(c.body.split(`
+`)[0] ?? "");
+    if (version === null)
+      continue;
+    if (best === null || version > best.version)
+      best = { ...c, version };
+  }
+  return best === null ? null : { ...best, content: frozenBriefContent(best.body, best.version) };
 }
 // ../../packages/aeg-core/src/doctrine-portability.ts
 var DEFAULT_SHIPS_PREFIX = "aeg-root/";
@@ -3202,6 +3352,28 @@ function topLevelSectionText(body, headingName) {
   const next = /^##[ \t]/m.exec(afterHeading);
   return next ? afterHeading.slice(0, next.index) : afterHeading;
 }
+function partHasBacktickedPath(text) {
+  let i = 0;
+  while (i < text.length) {
+    const start = text.indexOf("`", i);
+    if (start === -1)
+      return false;
+    const end = text.indexOf("`", start + 1);
+    if (end === -1)
+      return false;
+    if (text.slice(start + 1, end).includes("/"))
+      return true;
+    i = end + 1;
+  }
+  return false;
+}
+var PART_MIN_WORDS_OUTSIDE_BACKTICKS = 3;
+function stripPartBackticks(text) {
+  return text.replace(/`[^`\n]*`/g, " ");
+}
+function partWordCount(text) {
+  return text.split(/\s+/).filter((w) => /[a-z]/i.test(w)).length;
+}
 function looksLikeFilePath(entry2) {
   const stripped = entry2.replace(/\/\*\*?$/, "");
   const lastSegment = stripped.split("/").pop() ?? stripped;
@@ -3242,6 +3414,18 @@ function globCoversPath(glob, path) {
   const p = path.replace(/\/+$/, "");
   return g === p || g.startsWith(`${p}/`) || p.startsWith(`${g}/`);
 }
+function checkSurfaceGlobsResolve(body, resolvesToFile) {
+  const surface = parseIssueSurface(body);
+  if (!surface.ok)
+    return { status: "pass", errors: [] };
+  const errors = [];
+  for (const glob of surface.value.in) {
+    if (!resolvesToFile(glob)) {
+      errors.push(`issue-validation Surface: \`${glob}\` in \`## Surface\`'s \`in:\` list matches no tracked file — a Surface that cannot resolve cannot render a brief's file list.`);
+    }
+  }
+  return { status: errors.length > 0 ? "fail" : "pass", errors };
+}
 function checkSurfaceScope(changedFiles, outGlobs) {
   if (outGlobs.length === 0)
     return { ok: true };
@@ -3253,9 +3437,77 @@ function checkSurfaceScope(changedFiles, outGlobs) {
   }
   return violations.length > 0 ? { ok: false, violations } : { ok: true };
 }
+var ISSUE_PART_LINE_RE = /^Part\s+(\d+)\s*\(([^)]*)\)\s*[-—–]\s*(.*)$/i;
+function parseIssueParts(body) {
+  const section = topLevelSectionText(body, "Parts");
+  if (section === null)
+    return { ok: false, errors: ["no `## Parts` heading found in the body."] };
+  const lines = section.split(/\r?\n/).map((l) => l.trim()).filter((l) => l.length > 0);
+  const parts = [];
+  const errors = [];
+  for (const line of lines) {
+    const m = ISSUE_PART_LINE_RE.exec(line);
+    if (!m) {
+      errors.push(`"${line}" is not a well-formed Parts line — expected \`Part <n> (<refs>) — <outcome>\`.`);
+      continue;
+    }
+    const n = Number.parseInt(m[1], 10);
+    const refs = m[2];
+    const text = m[3].trim();
+    if (text.length === 0) {
+      errors.push(`Part ${n} has no outcome text after the dash — every Part states one observable outcome.`);
+      continue;
+    }
+    if (partHasBacktickedPath(text) && partWordCount(stripPartBackticks(text)) < PART_MIN_WORDS_OUTSIDE_BACKTICKS) {
+      errors.push(`Part ${n} is little more than a file path — a Part names an outcome and symbols, never a bare path.`);
+      continue;
+    }
+    const objectiveIds = [...refs.matchAll(/O(\d+)/g)].map((r) => Number.parseInt(r[1], 10));
+    parts.push({ n, objectiveIds, text });
+  }
+  if (parts.length === 0) {
+    errors.push("the `## Parts` section has no well-formed `Part <n> (<refs>) — <outcome>` lines.");
+  }
+  if (errors.length > 0)
+    return { ok: false, errors };
+  return { ok: true, value: parts };
+}
+function checkPartsCiteDefinedObjectives(body) {
+  const parts = parseIssueParts(body);
+  const objectives = objectivesOf(body);
+  if (!parts.ok || !objectives.ok)
+    return { status: "pass", errors: [] };
+  const definedIds = new Set(objectives.objectives.map((o) => Number.parseInt(o.id.slice(1), 10)));
+  const errors = [];
+  for (const part of parts.value) {
+    for (const objectiveId of part.objectiveIds) {
+      if (!definedIds.has(objectiveId)) {
+        errors.push(`issue-validation Parts: Part ${part.n} cites O${objectiveId}, which the Issue's own \`## Objectives\` section does not define.`);
+      }
+    }
+  }
+  return { status: errors.length > 0 ? "fail" : "pass", errors };
+}
 function isTaskIssueLabelSet(labels) {
   return hasLabel("tranche", labels);
 }
+function checkTrancheLabelPresence(_body, _labels) {
+  return { status: "pass", errors: [] };
+}
+function checkMilestoneAttach(labels, currentMilestoneTitle, resolvedMilestoneTitle) {
+  if (!isTaskIssueLabelSet(labels))
+    return { status: "pass", errors: [] };
+  if (resolvedMilestoneTitle === null)
+    return { status: "pass", errors: [] };
+  if (currentMilestoneTitle === resolvedMilestoneTitle)
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      `issue-validation milestone attach: this task Issue's tranche label resolves to Milestone "${resolvedMilestoneTitle}", but its live Milestone is ${currentMilestoneTitle === null ? "unset" : `"${currentMilestoneTitle}"`} — attach it to "${resolvedMilestoneTitle}".`
+    ]
+  };
+}
 var TYPE_LABEL_IDS = LABELS.filter((l) => l.category === "type").map((l) => l.id);
 function isControlCodePoint(codePoint) {
   return codePoint <= 31 || codePoint >= 127 && codePoint <= 159;
@@ -3320,6 +3572,19 @@ function checkProjectsRegistered(body, _labels, registeredNames) {
 var DOC_PATH_RE = /(?:(?:aeg-root|apps|packages|specs|docs|tools|\.claude|\.github)\/[\w./@-]*\.(?:md|mdx)|\.claude\/(?:skills|rules)\/[\w./-]+|\b(?:docs-index|decisions|projects|state-machine|enforcement|process|README|CLAUDE)\.md\b|\b[\w-]+-(?:spec|decisions|backlog)\.md\b)/i;
 var DOC_PATH_RE_GLOBAL = new RegExp(DOC_PATH_RE.source, "gi");
 
+// ../../packages/aeg-core/src/task-branch-identity.ts
+var ISSUE_BRANCH_PATTERN = /^task\/issue-(\d+)$/;
+var TRANCHE_BRANCH_PATTERN = /^task\/([^/]+)\/([^/]+)$/;
+function parseTaskBranchIdentity(branch) {
+  const issueMatch = ISSUE_BRANCH_PATTERN.exec(branch);
+  if (issueMatch)
+    return { kind: "issue", issueNumber: Number(issueMatch[1]) };
+  const trancheMatch = TRANCHE_BRANCH_PATTERN.exec(branch);
+  if (trancheMatch)
+    return { kind: "tranche", tranche: trancheMatch[1], taskId: trancheMatch[2] };
+  return null;
+}
+
 // ../../packages/aeg-core/src/coherence-checks.ts
 var COHERENCE_ENFORCED_FROM = "2026-07-01";
 function isGrandfathered(isoDate) {
@@ -3340,6 +3605,7 @@ function checkA1(entries, principalAllowlist = PRINCIPAL_ALLOWLIST) {
       if (handClosed)
         continue;
       failures.push({
+        code: "closed-without-merge",
         issue: e.task.issue,
         tranche: e.trancheSlug,
         task: e.task.id,
@@ -3364,6 +3630,7 @@ function checkA3(entries) {
       continue;
     if (e.facts.prState === "merged" && e.facts.issueState !== "closed") {
       failures.push({
+        code: "auto-close-misfire",
         issue: e.task.issue,
         tranche: e.trancheSlug,
         task: e.task.id,
@@ -3388,6 +3655,7 @@ function checkT1(entries) {
       continue;
     if (e.facts === undefined) {
       failures.push({
+        code: "phantom-issue-ref",
         issue: e.task.issue,
         tranche: e.trancheSlug,
         task: e.task.id,
@@ -3406,6 +3674,7 @@ function checkT2(openIssuesBySlug, topologyIssuesBySlug, ciTrancheSlug) {
     for (const num of openNums) {
       if (!topologySet.has(num)) {
         failures.push({
+          code: "orphan-task",
           issue: num,
           tranche: slug,
           reason: `Issue #${num} is open and labeled ${trancheLabel(slug)} but does not appear in the topology file`
@@ -3440,6 +3709,7 @@ function checkT3(entries, ciTrancheSlug, enrichedEntries, forgeUnavailableSlugs)
         continue;
       if (forgeUnavailableSlugs?.has(e.trancheSlug)) {
         failures.push({
+          code: "tbd-in-active-tranche",
           issue: null,
           tranche: e.trancheSlug,
           task: e.task.id,
@@ -3449,6 +3719,7 @@ function checkT3(entries, ciTrancheSlug, enrichedEntries, forgeUnavailableSlugs)
         continue;
       }
       failures.push({
+        code: "tbd-in-active-tranche",
         issue: null,
         tranche: e.trancheSlug,
         task: e.task.id,
@@ -3481,6 +3752,7 @@ function checkD1(entries, issueToEntry, taskToEntry) {
       const sameIssue = depEntry.task.issue !== null && e.task.issue !== null && depEntry.task.issue === e.task.issue;
       if (sameTask || sameIssue) {
         failures.push({
+          code: "d1-self-dependency",
           issue: e.task.issue,
           tranche: e.trancheSlug,
           task: e.task.id,
@@ -3492,6 +3764,7 @@ function checkD1(entries, issueToEntry, taskToEntry) {
       const depClosed = depFacts?.issueState === "closed";
       if (!depClosed) {
         failures.push({
+          code: "dispatched-on-unmet-deps",
           issue: e.task.issue,
           tranche: e.trancheSlug,
           task: e.task.id,
@@ -3517,11 +3790,13 @@ function checkR1(issuesBySlug, grandfatheredIssues, registeredNames = []) {
       const errors = [
         ...checkIssueRationale(issue.body).errors,
         ...checkProjectsRegistered(issue.body, issue.labels, registeredNames).errors,
-        ...checkIssueObjectives(issue.body, issue.number).errors
+        ...checkIssueObjectives(issue.body, issue.number).errors,
+        ...checkPartsCiteDefinedObjectives(issue.body).errors
       ];
       if (errors.length === 0)
         continue;
       failures.push({
+        code: "missing-rationale-field",
         issue: issue.number,
         tranche: slug,
         reason: `Issue #${issue.number} fails the rationale gate: ${errors.join(" | ")}`,
@@ -3550,6 +3825,7 @@ function checkL1(files, entriesBySlug) {
     const allClosed = withFacts.every((e) => e.facts?.issueState === "closed");
     if (allClosed) {
       failures.push({
+        code: "archive-recommended",
         tranche: f.slug,
         reason: "Active tranche has no open task-Issues — consider archiving to completed/"
       });
@@ -3581,27 +3857,38 @@ function extractClosesReferences(prBody) {
   }
   return referenced;
 }
-function checkClosesN2(branch, prBody, trancheFiles, taskIssueRefs) {
+function checkClosesNTopology(branch, prBody, trancheFiles, taskIssueRefs) {
   const referenced = extractClosesReferences(prBody);
   if (taskIssueRefs) {
     for (const n of referenced) {
-      const ref = taskIssueRefs.get(n);
-      if (!ref)
+      const ref2 = taskIssueRefs.get(n);
+      if (!ref2)
         continue;
-      const expectedBranch = `task/${ref.trancheSlug}/${ref.taskId}`;
+      const expectedBranch = `task/${ref2.trancheSlug}/${ref2.taskId}`;
       if (branch !== expectedBranch) {
         return {
           ok: false,
-          message: `closes-n-reverse: branch "${branch}" closes #${n} (task ${ref.taskId} of tranche "${ref.trancheSlug}") but is not named "${expectedBranch}" — rename the branch and re-push, or if this work is intentionally outside AEG's dispatch flow, remove the Closes reference.`
+          message: `closes-n-reverse: branch "${branch}" closes #${n} (task ${ref2.taskId} of tranche "${ref2.trancheSlug}") but is not named "${expectedBranch}" — rename the branch and re-push, or if this work is intentionally outside AEG's dispatch flow, remove the Closes reference.`
         };
       }
     }
   }
-  const m = branch.match(/^task\/([^/]+)\/([^/]+)$/);
-  if (!m)
+  const ref = parseTaskBranchIdentity(branch);
+  if (!ref)
     return { ok: true };
-  const trancheSlug = m[1];
-  const taskId = m[2];
+  if (ref.kind === "issue") {
+    const expectedIssue2 = ref.issueNumber;
+    if (!referenced.has(expectedIssue2)) {
+      return {
+        ok: false,
+        expectedIssue: expectedIssue2,
+        message: `closes-n: PR body does not contain \`Closes #${expectedIssue2}\` (required for branch "${branch}"). Add it to the PR body Summary section.`
+      };
+    }
+    return { ok: true, expectedIssue: expectedIssue2 };
+  }
+  const trancheSlug = ref.tranche;
+  const taskId = ref.taskId;
   const trancheFile = trancheFiles.find((f) => f.slug === trancheSlug);
   if (!trancheFile) {
     return {
@@ -3653,29 +3940,67 @@ function extractIssue(body) {
   const issue = headerNums.length > 0 ? headerNums[0] : bodyNums[0];
   return { issue, extraIssues: bodyNums.filter((n) => n !== issue), outsideHeader: headerNums.length === 0 };
 }
-// ../../packages/aeg-core/src/review-gate.ts
-function isBoundToHead(extraction, headSha) {
-  if (!extraction.headSha)
+// ../../packages/aeg-core/src/review-input-manifest.ts
+import { createHash as createHash4 } from "node:crypto";
+function briefHash(brief) {
+  return createHash4("sha256").update(`${brief}
+`).digest("hex");
+}
+function policyDigest(policy) {
+  return createHash4("sha256").update(JSON.stringify({ codeReviewThreshold: policy.codeReviewThreshold, securityThreshold: policy.securityThreshold })).digest("hex");
+}
+function isBoundToHead(echoed, headSha) {
+  if (!echoed.headSha)
     return false;
-  return headSha.toLowerCase().startsWith(extraction.headSha.toLowerCase());
+  return headSha.toLowerCase().startsWith(echoed.headSha.toLowerCase());
 }
-function isBoundByPatchIdentity(extraction, headSha, patchIdOf) {
-  if (patchIdOf === undefined || !extraction.headSha)
+function isBoundByPatchIdentity(echoed, headSha, patchIdOf) {
+  if (patchIdOf === undefined || !echoed.headSha)
     return false;
-  const judged = patchIdOf(extraction.headSha);
+  const judged = patchIdOf(echoed.headSha);
   const current = patchIdOf(headSha);
   if (judged === null || current === null)
     return false;
   return judged === current;
 }
-function isBoundToPatch(extraction, headSha, patchIdOf) {
-  return isBoundToHead(extraction, headSha) || isBoundByPatchIdentity(extraction, headSha, patchIdOf);
+function isBoundToPatch(echoed, headSha, patchIdOf) {
+  return isBoundToHead(echoed, headSha) || isBoundByPatchIdentity(echoed, headSha, patchIdOf);
 }
-function isBoundToObjectives(extraction, currentVersion) {
+function isBoundToObjectives(echoed, currentVersion) {
   if (currentVersion === null)
     return true;
-  return extraction.objectivesVersion === currentVersion;
+  return echoed.objectivesVersion === currentVersion;
+}
+function isBoundToRulings(echoed, currentOrdinal) {
+  if (echoed.rulingOrdinal === null)
+    return currentOrdinal === 0;
+  return echoed.rulingOrdinal === currentOrdinal;
+}
+function isBoundToBriefHash(echoed, currentHash) {
+  if (currentHash === null)
+    return true;
+  return echoed.briefHash === currentHash;
 }
+function isBoundToPolicy(echoed, currentDigest) {
+  return echoed.policyDigest === currentDigest;
+}
+function compareManifest(echoed, current, patchIdOf) {
+  const head = isBoundToPatch(echoed, current.headSha, patchIdOf);
+  const briefHashBound = isBoundToBriefHash(echoed, current.briefHash);
+  const objectivesVersion2 = isBoundToObjectives(echoed, current.objectivesVersion);
+  const rulingOrdinal = isBoundToRulings(echoed, current.rulingOrdinal);
+  const policyDigestBound = isBoundToPolicy(echoed, current.policyDigest);
+  return {
+    bound: head && briefHashBound && objectivesVersion2 && rulingOrdinal && policyDigestBound,
+    head,
+    briefHash: briefHashBound,
+    objectivesVersion: objectivesVersion2,
+    rulingOrdinal,
+    policyDigest: policyDigestBound
+  };
+}
+
+// ../../packages/aeg-core/src/review-gate.ts
 function checkReviewGate(input) {
   const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const waived = isWaiverLabelActorVerified({
@@ -3698,13 +4023,55 @@ function checkReviewGate(input) {
   const verifiedBodies = verified.map((c) => c.body);
   const codeReview = extractCodeReviewVerdict(verifiedBodies);
   const security = extractSecurityReviewVerdict(verifiedBodies);
-  const codeReviewClean = codeReview.value === "APPROVE";
-  const securityClean = security.value === "PASS";
-  const codeReviewBound = isBoundToPatch(codeReview, input.headSha, input.patchIdOf);
-  const securityBound = isBoundToPatch(security, input.headSha, input.patchIdOf);
-  const codeReviewObjectivesBound = isBoundToObjectives(codeReview, input.objectivesVersion);
-  const securityObjectivesBound = isBoundToObjectives(security, input.objectivesVersion);
-  if (codeReviewClean && codeReviewBound && codeReviewObjectivesBound && securityClean && securityBound && securityObjectivesBound && mechanicalChecksClean) {
+  const policy = input.policy ?? DEFAULT_REVIEW_POLICY;
+  let codeReviewPolicyEvaluation;
+  let securityPolicyEvaluation;
+  try {
+    codeReviewPolicyEvaluation = evaluateCodeReview(codeReview.findingSeverities, policy);
+    securityPolicyEvaluation = evaluateSecurityReview(security.findingSeverities, policy);
+  } catch (err) {
+    return {
+      verdict: "fail",
+      reason: `a verdict comment carries a finding severity this repository's policy does not recognize: ${err instanceof Error ? err.message : String(err)}`,
+      waived: false
+    };
+  }
+  const codeReviewTextClean = codeReview.value === "APPROVE";
+  const securityTextClean = security.value === "PASS";
+  const codeReviewPolicyClean = codeReviewPolicyEvaluation.outcome === "clean";
+  const securityPolicyClean = securityPolicyEvaluation.outcome === "clean";
+  const codeReviewClean = codeReviewTextClean && codeReviewPolicyClean;
+  const securityClean = securityTextClean && securityPolicyClean;
+  const currentManifest = {
+    headSha: input.headSha,
+    briefHash: input.briefHash ?? null,
+    objectivesVersion: input.objectivesVersion,
+    rulingOrdinal: input.rulingOrdinal,
+    policyDigest: policyDigest(policy)
+  };
+  const codeReviewEchoed = {
+    headSha: codeReview.headSha,
+    briefHash: codeReview.briefHash,
+    objectivesVersion: codeReview.objectivesVersion,
+    rulingOrdinal: codeReview.rulingOrdinal,
+    policyDigest: codeReview.policyDigest
+  };
+  const securityEchoed = {
+    headSha: security.headSha,
+    briefHash: security.briefHash,
+    objectivesVersion: security.objectivesVersion,
+    rulingOrdinal: security.rulingOrdinal,
+    policyDigest: security.policyDigest
+  };
+  const codeReviewBinding = compareManifest(codeReviewEchoed, currentManifest, input.patchIdOf);
+  const securityBinding = compareManifest(securityEchoed, currentManifest, input.patchIdOf);
+  const codeReviewBound = codeReviewBinding.head;
+  const securityBound = securityBinding.head;
+  const codeReviewObjectivesBound = codeReviewBinding.objectivesVersion;
+  const securityObjectivesBound = securityBinding.objectivesVersion;
+  const codeReviewRulingsBound = codeReviewBinding.rulingOrdinal;
+  const securityRulingsBound = securityBinding.rulingOrdinal;
+  if (codeReviewClean && codeReviewBinding.bound && securityClean && securityBinding.bound && mechanicalChecksClean) {
     return {
       verdict: "pass",
       reason: `code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS, both covering head ${input.headSha}, and every reported mechanical check is green.`,
@@ -3712,19 +4079,35 @@ function checkReviewGate(input) {
     };
   }
   const problems = [];
-  if (!codeReviewClean) {
+  if (!codeReviewTextClean) {
     problems.push(`code-reviewer verdict is not a clean APPROVE (found: ${codeReview.value})`);
+  } else if (!codeReviewPolicyClean) {
+    problems.push(`code-reviewer verdict says APPROVE but carries a finding (${codeReviewPolicyEvaluation.blockingFindings.map((f) => f.severity).join(", ")}) at or above this repository's code-review policy threshold (${policy.codeReviewThreshold}) — a reviewer's own APPROVE never overrides policy`);
   } else if (!codeReviewBound) {
     problems.push(`the newest code-review verdict covers ${codeReview.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
   } else if (!codeReviewObjectivesBound) {
     problems.push(`the newest code-review verdict was cast against objectives version ${codeReview.objectivesVersion ?? "none"}, the Issue's list is now ${input.objectivesVersion}`);
-  }
-  if (!securityClean) {
+  } else if (!codeReviewRulingsBound) {
+    problems.push(`the newest code-review verdict was cast against ruling ordinal ${codeReview.rulingOrdinal ?? "none"}, a newer ruling (ruling ${input.rulingOrdinal}) is now posted on this PR`);
+  } else if (!codeReviewBinding.briefHash) {
+    problems.push(`the newest code-review verdict was cast against brief hash ${codeReview.briefHash ?? "none"}, the frozen brief's current hash is ${currentManifest.briefHash ?? "none"}`);
+  } else if (!codeReviewBinding.policyDigest) {
+    problems.push(`the newest code-review verdict was cast against review policy digest ${codeReview.policyDigest ?? "none"}, this repository's current policy digest is ${currentManifest.policyDigest}`);
+  }
+  if (!securityTextClean) {
     problems.push(`security-review verdict is not a clean PASS (found: ${security.value})`);
+  } else if (!securityPolicyClean) {
+    problems.push(`security-review verdict says PASS but carries a finding (${securityPolicyEvaluation.blockingFindings.map((f) => f.severity).join(", ")}) at or above this repository's security policy threshold (${policy.securityThreshold}) — a reviewer's own PASS never overrides policy`);
   } else if (!securityBound) {
     problems.push(`the newest security-review verdict covers ${security.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
   } else if (!securityObjectivesBound) {
     problems.push(`the newest security-review verdict was cast against objectives version ${security.objectivesVersion ?? "none"}, the Issue's list is now ${input.objectivesVersion}`);
+  } else if (!securityRulingsBound) {
+    problems.push(`the newest security-review verdict was cast against ruling ordinal ${security.rulingOrdinal ?? "none"}, a newer ruling (ruling ${input.rulingOrdinal}) is now posted on this PR`);
+  } else if (!securityBinding.briefHash) {
+    problems.push(`the newest security-review verdict was cast against brief hash ${security.briefHash ?? "none"}, the frozen brief's current hash is ${currentManifest.briefHash ?? "none"}`);
+  } else if (!securityBinding.policyDigest) {
+    problems.push(`the newest security-review verdict was cast against review policy digest ${security.policyDigest ?? "none"}, this repository's current policy digest is ${currentManifest.policyDigest}`);
   }
   if (!mechanicalChecksClean) {
     problems.push(reportedMechanicalChecks.length === 0 ? "no mechanical checks have reported for this head yet" : `mechanical check(s) not green: ${reportedMechanicalChecks.filter((c) => c.bucket !== "pass").map((c) => `${c.name} (${c.bucket})`).join(", ")}`);
@@ -3741,6 +4124,24 @@ var DEFAULT_RELEASE_ACTOR = "github-actions[bot]";
 function isChangesetsReleasePr(branch, author, expectedAuthor) {
   return branch === CHANGESET_RELEASE_BRANCH && author === expectedAuthor;
 }
+// ../../packages/aeg-core/src/ruling-ordinal.ts
+var RULING_MARKER_ORDINAL = /^<!-- aeg:principal:ruling:\d+-(\d+) -->$/;
+function newestPrincipalRulingOrdinal(comments, allowlist) {
+  let best = 0;
+  for (const c of comments) {
+    if (!isPrincipal(c.author, allowlist))
+      continue;
+    const firstLine = (c.body.split(`
+`)[0] ?? "").trim();
+    const m = RULING_MARKER_ORDINAL.exec(firstLine);
+    if (!m)
+      continue;
+    const k = Number.parseInt(m[1], 10);
+    if (k > best)
+      best = k;
+  }
+  return best;
+}
 // ../../packages/aeg-core/src/markdown-table.ts
 function splitRow(line) {
   const trimmed = line.trim().replace(/^\|/, "").replace(/\|$/, "");
@@ -4398,42 +4799,45 @@ function checkDispatchReadiness(input) {
   const { trancheSlug, task } = input;
   const taskLabel = `task ${task.id} (tranche ${trancheSlug})`;
   const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
-  const blockers = [];
+  const blockerDetails = [];
+  const push = (blockerClass, message) => {
+    blockerDetails.push({ class: blockerClass, message });
+  };
   if (task.issue === null) {
-    blockers.push(`dispatch-gate issue-existence: ${taskLabel} has no Issue (#TBD or blank) in the topology — not dispatchable until the Planner cuts the Issue.`);
+    push("issue-existence", `dispatch-gate issue-existence: ${taskLabel} has no Issue (#TBD or blank) in the topology — not dispatchable until the Planner cuts the Issue.`);
   } else if (input.issue === null) {
-    blockers.push(`dispatch-gate issue-existence: ${taskLabel} names Issue #${task.issue}, but it does not resolve to a real GitHub Issue (phantom reference).`);
+    push("issue-existence", `dispatch-gate issue-existence: ${taskLabel} names Issue #${task.issue}, but it does not resolve to a real GitHub Issue (phantom reference).`);
   }
   if (input.issue !== null && !input.issueRationalePass) {
-    blockers.push(`dispatch-gate rationale: Issue #${input.issue.number} for ${taskLabel} fails the rationale gate (checkIssueRationale) — the Planner must complete the eight-field rationale before this task is dispatchable.`);
+    push("rationale", `dispatch-gate rationale: Issue #${input.issue.number} for ${taskLabel} fails the rationale gate (checkIssueRationale) — the Planner must complete the eight-field rationale before this task is dispatchable.`);
   }
   for (const dep of input.dependsOn) {
     if (isSelfDependency(dep, task, input.issue)) {
       const issueStr = input.issue !== null ? `#${input.issue.number}` : "?";
-      blockers.push(`dispatch-gate INTERNAL: parsed a self-dependency for task ${task.id} (${issueStr}) — this is a parser bug in parseRationaleDeps, not a real dependency. Please report it upstream. Re-run once the rationale is corrected or the fix ships.`);
+      push("internal-self-dependency", `dispatch-gate INTERNAL: parsed a self-dependency for task ${task.id} (${issueStr}) — this is a parser bug in parseRationaleDeps, not a real dependency. Please report it upstream. Re-run once the rationale is corrected or the fix ships.`);
       continue;
     }
     if (dep.resolved === false) {
-      blockers.push(`dispatch-gate depends-on: ${taskLabel} depends on "${dep.id}", which is UNRESOLVABLE — the resolver could not find a matching tranche/task/Issue for this edge (not a claim about merge status). Not dispatchable until the edge is corrected.`);
+      push("depends-on-unresolvable", `dispatch-gate depends-on: ${taskLabel} depends on "${dep.id}", which is UNRESOLVABLE — the resolver could not find a matching tranche/task/Issue for this edge (not a claim about merge status). Not dispatchable until the edge is corrected.`);
       continue;
     }
     if (!dep.merged && !isHandClosedByRecognizedPrincipal(dep, principalAllowlist)) {
       const issueStr = dep.issue !== null ? ` (#${dep.issue})` : "";
-      blockers.push(`dispatch-gate depends-on: ${taskLabel} depends on ${dep.id}${issueStr}, whose PR is not merged yet — not dispatchable, it serializes behind it.`);
+      push("depends-on-not-merged", `dispatch-gate depends-on: ${taskLabel} depends on ${dep.id}${issueStr}, whose PR is not merged yet — not dispatchable, it serializes behind it.`);
     }
   }
   for (const c of input.conflictsWith) {
     if (c.openOrInFlight) {
       const issueStr = c.issue !== null ? ` (#${c.issue})` : "";
-      blockers.push(`dispatch-gate conflicts-with: ${taskLabel} conflicts with ${c.id}${issueStr}, whose PR is open or in-flight — not dispatchable until it merges.`);
+      push("conflicts-with", `dispatch-gate conflicts-with: ${taskLabel} conflicts with ${c.id}${issueStr}, whose PR is open or in-flight — not dispatchable until it merges.`);
     }
   }
   for (const proj of input.priorTrancheArchival) {
     if (proj.priorTrancheSlug !== null && !proj.archived) {
-      blockers.push(`dispatch-gate prior-tranche-archival: project \`${proj.project}\`'s previous tranche \`${proj.priorTrancheSlug}\` is not archived — the Tranche Archivist must run before new work on this product.`);
+      push("prior-tranche-archival", `dispatch-gate prior-tranche-archival: project \`${proj.project}\`'s previous tranche \`${proj.priorTrancheSlug}\` is not archived — the Tranche Archivist must run before new work on this product.`);
     }
   }
-  return { ready: blockers.length === 0, blockers };
+  return { ready: blockerDetails.length === 0, blockers: blockerDetails.map((b) => b.message), blockerDetails };
 }
 // ../../packages/aeg-core/src/single-plan-pr.ts
 function trancheSlugFromTopologyPath(path) {
@@ -4535,6 +4939,91 @@ function checkBranchTopology(input) {
     reason: `Branch \`${branch}\` matches topology row \`${taskId}\` in ${topoPath}.`
   };
 }
+// ../../packages/aeg-core/src/task-tools.ts
+import { z } from "zod";
+var TASK_TOOL_ERROR_KINDS = [
+  "validation",
+  "authority",
+  "precondition",
+  "capability",
+  "infrastructure",
+  "cancellation",
+  "timeout",
+  "uncertain_effect"
+];
+var TaskToolErrorSchema = z.object({
+  kind: z.enum(TASK_TOOL_ERROR_KINDS),
+  message: z.string().min(1),
+  detail: z.string().optional()
+});
+var TaskToolRefSchema = z.union([
+  z.object({ tranche: z.string().min(1), id: z.string().min(1) }),
+  z.object({ issue: z.number().int().positive() })
+]);
+var MAX_PAGE_LIMIT = 100;
+var PageRequestSchema = z.object({
+  cursor: z.string().optional(),
+  limit: z.number().int().positive().max(MAX_PAGE_LIMIT).optional()
+});
+var FreshnessSchema = z.enum(["fresh", "stale", "unknown"]);
+var ObservedSchema = z.object({
+  observedAt: z.string(),
+  freshness: FreshnessSchema
+});
+var TaskStatusInputSchema = z.object({
+  task: TaskToolRefSchema.optional()
+}).merge(PageRequestSchema);
+var TaskStatusItemSchema = z.object({
+  task: TaskToolRefSchema,
+  issue: z.number().int().positive(),
+  pr: z.number().int().positive().nullable(),
+  state: z.string()
+}).merge(ObservedSchema);
+var TaskStatusResultSchema = z.object({
+  items: z.array(TaskStatusItemSchema),
+  nextCursor: z.string().nullable()
+});
+var RequestedAuthoritySchema = z.enum(["planner", "principal", "operator", "self"]);
+var EscalationInputsSchema = z.object({
+  task: z.number().int().positive(),
+  round: z.number().int().nonnegative(),
+  head: z.string(),
+  branch: z.string(),
+  prNumber: z.number().int().positive()
+});
+var EscalationEvidenceSchema = z.object({
+  round: z.number().int().nonnegative(),
+  reviewer: z.string().nullable(),
+  security: z.string().nullable()
+});
+var TaskEscalationReadInputSchema = z.object({
+  task: TaskToolRefSchema
+}).merge(PageRequestSchema);
+var TaskEscalationPacketSchema = z.object({
+  reason: z.string(),
+  detail: z.string().nullable(),
+  inputs: EscalationInputsSchema.nullable(),
+  evidence: EscalationEvidenceSchema.nullable(),
+  attemptedRecovery: z.string(),
+  requestedAuthority: RequestedAuthoritySchema,
+  permittedNextActions: z.array(z.string())
+}).merge(ObservedSchema);
+var TaskEscalationReadResultSchema = z.object({
+  items: z.array(TaskEscalationPacketSchema),
+  nextCursor: z.string().nullable()
+}).merge(ObservedSchema);
+var TaskStartInputSchema = z.object({
+  tranche: z.string().min(1),
+  id: z.string().min(1)
+});
+var TaskResumeInputSchema = z.object({
+  task: TaskToolRefSchema
+});
+var TaskCancelInputSchema = z.object({
+  task: TaskToolRefSchema,
+  reason: z.string().min(1)
+});
+var NoResultSchema = z.never();
 // ../../packages/aeg-core/src/first-push-dispatch-gate.ts
 function parseTaskBranch(branch) {
   const m = /^task\/([^/]+)\/([^/]+)$/.exec(branch);
@@ -4618,7 +5107,6 @@ function decideIssueAssignment(input) {
   };
 }
 // ../../packages/aeg-core/src/test-plan-gate.ts
-var TASK_BRANCH_PATTERN2 = /^task\/[^/]+\/[^/]+$/;
 function evaluateTestPlanGate(body, branch) {
   if (!body) {
     return {
@@ -4631,7 +5119,7 @@ function evaluateTestPlanGate(body, branch) {
   }
   const located = locateTestPlanSection(body);
   if (!located.found) {
-    if (TASK_BRANCH_PATTERN2.test(branch)) {
+    if (parseTaskBranchIdentity(branch) !== null) {
       return {
         verdict: "fail",
         messages: [
@@ -4759,7 +5247,7 @@ function findWorkspaceEscapes(files, knownPaths, workspaceDirs = DEFAULT_WORKSPA
   return findings;
 }
 // ../../packages/aeg-core/src/log/schema.ts
-import { z } from "zod";
+import { z as z2 } from "zod";
 var ROLE_VALUES = [
   "planner",
   "developer",
@@ -4769,136 +5257,172 @@ var ROLE_VALUES = [
   "archivist",
   "architect"
 ];
-var RoleSchema = z.enum(ROLE_VALUES);
+var RoleSchema = z2.enum(ROLE_VALUES);
 var HOST_VALUES = ["hook", "ci", "cli", "loop"];
-var HostSchema = z.enum(HOST_VALUES);
+var HostSchema = z2.enum(HOST_VALUES);
 var RUN_ID_PATTERN = /^[A-Za-z0-9_.-]{1,128}$/;
-var HeaderMetaSchema = z.object({
-  schema: z.literal(1),
-  ts: z.string(),
-  run_id: z.string().regex(RUN_ID_PATTERN),
-  seq: z.number().int().nonnegative(),
-  repo: z.string().nullable(),
-  vinaya: z.string(),
-  doctrine: z.string(),
+var headerMetaCore = {
+  ts: z2.string(),
+  run_id: z2.string().regex(RUN_ID_PATTERN),
+  seq: z2.number().int().nonnegative(),
+  repo: z2.string().nullable(),
+  vinaya: z2.string(),
+  doctrine: z2.string(),
   host: HostSchema,
-  machine: z.string()
+  machine: z2.string()
+};
+var HeaderMetaV1Schema = z2.object({
+  schema: z2.literal(1),
+  ...headerMetaCore
 }).strict();
-var SubjectSchema = z.object({
-  issue: z.number().int().nullable(),
-  pr: z.number().int().optional(),
-  sha: z.string().optional(),
-  role: z.union([RoleSchema, z.literal("unattributed")]),
-  round: z.number().int().optional(),
-  objectives_version: z.string().optional()
+var LineageSchema = z2.object({
+  run: z2.string().nullable(),
+  attempt: z2.number().int().nullable(),
+  parent: z2.string().nullable()
 }).strict();
-var HeaderSchema = z.object({
+var InputVersionsSchema = z2.object({
+  objectives_version: z2.string().nullable(),
+  brief_hash: z2.string().nullable(),
+  ruling_ordinal: z2.number().int().nullable(),
+  policy_digest: z2.string().nullable()
+}).strict();
+var ProvenanceSchema = z2.enum(["parent_attributed", "env_correlated", "self_reported", "unavailable"]);
+var HeaderMetaV2Schema = z2.object({
+  schema: z2.literal(2),
+  ...headerMetaCore,
+  event_id: z2.string().min(1),
+  process_id: z2.string().min(1),
+  actor_id: z2.string().nullable(),
+  lineage: LineageSchema,
+  input_versions: InputVersionsSchema,
+  provenance: ProvenanceSchema
+}).strict();
+var HeaderMetaSchema = z2.discriminatedUnion("schema", [HeaderMetaV1Schema, HeaderMetaV2Schema]);
+var SubjectSchema = z2.object({
+  issue: z2.number().int().nullable(),
+  pr: z2.number().int().optional(),
+  sha: z2.string().optional(),
+  role: z2.union([RoleSchema, z2.literal("unattributed")]),
+  round: z2.number().int().optional(),
+  objectives_version: z2.string().optional()
+}).strict();
+var HeaderSchema = z2.object({
   meta: HeaderMetaSchema,
   subject: SubjectSchema
 }).strict();
 var envelopeTail = {
-  duration_ms: z.number().nonnegative().optional(),
-  payload: z.object({}).strict()
+  duration_ms: z2.number().nonnegative().optional(),
+  payload: z2.object({}).strict()
 };
-var DispatchOutcomeSchema = z.discriminatedUnion("type", [
-  z.object({ type: z.literal("pr_opened"), pr: z.number().int(), head: z.string() }).strict(),
-  z.object({
-    type: z.literal("round_pushed"),
-    pr: z.number().int(),
-    head: z.string(),
-    comment_id: z.number().int()
+var ReviewFindingSchema = z2.object({
+  id: z2.string(),
+  severity: z2.string(),
+  state: z2.string().optional(),
+  severity_scale: z2.string().optional(),
+  policy_treatment: z2.enum(["blocking", "non_blocking", "unavailable"]).optional(),
+  confidence: z2.number().min(0).max(1).optional(),
+  confidence_scale: z2.string().optional(),
+  confidence_source: z2.string().optional()
+}).strict();
+var DispatchOutcomeSchema = z2.discriminatedUnion("type", [
+  z2.object({ type: z2.literal("pr_opened"), pr: z2.number().int(), head: z2.string() }).strict(),
+  z2.object({
+    type: z2.literal("round_pushed"),
+    pr: z2.number().int(),
+    head: z2.string(),
+    comment_id: z2.number().int()
   }).strict(),
-  z.object({
-    type: z.literal("verdict"),
-    verdict: z.enum(["APPROVE", "REQUEST CHANGES", "PASS", "FAIL"]),
-    head: z.string(),
-    comment_id: z.number().int(),
-    objectives: z.array(z.object({ id: z.string(), met: z.boolean() }).strict()),
-    findings: z.array(z.object({ id: z.string(), severity: z.string(), state: z.string().optional() }).strict())
+  z2.object({
+    type: z2.literal("verdict"),
+    verdict: z2.enum(["APPROVE", "REQUEST CHANGES", "PASS", "FAIL"]),
+    head: z2.string(),
+    comment_id: z2.number().int(),
+    objectives: z2.array(z2.object({ id: z2.string(), met: z2.boolean() }).strict()),
+    findings: z2.array(ReviewFindingSchema)
   }).strict(),
-  z.object({
-    type: z.literal("escalation"),
-    class: z.enum(["authority", "strategy", "product"]),
-    comment_id: z.number().int()
+  z2.object({
+    type: z2.literal("escalation"),
+    class: z2.enum(["authority", "strategy", "product"]),
+    comment_id: z2.number().int()
   }).strict(),
-  z.object({ type: z.literal("brief"), comment_id: z.number().int(), hash: z.string() }).strict(),
-  z.object({ type: z.literal("plan"), issues: z.array(z.number().int()) }).strict(),
-  z.object({ type: z.literal("archive"), provenance_comment_id: z.number().int() }).strict()
+  z2.object({ type: z2.literal("brief"), comment_id: z2.number().int(), hash: z2.string() }).strict(),
+  z2.object({ type: z2.literal("plan"), issues: z2.array(z2.number().int()) }).strict(),
+  z2.object({ type: z2.literal("archive"), provenance_comment_id: z2.number().int() }).strict()
 ]);
 var dispatchShared = {
   meta: HeaderMetaSchema,
   subject: SubjectSchema,
-  kind: z.literal("dispatch"),
+  kind: z2.literal("dispatch"),
   ...envelopeTail,
   target_role: RoleSchema,
-  model: z.string(),
-  round: z.number().int().optional(),
-  effect_id: z.string()
+  model: z2.string(),
+  round: z2.number().int().optional(),
+  effect_id: z2.string()
 };
-var dispatchUsageField = z.object({ input: z.number().nonnegative(), output: z.number().nonnegative() }).strict().nullable();
-var DispatchEventSchema = z.discriminatedUnion("event", [
-  z.object({ ...dispatchShared, event: z.literal("dispatched"), prompt_hash: z.string() }).strict(),
-  z.object({
+var dispatchUsageField = z2.object({ input: z2.number().nonnegative(), output: z2.number().nonnegative() }).strict().nullable();
+var DispatchEventSchema = z2.discriminatedUnion("event", [
+  z2.object({ ...dispatchShared, event: z2.literal("dispatched"), prompt_hash: z2.string() }).strict(),
+  z2.object({
     ...dispatchShared,
-    event: z.literal("outcome_received"),
+    event: z2.literal("outcome_received"),
     outcome: DispatchOutcomeSchema,
     usage: dispatchUsageField
   }).strict(),
-  z.object({
+  z2.object({
     ...dispatchShared,
-    event: z.literal("dispatch_failed"),
-    reason: z.enum(["timeout", "crash", "refused", "unattributed_write"]),
+    event: z2.literal("dispatch_failed"),
+    reason: z2.enum(["timeout", "crash", "refused", "unattributed_write"]),
     usage: dispatchUsageField
   }).strict()
 ]);
 var loopShared = {
   meta: HeaderMetaSchema,
   subject: SubjectSchema,
-  kind: z.literal("dev_review_loop"),
+  kind: z2.literal("dev_review_loop"),
   ...envelopeTail,
-  loop_id: z.string()
+  loop_id: z2.string()
 };
-var DevReviewLoopEventSchema = z.discriminatedUnion("event", [
-  z.object({
+var DevReviewLoopEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
     ...loopShared,
-    event: z.literal("loop_started"),
-    task: z.number().int(),
-    policy: z.object({
-      max_rounds: z.number().int().nonnegative(),
-      reviewers: z.array(RoleSchema),
-      models: z.record(RoleSchema, z.string())
+    event: z2.literal("loop_started"),
+    task: z2.number().int(),
+    policy: z2.object({
+      max_rounds: z2.number().int().nonnegative(),
+      reviewers: z2.array(RoleSchema),
+      models: z2.record(RoleSchema, z2.string())
     }).strict()
   }).strict(),
-  z.object({ ...loopShared, event: z.literal("round_started"), round: z.number().int(), base_head: z.string() }).strict(),
-  z.object({
+  z2.object({ ...loopShared, event: z2.literal("round_started"), round: z2.number().int(), base_head: z2.string() }).strict(),
+  z2.object({
     ...loopShared,
-    event: z.literal("gate_result_read"),
-    round: z.number().int(),
-    head: z.string(),
-    green: z.boolean()
+    event: z2.literal("gate_result_read"),
+    round: z2.number().int(),
+    head: z2.string(),
+    green: z2.boolean()
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("verdicts_read"),
-    round: z.number().int(),
-    head: z.string(),
-    all_approve: z.boolean(),
-    blockers: z.number().int().nonnegative()
+    event: z2.literal("verdicts_read"),
+    round: z2.number().int(),
+    head: z2.string(),
+    all_approve: z2.boolean(),
+    blockers: z2.number().int().nonnegative()
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("findings_compared"),
-    round: z.number().int(),
-    open: z.array(z.string()),
-    resolved: z.array(z.string()),
-    new: z.array(z.string()),
-    recurring: z.array(z.string())
+    event: z2.literal("findings_compared"),
+    round: z2.number().int(),
+    open: z2.array(z2.string()),
+    resolved: z2.array(z2.string()),
+    new: z2.array(z2.string()),
+    recurring: z2.array(z2.string())
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("stop_condition_met"),
-    round: z.number().int(),
-    condition: z.enum([
+    event: z2.literal("stop_condition_met"),
+    round: z2.number().int(),
+    condition: z2.enum([
       "green",
       "max_rounds",
       "no_progress",
@@ -4908,42 +5432,49 @@ var DevReviewLoopEventSchema = z.discriminatedUnion("event", [
       "reappearance"
     ])
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("paused"),
-    round: z.number().int(),
-    reason: z.enum(["escalation", "principal_item", "refreeze_needed"])
+    event: z2.literal("paused"),
+    round: z2.number().int(),
+    reason: z2.enum(["escalation", "principal_item", "refreeze_needed"])
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("resumed"),
-    round: z.number().int(),
-    by: z.literal("principal")
+    event: z2.literal("resumed"),
+    round: z2.number().int(),
+    by: z2.literal("principal")
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("round_ended"),
-    round: z.number().int(),
-    base_head: z.string(),
-    head: z.string(),
-    files_changed: z.number().int().nonnegative(),
-    insertions: z.number().int().nonnegative(),
-    deletions: z.number().int().nonnegative(),
-    wall_ms: z.number().nonnegative(),
-    outcome: z.enum(["green", "changes_requested", "escalated"])
+    event: z2.literal("unpushed_work_resume"),
+    round: z2.number().int(),
+    branch: z2.string(),
+    detail: z2.string()
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("journal_finalized"),
-    rounds: z.number().int().nonnegative(),
-    total_wall_ms: z.number().nonnegative(),
-    time_to_green_ms: z.number().nonnegative().nullable(),
-    files_changed_total: z.number().int().nonnegative(),
-    final_head: z.string(),
-    result: z.enum(["merged_ready", "stopped"])
+    event: z2.literal("round_ended"),
+    round: z2.number().int(),
+    base_head: z2.string(),
+    head: z2.string(),
+    files_changed: z2.number().int().nonnegative(),
+    insertions: z2.number().int().nonnegative(),
+    deletions: z2.number().int().nonnegative(),
+    wall_ms: z2.number().nonnegative(),
+    outcome: z2.enum(["green", "changes_requested", "escalated"])
+  }).strict(),
+  z2.object({
+    ...loopShared,
+    event: z2.literal("journal_finalized"),
+    rounds: z2.number().int().nonnegative(),
+    total_wall_ms: z2.number().nonnegative(),
+    time_to_green_ms: z2.number().nonnegative().nullable(),
+    files_changed_total: z2.number().int().nonnegative(),
+    final_head: z2.string(),
+    result: z2.enum(["merged_ready", "stopped"])
   }).strict()
 ]);
-var ForgeOpSchema = z.enum([
+var ForgeOpSchema = z2.enum([
   "pr.create",
   "pr.comment",
   "pr.body.replace",
@@ -4957,50 +5488,238 @@ var ForgeOpSchema = z.enum([
   "label.add",
   "label.remove"
 ]);
-var ForgeWriteTargetSchema = z.object({
-  issue: z.number().int().optional(),
-  pr: z.number().int().optional()
+var ForgeWriteTargetSchema = z2.object({
+  issue: z2.number().int().optional(),
+  pr: z2.number().int().optional()
 }).strict();
 var forgeWriteShared = {
   meta: HeaderMetaSchema,
   subject: SubjectSchema,
-  kind: z.literal("forge_write"),
+  kind: z2.literal("forge_write"),
   ...envelopeTail,
   op: ForgeOpSchema,
   target: ForgeWriteTargetSchema
 };
-var ForgeWriteEventSchema = z.discriminatedUnion("event", [
-  z.object({ ...forgeWriteShared, event: z.literal("validated") }).strict(),
-  z.object({ ...forgeWriteShared, event: z.literal("refused"), reason: z.string() }).strict(),
-  z.object({ ...forgeWriteShared, event: z.literal("written"), comment_ids: z.array(z.string()) }).strict()
+var ForgeWriteEventSchema = z2.discriminatedUnion("event", [
+  z2.object({ ...forgeWriteShared, event: z2.literal("validated") }).strict(),
+  z2.object({ ...forgeWriteShared, event: z2.literal("refused"), reason: z2.string() }).strict(),
+  z2.object({ ...forgeWriteShared, event: z2.literal("written"), comment_ids: z2.array(z2.string()) }).strict()
+]);
+var GateOutcomeSchema = z2.enum([
+  "pass",
+  "fail",
+  "wait",
+  "skip",
+  "invalid_input",
+  "unavailable_dependency",
+  "timeout",
+  "cancelled"
 ]);
-var LogEventSchema = z.union([DispatchEventSchema, DevReviewLoopEventSchema, ForgeWriteEventSchema]);
+var gateShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("gate"),
+  ...envelopeTail,
+  check: z2.string(),
+  check_version: z2.string().nullable(),
+  policy_version: z2.string().nullable(),
+  input_fingerprint: z2.string().nullable()
+};
+var GateEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...gateShared,
+    event: z2.literal("checked"),
+    outcome: GateOutcomeSchema,
+    reason: z2.string().optional()
+  }).strict()
+]);
+var OperationResultSchema = z2.enum(["ok", "error", "refused", "timeout", "cancelled", "unavailable"]);
+var operationShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("operation"),
+  ...envelopeTail,
+  operation: z2.string(),
+  target: z2.string().nullable()
+};
+var OperationEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...operationShared,
+    event: z2.literal("completed"),
+    result: OperationResultSchema,
+    error_class: z2.string().nullable()
+  }).strict()
+]);
+var UsageUnitsSchema = z2.object({
+  input: z2.number().nonnegative().nullable(),
+  output: z2.number().nonnegative().nullable(),
+  cache: z2.number().nonnegative().nullable()
+}).strict();
+var usageShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("usage"),
+  ...envelopeTail,
+  model: z2.string().nullable(),
+  source: z2.string(),
+  semantics: z2.enum(["cumulative", "delta"])
+};
+var UsageEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...usageShared,
+    event: z2.literal("observed"),
+    units: UsageUnitsSchema,
+    unknown_reason: z2.string().nullable()
+  }).strict()
+]);
+var RoleAttemptOutcomeSchema = z2.enum([
+  "completed",
+  "incomplete",
+  "infrastructure_failed",
+  "cancelled",
+  "timed_out",
+  "capability_refused"
+]);
+var roleAttemptShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("role_attempt"),
+  ...envelopeTail,
+  actor: z2.string().nullable(),
+  attempt: z2.number().int().nullable()
+};
+var RoleAttemptEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...roleAttemptShared,
+    event: z2.literal("attempted"),
+    outcome: RoleAttemptOutcomeSchema,
+    usage: dispatchUsageField
+  }).strict()
+]);
+var handoffShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("handoff"),
+  ...envelopeTail,
+  class: z2.enum(["authority", "strategy", "product"]),
+  reason: z2.string()
+};
+var HandoffEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...handoffShared,
+    event: z2.literal("raised"),
+    requested_decision: z2.string().nullable()
+  }).strict(),
+  z2.object({
+    ...handoffShared,
+    event: z2.literal("resolved"),
+    resolution: z2.string().nullable(),
+    resolved_by: z2.string().nullable()
+  }).strict()
+]);
+var EffectTargetSchema = z2.object({
+  kind: z2.string(),
+  ref: z2.string()
+}).strict();
+var effectShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("effect"),
+  ...envelopeTail,
+  effect_id: z2.string(),
+  target: EffectTargetSchema
+};
+var EffectEventSchema = z2.discriminatedUnion("event", [
+  z2.object({ ...effectShared, event: z2.literal("attempted") }).strict(),
+  z2.object({ ...effectShared, event: z2.literal("observed"), outcome: z2.enum(["success", "failure", "uncertain"]) }).strict(),
+  z2.object({ ...effectShared, event: z2.literal("verified"), outcome: z2.enum(["success", "failure", "uncertain"]) }).strict()
+]);
+var LogEventSchema = z2.union([
+  DispatchEventSchema,
+  DevReviewLoopEventSchema,
+  ForgeWriteEventSchema,
+  GateEventSchema,
+  OperationEventSchema,
+  UsageEventSchema,
+  RoleAttemptEventSchema,
+  HandoffEventSchema,
+  EffectEventSchema
+]);
+// ../../packages/aeg-core/src/dev-review-loop/journal-reconstruction.ts
+var STOPPED_CONDITIONS = new Set(["confidence", "reappearance", "no_progress", "max_rounds"]);
+// ../../packages/aeg-core/src/control-store/records.ts
+import { z as z3 } from "zod";
+var isoTimestamp = z3.string().min(1);
+var taskId = z3.number().int().positive();
+var epochNumber = z3.number().int().nonnegative();
+var RunRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("run"),
+  task: taskId,
+  runId: z3.string().min(1),
+  pid: z3.number().int().positive(),
+  host: z3.string().min(1),
+  startedAt: isoTimestamp
+}).strict();
+var InputRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("input"),
+  task: taskId,
+  runId: z3.string().min(1),
+  source: z3.union([z3.literal("fresh"), z3.literal("resume")]),
+  pr: z3.number().int().positive().nullable(),
+  round: z3.number().int().nonnegative(),
+  recordedAt: isoTimestamp
+}).strict();
+var OwnershipRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("ownership"),
+  task: taskId,
+  epoch: epochNumber,
+  ownerId: z3.string().min(1),
+  pid: z3.number().int().positive(),
+  host: z3.string().min(1),
+  acquiredAt: isoTimestamp
+}).strict();
+var TransitionRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("transition"),
+  task: taskId,
+  epoch: epochNumber,
+  seq: z3.number().int().nonnegative(),
+  from: z3.string().min(1),
+  to: z3.string().min(1),
+  detail: z3.string().optional(),
+  at: isoTimestamp
+}).strict();
 // src/lib/config.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync as readFileSync2, realpathSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
-import { z as z2 } from "zod";
+import { z as z4 } from "zod";
 
 // src/lib/agent-vendors.ts
 var AGENT_VENDORS = ["skills", "claude", "gemini"];
 
 // src/lib/config.ts
-var EnvEntrySchema = z2.union([
-  z2.literal(true),
-  z2.object({ optional: z2.literal(true) }),
-  z2.object({ anyOf: z2.array(z2.string()).min(2) }),
-  z2.string()
+var EnvEntrySchema = z4.union([
+  z4.literal(true),
+  z4.object({ optional: z4.literal(true) }),
+  z4.object({ anyOf: z4.array(z4.string()).min(2) }),
+  z4.string()
 ]);
-var CheckEntrySchema = z2.object({
-  run: z2.string(),
-  scope: z2.enum(["diff", "full"]),
-  include: z2.array(z2.string()).optional(),
-  args: z2.array(z2.string()).optional(),
-  timeoutMs: z2.number().optional(),
-  env: z2.record(z2.string(), EnvEntrySchema).optional(),
-  requiresOpenPr: z2.boolean().optional(),
-  ownWorkflow: z2.boolean().optional()
+var CheckEntrySchema = z4.object({
+  run: z4.string(),
+  scope: z4.enum(["diff", "full"]),
+  include: z4.array(z4.string()).optional(),
+  args: z4.array(z4.string()).optional(),
+  timeoutMs: z4.number().optional(),
+  env: z4.record(z4.string(), EnvEntrySchema).optional(),
+  requiresOpenPr: z4.boolean().optional(),
+  ownWorkflow: z4.boolean().optional(),
+  principalOwed: z4.literal(true).optional(),
+  validates: z4.enum(["body", "issue"]).optional()
 }).superRefine((entry2, ctx) => {
   if (!entry2.env)
     return;
@@ -5010,25 +5729,26 @@ var CheckEntrySchema = z2.object({
     const members = value.anyOf;
     if (new Set(members).size !== members.length) {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z4.ZodIssueCode.custom,
         message: `env.${key}.anyOf has duplicate members`,
         path: ["env", key, "anyOf"]
       });
     }
     if (!members.includes(key)) {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z4.ZodIssueCode.custom,
         message: `env.${key}.anyOf must include "${key}" itself as a member`,
         path: ["env", key, "anyOf"]
       });
     }
   }
 });
-var RoleEntrySchema = z2.object({
-  contract: z2.string().refine((p) => p.includes("/"), {
+var RoleEntrySchema = z4.object({
+  contract: z4.string().refine((p) => p.includes("/"), {
     message: 'must be a path (contain at least one "/"), not a bare filename'
   })
 });
+var MAX_REPORT_COMMAND_TIMEOUT_MS = 3600000;
 var BRIEF_BUILTINS = [
   "tier",
   "testPlan",
@@ -5048,17 +5768,17 @@ var BRIEF_BUILTINS = [
   "briefSections",
   "milestoneShape"
 ];
-var BriefSectionSchema = z2.union([
-  z2.object({ builtin: z2.enum(BRIEF_BUILTINS) }),
-  z2.object({ heading: z2.string().min(1), name: z2.string().optional() }),
-  z2.object({ field: z2.string().min(1), name: z2.string().optional() }),
-  z2.object({ phrase: z2.string().min(1), name: z2.string().optional() })
+var BriefSectionSchema = z4.union([
+  z4.object({ builtin: z4.enum(BRIEF_BUILTINS) }),
+  z4.object({ heading: z4.string().min(1), name: z4.string().optional() }),
+  z4.object({ field: z4.string().min(1), name: z4.string().optional() }),
+  z4.object({ phrase: z4.string().min(1), name: z4.string().optional() })
 ]);
-var BriefSchemaSchema = z2.object({
-  pr: z2.object({ sections: z2.array(BriefSectionSchema) }).optional(),
-  issue: z2.object({ sections: z2.array(BriefSectionSchema) }).optional(),
-  milestone: z2.object({ sections: z2.array(BriefSectionSchema) }).optional(),
-  ack: z2.array(z2.enum(BRIEF_BUILTINS)).optional()
+var BriefSchemaSchema = z4.object({
+  pr: z4.object({ sections: z4.array(BriefSectionSchema) }).optional(),
+  issue: z4.object({ sections: z4.array(BriefSectionSchema) }).optional(),
+  milestone: z4.object({ sections: z4.array(BriefSectionSchema) }).optional(),
+  ack: z4.array(z4.enum(BRIEF_BUILTINS)).optional()
 });
 function isSafeRepoRelPath(p) {
   if (p.length === 0)
@@ -5067,7 +5787,7 @@ function isSafeRepoRelPath(p) {
     return false;
   return p.split(/[\\/]/).every((seg) => seg !== ".." && seg !== "");
 }
-var SafeRepoRelPath = z2.string().refine(isSafeRepoRelPath, {
+var SafeRepoRelPath = z4.string().refine(isSafeRepoRelPath, {
   message: "must be a repo-root-relative path with no `..` segment or absolute root"
 });
 var CANONICAL_HOOK_BLOCK_PREFIXES = [".git/", ".husky/", ".vinaya/hooks/", ".claude/hooks/"];
@@ -5077,22 +5797,22 @@ function isCanonicalHookBlockPath(p) {
 var ManagedHookBlockPath = SafeRepoRelPath.refine(isCanonicalHookBlockPath, {
   message: `must start with one of ${CANONICAL_HOOK_BLOCK_PREFIXES.join(", ")} (byte-exact, case-sensitive)`
 });
-var ManagedBlockRecordSchema = z2.object({
+var ManagedBlockRecordSchema = z4.object({
   path: ManagedHookBlockPath,
-  marker: z2.string(),
-  comment: z2.enum(["hash", "html"])
+  marker: z4.string(),
+  comment: z4.enum(["hash", "html"])
 });
-var ManagedManifestSchema = z2.object({
-  version: z2.number().int().positive(),
-  files: z2.array(SafeRepoRelPath),
-  blocks: z2.array(ManagedBlockRecordSchema),
-  labels: z2.array(z2.string()),
-  agents: z2.array(z2.enum(AGENT_VENDORS)).optional()
+var ManagedManifestSchema = z4.object({
+  version: z4.number().int().positive(),
+  files: z4.array(SafeRepoRelPath),
+  blocks: z4.array(ManagedBlockRecordSchema),
+  labels: z4.array(z4.string()),
+  agents: z4.array(z4.enum(AGENT_VENDORS)).optional()
 });
-var ProjectEntrySchema = z2.object({
-  name: z2.string().min(1),
-  description: z2.string().min(1).optional(),
-  path: z2.string().min(1).optional()
+var ProjectEntrySchema = z4.object({
+  name: z4.string().min(1),
+  description: z4.string().min(1).optional(),
+  path: z4.string().min(1).optional()
 });
 function parseTokensCollectDeclaration(value) {
   const m = value.trim().match(/^(\S+)\s+(\S+)$/);
@@ -5103,34 +5823,55 @@ function parseTokensCollectDeclaration(value) {
     return null;
   return { interpreter, script };
 }
-var VinayaConfigSchema = z2.object({
-  rings: z2.object({
-    ring1_forgeWriteInterception: z2.boolean(),
-    ring2_asyncAudits: z2.boolean()
+var VinayaConfigSchema = z4.object({
+  rings: z4.object({
+    ring1_forgeWriteInterception: z4.boolean(),
+    ring2_asyncAudits: z4.boolean()
   }).optional(),
-  checks: z2.record(z2.string(), CheckEntrySchema).optional(),
-  roles: z2.record(z2.string(), RoleEntrySchema).optional(),
+  checks: z4.record(z4.string(), CheckEntrySchema).optional(),
+  roles: z4.record(z4.string(), RoleEntrySchema).optional(),
   briefSchema: BriefSchemaSchema.optional(),
   managed: ManagedManifestSchema.optional(),
-  principals: z2.array(z2.string()).min(1).optional(),
-  releaseActor: z2.string().min(1).optional(),
-  ci: z2.object({ setup: z2.string().min(1) }).optional(),
-  tokens: z2.object({
-    collect: z2.string().min(1).refine((v) => parseTokensCollectDeclaration(v) !== null, {
+  principals: z4.array(z4.string()).min(1).optional(),
+  releaseActor: z4.string().min(1).optional(),
+  ci: z4.object({ setup: z4.string().min(1) }).optional(),
+  tokens: z4.object({
+    collect: z4.string().min(1).refine((v) => parseTokensCollectDeclaration(v) !== null, {
       message: 'tokens.collect must be exactly "<interpreter> <repo-relative-script-path>" — two whitespace-separated tokens, no flags, no shell syntax, no quoting'
     })
   }).optional(),
-  blastRadius: z2.object({ extraDomains: z2.array(z2.string()).optional() }).optional(),
-  proseGates: z2.object({
-    doctrineRoot: z2.string().min(1).optional(),
-    readerFacingPrefix: z2.string().min(1).optional(),
-    readerFacingSuffix: z2.string().min(1).optional(),
-    legacySlugDir: z2.string().min(1).optional()
+  blastRadius: z4.object({ extraDomains: z4.array(z4.string()).optional() }).optional(),
+  proseGates: z4.object({
+    doctrineRoot: z4.string().min(1).optional(),
+    readerFacingPrefix: z4.string().min(1).optional(),
+    readerFacingSuffix: z4.string().min(1).optional(),
+    legacySlugDir: z4.string().min(1).optional()
+  }).optional(),
+  projects: z4.array(ProjectEntrySchema).optional(),
+  dispatch: z4.object({
+    timeoutMs: z4.number().int().positive().optional(),
+    killGraceMs: z4.number().int().positive().optional(),
+    agent: z4.enum(["claude", "codex", "gemini"]).optional()
+  }).optional(),
+  reviewPolicy: z4.object({
+    codeReviewThreshold: z4.string().min(1).optional(),
+    securityThreshold: z4.string().min(1).optional(),
+    maxRounds: z4.number().optional()
   }).optional(),
-  projects: z2.array(ProjectEntrySchema).optional(),
-  dispatch: z2.object({
-    timeoutMs: z2.number().int().positive().optional(),
-    agent: z2.enum(["claude", "codex", "gemini"]).optional()
+  prePush: z4.object({
+    alwaysRun: z4.array(z4.string()).optional()
+  }).optional(),
+  report: z4.object({
+    commandTimeoutMs: z4.number().int().positive().optional()
+  }).superRefine((report, ctx) => {
+    const commandTimeoutMs = report.commandTimeoutMs;
+    if (commandTimeoutMs !== undefined && commandTimeoutMs > MAX_REPORT_COMMAND_TIMEOUT_MS) {
+      ctx.addIssue({
+        code: z4.ZodIssueCode.custom,
+        path: ["commandTimeoutMs"],
+        message: "must be at most 3600000 (1 hour)"
+      });
+    }
   }).optional()
 });
 var GLOBAL_VINAYA_HOME = join(homedir(), ".vinaya");
@@ -5205,6 +5946,28 @@ function resolvePrincipalAllowlist(config) {
 function resolveReleaseActor(config) {
   return config?.releaseActor ?? DEFAULT_RELEASE_ACTOR;
 }
+function resolveReviewPolicy(config) {
+  const raw = config?.reviewPolicy;
+  if (!raw)
+    return DEFAULT_REVIEW_POLICY;
+  const codeReviewThreshold = raw.codeReviewThreshold ?? DEFAULT_REVIEW_POLICY.codeReviewThreshold;
+  if (!isKnownSeverity(CODE_REVIEW_SEVERITY_ORDER, codeReviewThreshold)) {
+    throw new Error(`vinaya.config.json: reviewPolicy.codeReviewThreshold "${codeReviewThreshold}" is not one of ${CODE_REVIEW_SEVERITY_ORDER.join(" > ")} — fix the config, this never falls back to a default.`);
+  }
+  const securityThreshold = raw.securityThreshold ?? DEFAULT_REVIEW_POLICY.securityThreshold;
+  if (!isKnownSeverity(SECURITY_SEVERITY_ORDER, securityThreshold)) {
+    throw new Error(`vinaya.config.json: reviewPolicy.securityThreshold "${securityThreshold}" is not one of ${SECURITY_SEVERITY_ORDER.join(" > ")} — fix the config, this never falls back to a default.`);
+  }
+  const maxRounds = raw.maxRounds ?? DEFAULT_REVIEW_POLICY.maxRounds;
+  if (!Number.isInteger(maxRounds) || maxRounds < 1) {
+    throw new Error(`vinaya.config.json: reviewPolicy.maxRounds "${maxRounds}" is not a positive integer — fix the config, this never falls back to a default.`);
+  }
+  return {
+    codeReviewThreshold,
+    securityThreshold,
+    maxRounds
+  };
+}
 function trustAnchorRepo() {
   const wellFormed = (slug) => /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
   const fromRunner = process.env.GITHUB_REPOSITORY?.trim();