@attalabs/vinaya 0.27.0 → 0.28.0

package/dist/checks/bin/check-exec-bits.js

@@ -3,7 +3,7 @@ import { createRequire } from "node:module";
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/checks/bin/check-exec-bits.ts
-import { execFileSync as execFileSync5 } from "node:child_process";
+import { execFileSync as execFileSync6 } from "node:child_process";
 import { readFileSync as readFileSync3 } from "node:fs";
 
 // src/checks/contract.ts
@@ -14,8 +14,8 @@ function emitCheckError(error) {
 }
 
 // src/lib/diff-evidence.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
-import { join as join2, relative, resolve as resolve2 } from "node:path";
+import { execFileSync as execFileSync5 } from "node:child_process";
+import { join as join4, relative, resolve as resolve2 } from "node:path";
 // ../../packages/aeg-core/src/gate-audience.ts
 var GATE_AUDIENCE = {
   "check-branch-topology": { shippedAs: "branch-topology", ring: 0 },
@@ -1966,6 +1966,8 @@ function parseInlineFieldList(section) {
 var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
 var OBJECTIVES_VERSION_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Objectives version:\s*([0-9a-f]{64})(?![A-Za-z0-9])/im;
 var RULING_ORDINAL_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Ruling ordinal:\s*(\d+)(?!\d)/im;
+var BRIEF_HASH_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Brief hash:\s*([0-9a-f]{64})(?![A-Za-z0-9])/im;
+var POLICY_DIGEST_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Policy digest:\s*([0-9a-f]{64})(?![A-Za-z0-9])/im;
 function firstFiveLines(comment) {
   return comment.split(`
 `).slice(0, 5).join(`
@@ -1988,6 +1990,26 @@ function extractRulingOrdinal(comment) {
   const m = firstSevenLines(comment).match(RULING_ORDINAL_PATTERN);
   return m ? Number.parseInt(m[1], 10) : null;
 }
+function firstElevenLines(comment) {
+  return comment.split(`
+`).slice(0, 11).join(`
+`);
+}
+function extractBriefHash(comment) {
+  const m = firstElevenLines(comment).match(BRIEF_HASH_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
+function extractPolicyDigest(comment) {
+  const m = firstElevenLines(comment).match(POLICY_DIGEST_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
+var FINDING_SEVERITY_LINE = /^\d+\.\s+\[([A-Z][A-Z]*)\]\s+(.+?)\s+—/gm;
+function extractFindingSeverities(comment) {
+  return [...comment.matchAll(FINDING_SEVERITY_LINE)].map((m) => ({
+    severity: m[1],
+    location: m[2]
+  }));
+}
 function extractVerdict(comments, valuePattern, missingLabel) {
   const candidates = comments.filter((c) => valuePattern.test(c));
   if (candidates.length === 0) {
@@ -1996,6 +2018,9 @@ function extractVerdict(comments, valuePattern, missingLabel) {
       headSha: null,
       objectivesVersion: null,
       rulingOrdinal: null,
+      briefHash: null,
+      policyDigest: null,
+      findingSeverities: [],
       danglingNote: `no ${missingLabel} verdict comment found on this PR`
     };
   }
@@ -2007,6 +2032,9 @@ function extractVerdict(comments, valuePattern, missingLabel) {
       headSha: null,
       objectivesVersion: null,
       rulingOrdinal: null,
+      briefHash: null,
+      policyDigest: null,
+      findingSeverities: [],
       danglingNote: `the most recent ${missingLabel} verdict comment carries a VERDICT-shaped line outside the first-five-line read window`
     };
   }
@@ -2015,6 +2043,9 @@ function extractVerdict(comments, valuePattern, missingLabel) {
     headSha: extractHeadSha(latest),
     objectivesVersion: extractObjectivesVersion(latest),
     rulingOrdinal: extractRulingOrdinal(latest),
+    briefHash: extractBriefHash(latest),
+    policyDigest: extractPolicyDigest(latest),
+    findingSeverities: extractFindingSeverities(latest),
     danglingNote: null
   };
 }
@@ -2350,6 +2381,53 @@ function evaluateC5(changed, docOwnersContent, prBody, fileExists, waiverActive,
   }
   return out;
 }
+// ../../packages/aeg-core/src/review-policy.ts
+var CODE_REVIEW_SEVERITY_ORDER = ["BLOCKER", "MAJOR", "MINOR"];
+var SECURITY_SEVERITY_ORDER = ["CRITICAL", "HIGH", "MEDIUM", "LOW"];
+var DEFAULT_MAX_ROUNDS = 3;
+var DEFAULT_REVIEW_POLICY = {
+  codeReviewThreshold: "BLOCKER",
+  securityThreshold: "HIGH",
+  maxRounds: DEFAULT_MAX_ROUNDS
+};
+var FILE_SHAPED_LOCATION = /\.[a-zA-Z0-9]{1,10}(:\d+)?\s*$/;
+var PROSE_LOCATION_PATTERNS = [/\bpr\s*body\b/i, /\bcomment\b/i];
+var ROLE_FILE_LOCATION = /(^|\/)aeg-root\/roles\//i;
+function isProseLocation(location) {
+  if (ROLE_FILE_LOCATION.test(location))
+    return true;
+  if (FILE_SHAPED_LOCATION.test(location))
+    return false;
+  return PROSE_LOCATION_PATTERNS.some((pattern) => pattern.test(location));
+}
+var PROSE_CAP_SEVERITY = "MINOR";
+function blockingSeverities(scale, threshold) {
+  const idx = scale.indexOf(threshold);
+  if (idx === -1) {
+    throw new Error(`blockingSeverities: threshold "${threshold}" is not one of ${scale.join(" > ")}`);
+  }
+  return scale.slice(0, idx + 1);
+}
+function evaluateReviewFindings(findings, scale, threshold) {
+  const blocking = new Set(blockingSeverities(scale, threshold));
+  const blockingFindings = findings.filter((f) => {
+    if (!scale.includes(f.severity)) {
+      throw new Error(`evaluateReviewFindings: severity "${f.severity}" is not one of ${scale.join(" > ")}`);
+    }
+    const effectiveSeverity = f.location !== undefined && isProseLocation(f.location) ? PROSE_CAP_SEVERITY : f.severity;
+    return blocking.has(effectiveSeverity);
+  });
+  return { outcome: blockingFindings.length > 0 ? "blocked" : "clean", blockingFindings };
+}
+function evaluateCodeReview(findings, policy) {
+  return evaluateReviewFindings(findings, CODE_REVIEW_SEVERITY_ORDER, policy.codeReviewThreshold);
+}
+function evaluateSecurityReview(findings, policy) {
+  return evaluateReviewFindings(findings, SECURITY_SEVERITY_ORDER, policy.securityThreshold);
+}
+function isKnownSeverity(scale, value) {
+  return scale.includes(value);
+}
 // ../../packages/aeg-core/src/pr-tier.ts
 var TIER_FIELD = /(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i;
 function readTierFromPrBody(prBody) {
@@ -2720,7 +2798,7 @@ function checkForField(prBody) {
     ]
   };
 }
-function checkClosesN(prBody) {
+function checkClosesNPresence(prBody) {
   const closesPattern = /(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s{0,8}:?\s{0,8}#\d+/i;
   if (closesPattern.test(stripCode(prBody))) {
     return { status: "pass", errors: [] };
@@ -2752,10 +2830,22 @@ var COMMIT_TYPES = [
   "Test"
 ];
 var COMMIT_TYPE_STYLE = new RegExp(`^(${COMMIT_TYPES.join("|")})(\\([a-z0-9-]+\\))?: \\S`);
+function checkForgeTitle(title) {
+  const taskStyle = /^\[[a-z0-9._-]+\] \S+ — \S/;
+  if (COMMIT_TYPE_STYLE.test(title) || taskStyle.test(title))
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      `brief-validation title: "${title}" matches neither title grammar — expected \`Type: description\` / \`Type(scope): description\` (commitlint types + Plan) or \`[tranche] id — description\` (task form).`
+    ]
+  };
+}
 var BRIEF_SHAPE_MARKERS = [checkSurfaceMap, checkDocUpdateList, checkStopConditions, checkAutonomyClause];
 var TASK_BRANCH_PATTERN = /^task\/[^/]+\/[^/]+$/;
+var TASK_ISSUE_BRANCH_PATTERN = /^task\/issue-\d+$/;
 function isTaskBranch(branch) {
-  return TASK_BRANCH_PATTERN.test(branch);
+  return TASK_BRANCH_PATTERN.test(branch) || TASK_ISSUE_BRANCH_PATTERN.test(branch);
 }
 function isBriefShaped(prBody) {
   const stripped = stripCode(prBody);
@@ -2877,8 +2967,9 @@ function packagesNamedIn(text) {
 }
 function hasTestPathForConsumer(text, consumerDir) {
   const escaped = consumerDir.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const re = new RegExp(`${escaped}\\/[\\w./-]*\\.test\\.[A-Za-z0-9]+`);
-  return re.test(text);
+  const filePathRe = new RegExp(`${escaped}\\/[\\w./-]*\\.test\\.[A-Za-z0-9]+`);
+  const testDirRe = new RegExp(`${escaped}\\/(?:[\\w-]+\\/)*(?:tests|specs)(?:\\/|\\b)`);
+  return filePathRe.test(text) || testDirRe.test(text);
 }
 function checkConsumerTests(prBody, consumersOf) {
   const section4 = extractNumberedSection(prBody, 4);
@@ -2982,7 +3073,7 @@ function checkBriefSections(prBody, readTier, options = {}) {
     checkConsumerTests(prBody, consumersOf),
     checkDefeatCases(prBody),
     ...issueObjectives !== undefined ? [checkObjectivesCopy(prBody, issueObjectives), checkObjectivesCoverage(prBody)] : [],
-    ...requireClosesN ? [checkClosesN(prBody)] : []
+    ...requireClosesN ? [checkClosesNPresence(prBody)] : []
   ];
   return { errors: results.flatMap((r) => r.errors) };
 }
@@ -3272,6 +3363,28 @@ function topLevelSectionText(body, headingName) {
   const next = /^##[ \t]/m.exec(afterHeading);
   return next ? afterHeading.slice(0, next.index) : afterHeading;
 }
+function partHasBacktickedPath(text) {
+  let i = 0;
+  while (i < text.length) {
+    const start = text.indexOf("`", i);
+    if (start === -1)
+      return false;
+    const end = text.indexOf("`", start + 1);
+    if (end === -1)
+      return false;
+    if (text.slice(start + 1, end).includes("/"))
+      return true;
+    i = end + 1;
+  }
+  return false;
+}
+var PART_MIN_WORDS_OUTSIDE_BACKTICKS = 3;
+function stripPartBackticks(text) {
+  return text.replace(/`[^`\n]*`/g, " ");
+}
+function partWordCount(text) {
+  return text.split(/\s+/).filter((w) => /[a-z]/i.test(w)).length;
+}
 function looksLikeFilePath(entry2) {
   const stripped = entry2.replace(/\/\*\*?$/, "");
   const lastSegment = stripped.split("/").pop() ?? stripped;
@@ -3312,6 +3425,18 @@ function globCoversPath(glob, path) {
   const p = path.replace(/\/+$/, "");
   return g === p || g.startsWith(`${p}/`) || p.startsWith(`${g}/`);
 }
+function checkSurfaceGlobsResolve(body, resolvesToFile) {
+  const surface = parseIssueSurface(body);
+  if (!surface.ok)
+    return { status: "pass", errors: [] };
+  const errors = [];
+  for (const glob of surface.value.in) {
+    if (!resolvesToFile(glob)) {
+      errors.push(`issue-validation Surface: \`${glob}\` in \`## Surface\`'s \`in:\` list matches no tracked file — a Surface that cannot resolve cannot render a brief's file list.`);
+    }
+  }
+  return { status: errors.length > 0 ? "fail" : "pass", errors };
+}
 function checkSurfaceScope(changedFiles, outGlobs) {
   if (outGlobs.length === 0)
     return { ok: true };
@@ -3323,9 +3448,77 @@ function checkSurfaceScope(changedFiles, outGlobs) {
   }
   return violations.length > 0 ? { ok: false, violations } : { ok: true };
 }
+var ISSUE_PART_LINE_RE = /^Part\s+(\d+)\s*\(([^)]*)\)\s*[-—–]\s*(.*)$/i;
+function parseIssueParts(body) {
+  const section = topLevelSectionText(body, "Parts");
+  if (section === null)
+    return { ok: false, errors: ["no `## Parts` heading found in the body."] };
+  const lines = section.split(/\r?\n/).map((l) => l.trim()).filter((l) => l.length > 0);
+  const parts = [];
+  const errors = [];
+  for (const line of lines) {
+    const m = ISSUE_PART_LINE_RE.exec(line);
+    if (!m) {
+      errors.push(`"${line}" is not a well-formed Parts line — expected \`Part <n> (<refs>) — <outcome>\`.`);
+      continue;
+    }
+    const n = Number.parseInt(m[1], 10);
+    const refs = m[2];
+    const text = m[3].trim();
+    if (text.length === 0) {
+      errors.push(`Part ${n} has no outcome text after the dash — every Part states one observable outcome.`);
+      continue;
+    }
+    if (partHasBacktickedPath(text) && partWordCount(stripPartBackticks(text)) < PART_MIN_WORDS_OUTSIDE_BACKTICKS) {
+      errors.push(`Part ${n} is little more than a file path — a Part names an outcome and symbols, never a bare path.`);
+      continue;
+    }
+    const objectiveIds = [...refs.matchAll(/O(\d+)/g)].map((r) => Number.parseInt(r[1], 10));
+    parts.push({ n, objectiveIds, text });
+  }
+  if (parts.length === 0) {
+    errors.push("the `## Parts` section has no well-formed `Part <n> (<refs>) — <outcome>` lines.");
+  }
+  if (errors.length > 0)
+    return { ok: false, errors };
+  return { ok: true, value: parts };
+}
+function checkPartsCiteDefinedObjectives(body) {
+  const parts = parseIssueParts(body);
+  const objectives = objectivesOf(body);
+  if (!parts.ok || !objectives.ok)
+    return { status: "pass", errors: [] };
+  const definedIds = new Set(objectives.objectives.map((o) => Number.parseInt(o.id.slice(1), 10)));
+  const errors = [];
+  for (const part of parts.value) {
+    for (const objectiveId of part.objectiveIds) {
+      if (!definedIds.has(objectiveId)) {
+        errors.push(`issue-validation Parts: Part ${part.n} cites O${objectiveId}, which the Issue's own \`## Objectives\` section does not define.`);
+      }
+    }
+  }
+  return { status: errors.length > 0 ? "fail" : "pass", errors };
+}
 function isTaskIssueLabelSet(labels) {
   return hasLabel("tranche", labels);
 }
+function checkTrancheLabelPresence(_body, _labels) {
+  return { status: "pass", errors: [] };
+}
+function checkMilestoneAttach(labels, currentMilestoneTitle, resolvedMilestoneTitle) {
+  if (!isTaskIssueLabelSet(labels))
+    return { status: "pass", errors: [] };
+  if (resolvedMilestoneTitle === null)
+    return { status: "pass", errors: [] };
+  if (currentMilestoneTitle === resolvedMilestoneTitle)
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      `issue-validation milestone attach: this task Issue's tranche label resolves to Milestone "${resolvedMilestoneTitle}", but its live Milestone is ${currentMilestoneTitle === null ? "unset" : `"${currentMilestoneTitle}"`} — attach it to "${resolvedMilestoneTitle}".`
+    ]
+  };
+}
 var TYPE_LABEL_IDS = LABELS.filter((l) => l.category === "type").map((l) => l.id);
 function isControlCodePoint(codePoint) {
   return codePoint <= 31 || codePoint >= 127 && codePoint <= 159;
@@ -3390,6 +3583,19 @@ function checkProjectsRegistered(body, _labels, registeredNames) {
 var DOC_PATH_RE = /(?:(?:aeg-root|apps|packages|specs|docs|tools|\.claude|\.github)\/[\w./@-]*\.(?:md|mdx)|\.claude\/(?:skills|rules)\/[\w./-]+|\b(?:docs-index|decisions|projects|state-machine|enforcement|process|README|CLAUDE)\.md\b|\b[\w-]+-(?:spec|decisions|backlog)\.md\b)/i;
 var DOC_PATH_RE_GLOBAL = new RegExp(DOC_PATH_RE.source, "gi");
 
+// ../../packages/aeg-core/src/task-branch-identity.ts
+var ISSUE_BRANCH_PATTERN = /^task\/issue-(\d+)$/;
+var TRANCHE_BRANCH_PATTERN = /^task\/([^/]+)\/([^/]+)$/;
+function parseTaskBranchIdentity(branch) {
+  const issueMatch = ISSUE_BRANCH_PATTERN.exec(branch);
+  if (issueMatch)
+    return { kind: "issue", issueNumber: Number(issueMatch[1]) };
+  const trancheMatch = TRANCHE_BRANCH_PATTERN.exec(branch);
+  if (trancheMatch)
+    return { kind: "tranche", tranche: trancheMatch[1], taskId: trancheMatch[2] };
+  return null;
+}
+
 // ../../packages/aeg-core/src/coherence-checks.ts
 var COHERENCE_ENFORCED_FROM = "2026-07-01";
 function isGrandfathered(isoDate) {
@@ -3410,6 +3616,7 @@ function checkA1(entries, principalAllowlist = PRINCIPAL_ALLOWLIST) {
       if (handClosed)
         continue;
       failures.push({
+        code: "closed-without-merge",
         issue: e.task.issue,
         tranche: e.trancheSlug,
         task: e.task.id,
@@ -3434,6 +3641,7 @@ function checkA3(entries) {
       continue;
     if (e.facts.prState === "merged" && e.facts.issueState !== "closed") {
       failures.push({
+        code: "auto-close-misfire",
         issue: e.task.issue,
         tranche: e.trancheSlug,
         task: e.task.id,
@@ -3458,6 +3666,7 @@ function checkT1(entries) {
       continue;
     if (e.facts === undefined) {
       failures.push({
+        code: "phantom-issue-ref",
         issue: e.task.issue,
         tranche: e.trancheSlug,
         task: e.task.id,
@@ -3476,6 +3685,7 @@ function checkT2(openIssuesBySlug, topologyIssuesBySlug, ciTrancheSlug) {
     for (const num of openNums) {
       if (!topologySet.has(num)) {
         failures.push({
+          code: "orphan-task",
           issue: num,
           tranche: slug,
           reason: `Issue #${num} is open and labeled ${trancheLabel(slug)} but does not appear in the topology file`
@@ -3510,6 +3720,7 @@ function checkT3(entries, ciTrancheSlug, enrichedEntries, forgeUnavailableSlugs)
         continue;
       if (forgeUnavailableSlugs?.has(e.trancheSlug)) {
         failures.push({
+          code: "tbd-in-active-tranche",
           issue: null,
           tranche: e.trancheSlug,
           task: e.task.id,
@@ -3519,6 +3730,7 @@ function checkT3(entries, ciTrancheSlug, enrichedEntries, forgeUnavailableSlugs)
         continue;
       }
       failures.push({
+        code: "tbd-in-active-tranche",
         issue: null,
         tranche: e.trancheSlug,
         task: e.task.id,
@@ -3551,6 +3763,7 @@ function checkD1(entries, issueToEntry, taskToEntry) {
       const sameIssue = depEntry.task.issue !== null && e.task.issue !== null && depEntry.task.issue === e.task.issue;
       if (sameTask || sameIssue) {
         failures.push({
+          code: "d1-self-dependency",
           issue: e.task.issue,
           tranche: e.trancheSlug,
           task: e.task.id,
@@ -3562,6 +3775,7 @@ function checkD1(entries, issueToEntry, taskToEntry) {
       const depClosed = depFacts?.issueState === "closed";
       if (!depClosed) {
         failures.push({
+          code: "dispatched-on-unmet-deps",
           issue: e.task.issue,
           tranche: e.trancheSlug,
           task: e.task.id,
@@ -3587,11 +3801,13 @@ function checkR1(issuesBySlug, grandfatheredIssues, registeredNames = []) {
       const errors = [
         ...checkIssueRationale(issue.body).errors,
         ...checkProjectsRegistered(issue.body, issue.labels, registeredNames).errors,
-        ...checkIssueObjectives(issue.body, issue.number).errors
+        ...checkIssueObjectives(issue.body, issue.number).errors,
+        ...checkPartsCiteDefinedObjectives(issue.body).errors
       ];
       if (errors.length === 0)
         continue;
       failures.push({
+        code: "missing-rationale-field",
         issue: issue.number,
         tranche: slug,
         reason: `Issue #${issue.number} fails the rationale gate: ${errors.join(" | ")}`,
@@ -3620,6 +3836,7 @@ function checkL1(files, entriesBySlug) {
     const allClosed = withFacts.every((e) => e.facts?.issueState === "closed");
     if (allClosed) {
       failures.push({
+        code: "archive-recommended",
         tranche: f.slug,
         reason: "Active tranche has no open task-Issues — consider archiving to completed/"
       });
@@ -3651,27 +3868,38 @@ function extractClosesReferences(prBody) {
   }
   return referenced;
 }
-function checkClosesN2(branch, prBody, trancheFiles, taskIssueRefs) {
+function checkClosesNTopology(branch, prBody, trancheFiles, taskIssueRefs) {
   const referenced = extractClosesReferences(prBody);
   if (taskIssueRefs) {
     for (const n of referenced) {
-      const ref = taskIssueRefs.get(n);
-      if (!ref)
+      const ref2 = taskIssueRefs.get(n);
+      if (!ref2)
         continue;
-      const expectedBranch = `task/${ref.trancheSlug}/${ref.taskId}`;
+      const expectedBranch = `task/${ref2.trancheSlug}/${ref2.taskId}`;
       if (branch !== expectedBranch) {
         return {
           ok: false,
-          message: `closes-n-reverse: branch "${branch}" closes #${n} (task ${ref.taskId} of tranche "${ref.trancheSlug}") but is not named "${expectedBranch}" — rename the branch and re-push, or if this work is intentionally outside AEG's dispatch flow, remove the Closes reference.`
+          message: `closes-n-reverse: branch "${branch}" closes #${n} (task ${ref2.taskId} of tranche "${ref2.trancheSlug}") but is not named "${expectedBranch}" — rename the branch and re-push, or if this work is intentionally outside AEG's dispatch flow, remove the Closes reference.`
         };
       }
     }
   }
-  const m = branch.match(/^task\/([^/]+)\/([^/]+)$/);
-  if (!m)
+  const ref = parseTaskBranchIdentity(branch);
+  if (!ref)
     return { ok: true };
-  const trancheSlug = m[1];
-  const taskId = m[2];
+  if (ref.kind === "issue") {
+    const expectedIssue2 = ref.issueNumber;
+    if (!referenced.has(expectedIssue2)) {
+      return {
+        ok: false,
+        expectedIssue: expectedIssue2,
+        message: `closes-n: PR body does not contain \`Closes #${expectedIssue2}\` (required for branch "${branch}"). Add it to the PR body Summary section.`
+      };
+    }
+    return { ok: true, expectedIssue: expectedIssue2 };
+  }
+  const trancheSlug = ref.tranche;
+  const taskId = ref.taskId;
   const trancheFile = trancheFiles.find((f) => f.slug === trancheSlug);
   if (!trancheFile) {
     return {
@@ -3723,34 +3951,67 @@ function extractIssue(body) {
   const issue = headerNums.length > 0 ? headerNums[0] : bodyNums[0];
   return { issue, extraIssues: bodyNums.filter((n) => n !== issue), outsideHeader: headerNums.length === 0 };
 }
-// ../../packages/aeg-core/src/review-gate.ts
-function isBoundToHead(extraction, headSha) {
-  if (!extraction.headSha)
+// ../../packages/aeg-core/src/review-input-manifest.ts
+import { createHash as createHash4 } from "node:crypto";
+function briefHash(brief) {
+  return createHash4("sha256").update(`${brief}
+`).digest("hex");
+}
+function policyDigest(policy) {
+  return createHash4("sha256").update(JSON.stringify({ codeReviewThreshold: policy.codeReviewThreshold, securityThreshold: policy.securityThreshold })).digest("hex");
+}
+function isBoundToHead(echoed, headSha) {
+  if (!echoed.headSha)
     return false;
-  return headSha.toLowerCase().startsWith(extraction.headSha.toLowerCase());
+  return headSha.toLowerCase().startsWith(echoed.headSha.toLowerCase());
 }
-function isBoundByPatchIdentity(extraction, headSha, patchIdOf) {
-  if (patchIdOf === undefined || !extraction.headSha)
+function isBoundByPatchIdentity(echoed, headSha, patchIdOf) {
+  if (patchIdOf === undefined || !echoed.headSha)
     return false;
-  const judged = patchIdOf(extraction.headSha);
+  const judged = patchIdOf(echoed.headSha);
   const current = patchIdOf(headSha);
   if (judged === null || current === null)
     return false;
   return judged === current;
 }
-function isBoundToPatch(extraction, headSha, patchIdOf) {
-  return isBoundToHead(extraction, headSha) || isBoundByPatchIdentity(extraction, headSha, patchIdOf);
+function isBoundToPatch(echoed, headSha, patchIdOf) {
+  return isBoundToHead(echoed, headSha) || isBoundByPatchIdentity(echoed, headSha, patchIdOf);
 }
-function isBoundToObjectives(extraction, currentVersion) {
+function isBoundToObjectives(echoed, currentVersion) {
   if (currentVersion === null)
     return true;
-  return extraction.objectivesVersion === currentVersion;
+  return echoed.objectivesVersion === currentVersion;
 }
-function isBoundToRulings(extraction, currentOrdinal) {
-  if (extraction.rulingOrdinal === null)
+function isBoundToRulings(echoed, currentOrdinal) {
+  if (echoed.rulingOrdinal === null)
     return currentOrdinal === 0;
-  return extraction.rulingOrdinal === currentOrdinal;
+  return echoed.rulingOrdinal === currentOrdinal;
 }
+function isBoundToBriefHash(echoed, currentHash) {
+  if (currentHash === null)
+    return true;
+  return echoed.briefHash === currentHash;
+}
+function isBoundToPolicy(echoed, currentDigest) {
+  return echoed.policyDigest === currentDigest;
+}
+function compareManifest(echoed, current, patchIdOf) {
+  const head = isBoundToPatch(echoed, current.headSha, patchIdOf);
+  const briefHashBound = isBoundToBriefHash(echoed, current.briefHash);
+  const objectivesVersion2 = isBoundToObjectives(echoed, current.objectivesVersion);
+  const rulingOrdinal = isBoundToRulings(echoed, current.rulingOrdinal);
+  const policyDigestBound = isBoundToPolicy(echoed, current.policyDigest);
+  return {
+    bound: head && briefHashBound && objectivesVersion2 && rulingOrdinal && policyDigestBound,
+    head,
+    briefHash: briefHashBound,
+    objectivesVersion: objectivesVersion2,
+    rulingOrdinal,
+    policyDigest: policyDigestBound
+  };
+}
+
+// ../../packages/aeg-core/src/review-gate.ts
 function checkReviewGate(input) {
   const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const waived = isWaiverLabelActorVerified({
@@ -3773,15 +4034,55 @@ function checkReviewGate(input) {
   const verifiedBodies = verified.map((c) => c.body);
   const codeReview = extractCodeReviewVerdict(verifiedBodies);
   const security = extractSecurityReviewVerdict(verifiedBodies);
-  const codeReviewClean = codeReview.value === "APPROVE";
-  const securityClean = security.value === "PASS";
-  const codeReviewBound = isBoundToPatch(codeReview, input.headSha, input.patchIdOf);
-  const securityBound = isBoundToPatch(security, input.headSha, input.patchIdOf);
-  const codeReviewObjectivesBound = isBoundToObjectives(codeReview, input.objectivesVersion);
-  const securityObjectivesBound = isBoundToObjectives(security, input.objectivesVersion);
-  const codeReviewRulingsBound = isBoundToRulings(codeReview, input.rulingOrdinal);
-  const securityRulingsBound = isBoundToRulings(security, input.rulingOrdinal);
-  if (codeReviewClean && codeReviewBound && codeReviewObjectivesBound && codeReviewRulingsBound && securityClean && securityBound && securityObjectivesBound && securityRulingsBound && mechanicalChecksClean) {
+  const policy = input.policy ?? DEFAULT_REVIEW_POLICY;
+  let codeReviewPolicyEvaluation;
+  let securityPolicyEvaluation;
+  try {
+    codeReviewPolicyEvaluation = evaluateCodeReview(codeReview.findingSeverities, policy);
+    securityPolicyEvaluation = evaluateSecurityReview(security.findingSeverities, policy);
+  } catch (err) {
+    return {
+      verdict: "fail",
+      reason: `a verdict comment carries a finding severity this repository's policy does not recognize: ${err instanceof Error ? err.message : String(err)}`,
+      waived: false
+    };
+  }
+  const codeReviewTextClean = codeReview.value === "APPROVE";
+  const securityTextClean = security.value === "PASS";
+  const codeReviewPolicyClean = codeReviewPolicyEvaluation.outcome === "clean";
+  const securityPolicyClean = securityPolicyEvaluation.outcome === "clean";
+  const codeReviewClean = codeReviewTextClean && codeReviewPolicyClean;
+  const securityClean = securityTextClean && securityPolicyClean;
+  const currentManifest = {
+    headSha: input.headSha,
+    briefHash: input.briefHash ?? null,
+    objectivesVersion: input.objectivesVersion,
+    rulingOrdinal: input.rulingOrdinal,
+    policyDigest: policyDigest(policy)
+  };
+  const codeReviewEchoed = {
+    headSha: codeReview.headSha,
+    briefHash: codeReview.briefHash,
+    objectivesVersion: codeReview.objectivesVersion,
+    rulingOrdinal: codeReview.rulingOrdinal,
+    policyDigest: codeReview.policyDigest
+  };
+  const securityEchoed = {
+    headSha: security.headSha,
+    briefHash: security.briefHash,
+    objectivesVersion: security.objectivesVersion,
+    rulingOrdinal: security.rulingOrdinal,
+    policyDigest: security.policyDigest
+  };
+  const codeReviewBinding = compareManifest(codeReviewEchoed, currentManifest, input.patchIdOf);
+  const securityBinding = compareManifest(securityEchoed, currentManifest, input.patchIdOf);
+  const codeReviewBound = codeReviewBinding.head;
+  const securityBound = securityBinding.head;
+  const codeReviewObjectivesBound = codeReviewBinding.objectivesVersion;
+  const securityObjectivesBound = securityBinding.objectivesVersion;
+  const codeReviewRulingsBound = codeReviewBinding.rulingOrdinal;
+  const securityRulingsBound = securityBinding.rulingOrdinal;
+  if (codeReviewClean && codeReviewBinding.bound && securityClean && securityBinding.bound && mechanicalChecksClean) {
     return {
       verdict: "pass",
       reason: `code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS, both covering head ${input.headSha}, and every reported mechanical check is green.`,
@@ -3789,23 +4090,35 @@ function checkReviewGate(input) {
     };
   }
   const problems = [];
-  if (!codeReviewClean) {
+  if (!codeReviewTextClean) {
     problems.push(`code-reviewer verdict is not a clean APPROVE (found: ${codeReview.value})`);
+  } else if (!codeReviewPolicyClean) {
+    problems.push(`code-reviewer verdict says APPROVE but carries a finding (${codeReviewPolicyEvaluation.blockingFindings.map((f) => f.severity).join(", ")}) at or above this repository's code-review policy threshold (${policy.codeReviewThreshold}) — a reviewer's own APPROVE never overrides policy`);
   } else if (!codeReviewBound) {
     problems.push(`the newest code-review verdict covers ${codeReview.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
   } else if (!codeReviewObjectivesBound) {
     problems.push(`the newest code-review verdict was cast against objectives version ${codeReview.objectivesVersion ?? "none"}, the Issue's list is now ${input.objectivesVersion}`);
   } else if (!codeReviewRulingsBound) {
     problems.push(`the newest code-review verdict was cast against ruling ordinal ${codeReview.rulingOrdinal ?? "none"}, a newer ruling (ruling ${input.rulingOrdinal}) is now posted on this PR`);
+  } else if (!codeReviewBinding.briefHash) {
+    problems.push(`the newest code-review verdict was cast against brief hash ${codeReview.briefHash ?? "none"}, the frozen brief's current hash is ${currentManifest.briefHash ?? "none"}`);
+  } else if (!codeReviewBinding.policyDigest) {
+    problems.push(`the newest code-review verdict was cast against review policy digest ${codeReview.policyDigest ?? "none"}, this repository's current policy digest is ${currentManifest.policyDigest}`);
   }
-  if (!securityClean) {
+  if (!securityTextClean) {
     problems.push(`security-review verdict is not a clean PASS (found: ${security.value})`);
+  } else if (!securityPolicyClean) {
+    problems.push(`security-review verdict says PASS but carries a finding (${securityPolicyEvaluation.blockingFindings.map((f) => f.severity).join(", ")}) at or above this repository's security policy threshold (${policy.securityThreshold}) — a reviewer's own PASS never overrides policy`);
   } else if (!securityBound) {
     problems.push(`the newest security-review verdict covers ${security.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
   } else if (!securityObjectivesBound) {
     problems.push(`the newest security-review verdict was cast against objectives version ${security.objectivesVersion ?? "none"}, the Issue's list is now ${input.objectivesVersion}`);
   } else if (!securityRulingsBound) {
     problems.push(`the newest security-review verdict was cast against ruling ordinal ${security.rulingOrdinal ?? "none"}, a newer ruling (ruling ${input.rulingOrdinal}) is now posted on this PR`);
+  } else if (!securityBinding.briefHash) {
+    problems.push(`the newest security-review verdict was cast against brief hash ${security.briefHash ?? "none"}, the frozen brief's current hash is ${currentManifest.briefHash ?? "none"}`);
+  } else if (!securityBinding.policyDigest) {
+    problems.push(`the newest security-review verdict was cast against review policy digest ${security.policyDigest ?? "none"}, this repository's current policy digest is ${currentManifest.policyDigest}`);
   }
   if (!mechanicalChecksClean) {
     problems.push(reportedMechanicalChecks.length === 0 ? "no mechanical checks have reported for this head yet" : `mechanical check(s) not green: ${reportedMechanicalChecks.filter((c) => c.bucket !== "pass").map((c) => `${c.name} (${c.bucket})`).join(", ")}`);
@@ -4497,42 +4810,45 @@ function checkDispatchReadiness(input) {
   const { trancheSlug, task } = input;
   const taskLabel = `task ${task.id} (tranche ${trancheSlug})`;
   const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
-  const blockers = [];
+  const blockerDetails = [];
+  const push = (blockerClass, message) => {
+    blockerDetails.push({ class: blockerClass, message });
+  };
   if (task.issue === null) {
-    blockers.push(`dispatch-gate issue-existence: ${taskLabel} has no Issue (#TBD or blank) in the topology — not dispatchable until the Planner cuts the Issue.`);
+    push("issue-existence", `dispatch-gate issue-existence: ${taskLabel} has no Issue (#TBD or blank) in the topology — not dispatchable until the Planner cuts the Issue.`);
   } else if (input.issue === null) {
-    blockers.push(`dispatch-gate issue-existence: ${taskLabel} names Issue #${task.issue}, but it does not resolve to a real GitHub Issue (phantom reference).`);
+    push("issue-existence", `dispatch-gate issue-existence: ${taskLabel} names Issue #${task.issue}, but it does not resolve to a real GitHub Issue (phantom reference).`);
   }
   if (input.issue !== null && !input.issueRationalePass) {
-    blockers.push(`dispatch-gate rationale: Issue #${input.issue.number} for ${taskLabel} fails the rationale gate (checkIssueRationale) — the Planner must complete the eight-field rationale before this task is dispatchable.`);
+    push("rationale", `dispatch-gate rationale: Issue #${input.issue.number} for ${taskLabel} fails the rationale gate (checkIssueRationale) — the Planner must complete the eight-field rationale before this task is dispatchable.`);
   }
   for (const dep of input.dependsOn) {
     if (isSelfDependency(dep, task, input.issue)) {
       const issueStr = input.issue !== null ? `#${input.issue.number}` : "?";
-      blockers.push(`dispatch-gate INTERNAL: parsed a self-dependency for task ${task.id} (${issueStr}) — this is a parser bug in parseRationaleDeps, not a real dependency. Please report it upstream. Re-run once the rationale is corrected or the fix ships.`);
+      push("internal-self-dependency", `dispatch-gate INTERNAL: parsed a self-dependency for task ${task.id} (${issueStr}) — this is a parser bug in parseRationaleDeps, not a real dependency. Please report it upstream. Re-run once the rationale is corrected or the fix ships.`);
       continue;
     }
     if (dep.resolved === false) {
-      blockers.push(`dispatch-gate depends-on: ${taskLabel} depends on "${dep.id}", which is UNRESOLVABLE — the resolver could not find a matching tranche/task/Issue for this edge (not a claim about merge status). Not dispatchable until the edge is corrected.`);
+      push("depends-on-unresolvable", `dispatch-gate depends-on: ${taskLabel} depends on "${dep.id}", which is UNRESOLVABLE — the resolver could not find a matching tranche/task/Issue for this edge (not a claim about merge status). Not dispatchable until the edge is corrected.`);
       continue;
     }
     if (!dep.merged && !isHandClosedByRecognizedPrincipal(dep, principalAllowlist)) {
       const issueStr = dep.issue !== null ? ` (#${dep.issue})` : "";
-      blockers.push(`dispatch-gate depends-on: ${taskLabel} depends on ${dep.id}${issueStr}, whose PR is not merged yet — not dispatchable, it serializes behind it.`);
+      push("depends-on-not-merged", `dispatch-gate depends-on: ${taskLabel} depends on ${dep.id}${issueStr}, whose PR is not merged yet — not dispatchable, it serializes behind it.`);
     }
   }
   for (const c of input.conflictsWith) {
     if (c.openOrInFlight) {
       const issueStr = c.issue !== null ? ` (#${c.issue})` : "";
-      blockers.push(`dispatch-gate conflicts-with: ${taskLabel} conflicts with ${c.id}${issueStr}, whose PR is open or in-flight — not dispatchable until it merges.`);
+      push("conflicts-with", `dispatch-gate conflicts-with: ${taskLabel} conflicts with ${c.id}${issueStr}, whose PR is open or in-flight — not dispatchable until it merges.`);
     }
   }
   for (const proj of input.priorTrancheArchival) {
     if (proj.priorTrancheSlug !== null && !proj.archived) {
-      blockers.push(`dispatch-gate prior-tranche-archival: project \`${proj.project}\`'s previous tranche \`${proj.priorTrancheSlug}\` is not archived — the Tranche Archivist must run before new work on this product.`);
+      push("prior-tranche-archival", `dispatch-gate prior-tranche-archival: project \`${proj.project}\`'s previous tranche \`${proj.priorTrancheSlug}\` is not archived — the Tranche Archivist must run before new work on this product.`);
     }
   }
-  return { ready: blockers.length === 0, blockers };
+  return { ready: blockerDetails.length === 0, blockers: blockerDetails.map((b) => b.message), blockerDetails };
 }
 // ../../packages/aeg-core/src/single-plan-pr.ts
 function trancheSlugFromTopologyPath(path) {
@@ -4634,6 +4950,91 @@ function checkBranchTopology(input) {
     reason: `Branch \`${branch}\` matches topology row \`${taskId}\` in ${topoPath}.`
   };
 }
+// ../../packages/aeg-core/src/task-tools.ts
+import { z } from "zod";
+var TASK_TOOL_ERROR_KINDS = [
+  "validation",
+  "authority",
+  "precondition",
+  "capability",
+  "infrastructure",
+  "cancellation",
+  "timeout",
+  "uncertain_effect"
+];
+var TaskToolErrorSchema = z.object({
+  kind: z.enum(TASK_TOOL_ERROR_KINDS),
+  message: z.string().min(1),
+  detail: z.string().optional()
+});
+var TaskToolRefSchema = z.union([
+  z.object({ tranche: z.string().min(1), id: z.string().min(1) }),
+  z.object({ issue: z.number().int().positive() })
+]);
+var MAX_PAGE_LIMIT = 100;
+var PageRequestSchema = z.object({
+  cursor: z.string().optional(),
+  limit: z.number().int().positive().max(MAX_PAGE_LIMIT).optional()
+});
+var FreshnessSchema = z.enum(["fresh", "stale", "unknown"]);
+var ObservedSchema = z.object({
+  observedAt: z.string(),
+  freshness: FreshnessSchema
+});
+var TaskStatusInputSchema = z.object({
+  task: TaskToolRefSchema.optional()
+}).merge(PageRequestSchema);
+var TaskStatusItemSchema = z.object({
+  task: TaskToolRefSchema,
+  issue: z.number().int().positive(),
+  pr: z.number().int().positive().nullable(),
+  state: z.string()
+}).merge(ObservedSchema);
+var TaskStatusResultSchema = z.object({
+  items: z.array(TaskStatusItemSchema),
+  nextCursor: z.string().nullable()
+});
+var RequestedAuthoritySchema = z.enum(["planner", "principal", "operator", "self"]);
+var EscalationInputsSchema = z.object({
+  task: z.number().int().positive(),
+  round: z.number().int().nonnegative(),
+  head: z.string(),
+  branch: z.string(),
+  prNumber: z.number().int().positive()
+});
+var EscalationEvidenceSchema = z.object({
+  round: z.number().int().nonnegative(),
+  reviewer: z.string().nullable(),
+  security: z.string().nullable()
+});
+var TaskEscalationReadInputSchema = z.object({
+  task: TaskToolRefSchema
+}).merge(PageRequestSchema);
+var TaskEscalationPacketSchema = z.object({
+  reason: z.string(),
+  detail: z.string().nullable(),
+  inputs: EscalationInputsSchema.nullable(),
+  evidence: EscalationEvidenceSchema.nullable(),
+  attemptedRecovery: z.string(),
+  requestedAuthority: RequestedAuthoritySchema,
+  permittedNextActions: z.array(z.string())
+}).merge(ObservedSchema);
+var TaskEscalationReadResultSchema = z.object({
+  items: z.array(TaskEscalationPacketSchema),
+  nextCursor: z.string().nullable()
+}).merge(ObservedSchema);
+var TaskStartInputSchema = z.object({
+  tranche: z.string().min(1),
+  id: z.string().min(1)
+});
+var TaskResumeInputSchema = z.object({
+  task: TaskToolRefSchema
+});
+var TaskCancelInputSchema = z.object({
+  task: TaskToolRefSchema,
+  reason: z.string().min(1)
+});
+var NoResultSchema = z.never();
 // ../../packages/aeg-core/src/first-push-dispatch-gate.ts
 function parseTaskBranch(branch) {
   const m = /^task\/([^/]+)\/([^/]+)$/.exec(branch);
@@ -4717,7 +5118,6 @@ function decideIssueAssignment(input) {
   };
 }
 // ../../packages/aeg-core/src/test-plan-gate.ts
-var TASK_BRANCH_PATTERN2 = /^task\/[^/]+\/[^/]+$/;
 function evaluateTestPlanGate(body, branch) {
   if (!body) {
     return {
@@ -4730,7 +5130,7 @@ function evaluateTestPlanGate(body, branch) {
   }
   const located = locateTestPlanSection(body);
   if (!located.found) {
-    if (TASK_BRANCH_PATTERN2.test(branch)) {
+    if (parseTaskBranchIdentity(branch) !== null) {
       return {
         verdict: "fail",
         messages: [
@@ -4858,7 +5258,7 @@ function findWorkspaceEscapes(files, knownPaths, workspaceDirs = DEFAULT_WORKSPA
   return findings;
 }
 // ../../packages/aeg-core/src/log/schema.ts
-import { z } from "zod";
+import { z as z2 } from "zod";
 var ROLE_VALUES = [
   "planner",
   "developer",
@@ -4868,136 +5268,172 @@ var ROLE_VALUES = [
   "archivist",
   "architect"
 ];
-var RoleSchema = z.enum(ROLE_VALUES);
+var RoleSchema = z2.enum(ROLE_VALUES);
 var HOST_VALUES = ["hook", "ci", "cli", "loop"];
-var HostSchema = z.enum(HOST_VALUES);
+var HostSchema = z2.enum(HOST_VALUES);
 var RUN_ID_PATTERN = /^[A-Za-z0-9_.-]{1,128}$/;
-var HeaderMetaSchema = z.object({
-  schema: z.literal(1),
-  ts: z.string(),
-  run_id: z.string().regex(RUN_ID_PATTERN),
-  seq: z.number().int().nonnegative(),
-  repo: z.string().nullable(),
-  vinaya: z.string(),
-  doctrine: z.string(),
+var headerMetaCore = {
+  ts: z2.string(),
+  run_id: z2.string().regex(RUN_ID_PATTERN),
+  seq: z2.number().int().nonnegative(),
+  repo: z2.string().nullable(),
+  vinaya: z2.string(),
+  doctrine: z2.string(),
   host: HostSchema,
-  machine: z.string()
+  machine: z2.string()
+};
+var HeaderMetaV1Schema = z2.object({
+  schema: z2.literal(1),
+  ...headerMetaCore
+}).strict();
+var LineageSchema = z2.object({
+  run: z2.string().nullable(),
+  attempt: z2.number().int().nullable(),
+  parent: z2.string().nullable()
+}).strict();
+var InputVersionsSchema = z2.object({
+  objectives_version: z2.string().nullable(),
+  brief_hash: z2.string().nullable(),
+  ruling_ordinal: z2.number().int().nullable(),
+  policy_digest: z2.string().nullable()
+}).strict();
+var ProvenanceSchema = z2.enum(["parent_attributed", "env_correlated", "self_reported", "unavailable"]);
+var HeaderMetaV2Schema = z2.object({
+  schema: z2.literal(2),
+  ...headerMetaCore,
+  event_id: z2.string().min(1),
+  process_id: z2.string().min(1),
+  actor_id: z2.string().nullable(),
+  lineage: LineageSchema,
+  input_versions: InputVersionsSchema,
+  provenance: ProvenanceSchema
 }).strict();
-var SubjectSchema = z.object({
-  issue: z.number().int().nullable(),
-  pr: z.number().int().optional(),
-  sha: z.string().optional(),
-  role: z.union([RoleSchema, z.literal("unattributed")]),
-  round: z.number().int().optional(),
-  objectives_version: z.string().optional()
+var HeaderMetaSchema = z2.discriminatedUnion("schema", [HeaderMetaV1Schema, HeaderMetaV2Schema]);
+var SubjectSchema = z2.object({
+  issue: z2.number().int().nullable(),
+  pr: z2.number().int().optional(),
+  sha: z2.string().optional(),
+  role: z2.union([RoleSchema, z2.literal("unattributed")]),
+  round: z2.number().int().optional(),
+  objectives_version: z2.string().optional()
 }).strict();
-var HeaderSchema = z.object({
+var HeaderSchema = z2.object({
   meta: HeaderMetaSchema,
   subject: SubjectSchema
 }).strict();
 var envelopeTail = {
-  duration_ms: z.number().nonnegative().optional(),
-  payload: z.object({}).strict()
+  duration_ms: z2.number().nonnegative().optional(),
+  payload: z2.object({}).strict()
 };
-var DispatchOutcomeSchema = z.discriminatedUnion("type", [
-  z.object({ type: z.literal("pr_opened"), pr: z.number().int(), head: z.string() }).strict(),
-  z.object({
-    type: z.literal("round_pushed"),
-    pr: z.number().int(),
-    head: z.string(),
-    comment_id: z.number().int()
+var ReviewFindingSchema = z2.object({
+  id: z2.string(),
+  severity: z2.string(),
+  state: z2.string().optional(),
+  severity_scale: z2.string().optional(),
+  policy_treatment: z2.enum(["blocking", "non_blocking", "unavailable"]).optional(),
+  confidence: z2.number().min(0).max(1).optional(),
+  confidence_scale: z2.string().optional(),
+  confidence_source: z2.string().optional()
+}).strict();
+var DispatchOutcomeSchema = z2.discriminatedUnion("type", [
+  z2.object({ type: z2.literal("pr_opened"), pr: z2.number().int(), head: z2.string() }).strict(),
+  z2.object({
+    type: z2.literal("round_pushed"),
+    pr: z2.number().int(),
+    head: z2.string(),
+    comment_id: z2.number().int()
   }).strict(),
-  z.object({
-    type: z.literal("verdict"),
-    verdict: z.enum(["APPROVE", "REQUEST CHANGES", "PASS", "FAIL"]),
-    head: z.string(),
-    comment_id: z.number().int(),
-    objectives: z.array(z.object({ id: z.string(), met: z.boolean() }).strict()),
-    findings: z.array(z.object({ id: z.string(), severity: z.string(), state: z.string().optional() }).strict())
+  z2.object({
+    type: z2.literal("verdict"),
+    verdict: z2.enum(["APPROVE", "REQUEST CHANGES", "PASS", "FAIL"]),
+    head: z2.string(),
+    comment_id: z2.number().int(),
+    objectives: z2.array(z2.object({ id: z2.string(), met: z2.boolean() }).strict()),
+    findings: z2.array(ReviewFindingSchema)
   }).strict(),
-  z.object({
-    type: z.literal("escalation"),
-    class: z.enum(["authority", "strategy", "product"]),
-    comment_id: z.number().int()
+  z2.object({
+    type: z2.literal("escalation"),
+    class: z2.enum(["authority", "strategy", "product"]),
+    comment_id: z2.number().int()
   }).strict(),
-  z.object({ type: z.literal("brief"), comment_id: z.number().int(), hash: z.string() }).strict(),
-  z.object({ type: z.literal("plan"), issues: z.array(z.number().int()) }).strict(),
-  z.object({ type: z.literal("archive"), provenance_comment_id: z.number().int() }).strict()
+  z2.object({ type: z2.literal("brief"), comment_id: z2.number().int(), hash: z2.string() }).strict(),
+  z2.object({ type: z2.literal("plan"), issues: z2.array(z2.number().int()) }).strict(),
+  z2.object({ type: z2.literal("archive"), provenance_comment_id: z2.number().int() }).strict()
 ]);
 var dispatchShared = {
   meta: HeaderMetaSchema,
   subject: SubjectSchema,
-  kind: z.literal("dispatch"),
+  kind: z2.literal("dispatch"),
   ...envelopeTail,
   target_role: RoleSchema,
-  model: z.string(),
-  round: z.number().int().optional(),
-  effect_id: z.string()
+  model: z2.string(),
+  round: z2.number().int().optional(),
+  effect_id: z2.string()
 };
-var dispatchUsageField = z.object({ input: z.number().nonnegative(), output: z.number().nonnegative() }).strict().nullable();
-var DispatchEventSchema = z.discriminatedUnion("event", [
-  z.object({ ...dispatchShared, event: z.literal("dispatched"), prompt_hash: z.string() }).strict(),
-  z.object({
+var dispatchUsageField = z2.object({ input: z2.number().nonnegative(), output: z2.number().nonnegative() }).strict().nullable();
+var DispatchEventSchema = z2.discriminatedUnion("event", [
+  z2.object({ ...dispatchShared, event: z2.literal("dispatched"), prompt_hash: z2.string() }).strict(),
+  z2.object({
     ...dispatchShared,
-    event: z.literal("outcome_received"),
+    event: z2.literal("outcome_received"),
     outcome: DispatchOutcomeSchema,
     usage: dispatchUsageField
   }).strict(),
-  z.object({
+  z2.object({
     ...dispatchShared,
-    event: z.literal("dispatch_failed"),
-    reason: z.enum(["timeout", "crash", "refused", "unattributed_write"]),
+    event: z2.literal("dispatch_failed"),
+    reason: z2.enum(["timeout", "crash", "refused", "unattributed_write"]),
     usage: dispatchUsageField
   }).strict()
 ]);
 var loopShared = {
   meta: HeaderMetaSchema,
   subject: SubjectSchema,
-  kind: z.literal("dev_review_loop"),
+  kind: z2.literal("dev_review_loop"),
   ...envelopeTail,
-  loop_id: z.string()
+  loop_id: z2.string()
 };
-var DevReviewLoopEventSchema = z.discriminatedUnion("event", [
-  z.object({
+var DevReviewLoopEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
     ...loopShared,
-    event: z.literal("loop_started"),
-    task: z.number().int(),
-    policy: z.object({
-      max_rounds: z.number().int().nonnegative(),
-      reviewers: z.array(RoleSchema),
-      models: z.record(RoleSchema, z.string())
+    event: z2.literal("loop_started"),
+    task: z2.number().int(),
+    policy: z2.object({
+      max_rounds: z2.number().int().nonnegative(),
+      reviewers: z2.array(RoleSchema),
+      models: z2.record(RoleSchema, z2.string())
     }).strict()
   }).strict(),
-  z.object({ ...loopShared, event: z.literal("round_started"), round: z.number().int(), base_head: z.string() }).strict(),
-  z.object({
+  z2.object({ ...loopShared, event: z2.literal("round_started"), round: z2.number().int(), base_head: z2.string() }).strict(),
+  z2.object({
     ...loopShared,
-    event: z.literal("gate_result_read"),
-    round: z.number().int(),
-    head: z.string(),
-    green: z.boolean()
+    event: z2.literal("gate_result_read"),
+    round: z2.number().int(),
+    head: z2.string(),
+    green: z2.boolean()
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("verdicts_read"),
-    round: z.number().int(),
-    head: z.string(),
-    all_approve: z.boolean(),
-    blockers: z.number().int().nonnegative()
+    event: z2.literal("verdicts_read"),
+    round: z2.number().int(),
+    head: z2.string(),
+    all_approve: z2.boolean(),
+    blockers: z2.number().int().nonnegative()
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("findings_compared"),
-    round: z.number().int(),
-    open: z.array(z.string()),
-    resolved: z.array(z.string()),
-    new: z.array(z.string()),
-    recurring: z.array(z.string())
+    event: z2.literal("findings_compared"),
+    round: z2.number().int(),
+    open: z2.array(z2.string()),
+    resolved: z2.array(z2.string()),
+    new: z2.array(z2.string()),
+    recurring: z2.array(z2.string())
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("stop_condition_met"),
-    round: z.number().int(),
-    condition: z.enum([
+    event: z2.literal("stop_condition_met"),
+    round: z2.number().int(),
+    condition: z2.enum([
       "green",
       "max_rounds",
       "no_progress",
@@ -5007,42 +5443,49 @@ var DevReviewLoopEventSchema = z.discriminatedUnion("event", [
       "reappearance"
     ])
   }).strict(),
-  z.object({
+  z2.object({
+    ...loopShared,
+    event: z2.literal("paused"),
+    round: z2.number().int(),
+    reason: z2.enum(["escalation", "principal_item", "refreeze_needed"])
+  }).strict(),
+  z2.object({
     ...loopShared,
-    event: z.literal("paused"),
-    round: z.number().int(),
-    reason: z.enum(["escalation", "principal_item", "refreeze_needed"])
+    event: z2.literal("resumed"),
+    round: z2.number().int(),
+    by: z2.literal("principal")
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("resumed"),
-    round: z.number().int(),
-    by: z.literal("principal")
+    event: z2.literal("unpushed_work_resume"),
+    round: z2.number().int(),
+    branch: z2.string(),
+    detail: z2.string()
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("round_ended"),
-    round: z.number().int(),
-    base_head: z.string(),
-    head: z.string(),
-    files_changed: z.number().int().nonnegative(),
-    insertions: z.number().int().nonnegative(),
-    deletions: z.number().int().nonnegative(),
-    wall_ms: z.number().nonnegative(),
-    outcome: z.enum(["green", "changes_requested", "escalated"])
+    event: z2.literal("round_ended"),
+    round: z2.number().int(),
+    base_head: z2.string(),
+    head: z2.string(),
+    files_changed: z2.number().int().nonnegative(),
+    insertions: z2.number().int().nonnegative(),
+    deletions: z2.number().int().nonnegative(),
+    wall_ms: z2.number().nonnegative(),
+    outcome: z2.enum(["green", "changes_requested", "escalated"])
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("journal_finalized"),
-    rounds: z.number().int().nonnegative(),
-    total_wall_ms: z.number().nonnegative(),
-    time_to_green_ms: z.number().nonnegative().nullable(),
-    files_changed_total: z.number().int().nonnegative(),
-    final_head: z.string(),
-    result: z.enum(["merged_ready", "stopped"])
+    event: z2.literal("journal_finalized"),
+    rounds: z2.number().int().nonnegative(),
+    total_wall_ms: z2.number().nonnegative(),
+    time_to_green_ms: z2.number().nonnegative().nullable(),
+    files_changed_total: z2.number().int().nonnegative(),
+    final_head: z2.string(),
+    result: z2.enum(["merged_ready", "stopped"])
   }).strict()
 ]);
-var ForgeOpSchema = z.enum([
+var ForgeOpSchema = z2.enum([
   "pr.create",
   "pr.comment",
   "pr.body.replace",
@@ -5056,50 +5499,238 @@ var ForgeOpSchema = z.enum([
   "label.add",
   "label.remove"
 ]);
-var ForgeWriteTargetSchema = z.object({
-  issue: z.number().int().optional(),
-  pr: z.number().int().optional()
+var ForgeWriteTargetSchema = z2.object({
+  issue: z2.number().int().optional(),
+  pr: z2.number().int().optional()
 }).strict();
 var forgeWriteShared = {
   meta: HeaderMetaSchema,
   subject: SubjectSchema,
-  kind: z.literal("forge_write"),
+  kind: z2.literal("forge_write"),
   ...envelopeTail,
   op: ForgeOpSchema,
   target: ForgeWriteTargetSchema
 };
-var ForgeWriteEventSchema = z.discriminatedUnion("event", [
-  z.object({ ...forgeWriteShared, event: z.literal("validated") }).strict(),
-  z.object({ ...forgeWriteShared, event: z.literal("refused"), reason: z.string() }).strict(),
-  z.object({ ...forgeWriteShared, event: z.literal("written"), comment_ids: z.array(z.string()) }).strict()
+var ForgeWriteEventSchema = z2.discriminatedUnion("event", [
+  z2.object({ ...forgeWriteShared, event: z2.literal("validated") }).strict(),
+  z2.object({ ...forgeWriteShared, event: z2.literal("refused"), reason: z2.string() }).strict(),
+  z2.object({ ...forgeWriteShared, event: z2.literal("written"), comment_ids: z2.array(z2.string()) }).strict()
+]);
+var GateOutcomeSchema = z2.enum([
+  "pass",
+  "fail",
+  "wait",
+  "skip",
+  "invalid_input",
+  "unavailable_dependency",
+  "timeout",
+  "cancelled"
+]);
+var gateShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("gate"),
+  ...envelopeTail,
+  check: z2.string(),
+  check_version: z2.string().nullable(),
+  policy_version: z2.string().nullable(),
+  input_fingerprint: z2.string().nullable()
+};
+var GateEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...gateShared,
+    event: z2.literal("checked"),
+    outcome: GateOutcomeSchema,
+    reason: z2.string().optional()
+  }).strict()
+]);
+var OperationResultSchema = z2.enum(["ok", "error", "refused", "timeout", "cancelled", "unavailable"]);
+var operationShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("operation"),
+  ...envelopeTail,
+  operation: z2.string(),
+  target: z2.string().nullable()
+};
+var OperationEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...operationShared,
+    event: z2.literal("completed"),
+    result: OperationResultSchema,
+    error_class: z2.string().nullable()
+  }).strict()
 ]);
-var LogEventSchema = z.union([DispatchEventSchema, DevReviewLoopEventSchema, ForgeWriteEventSchema]);
+var UsageUnitsSchema = z2.object({
+  input: z2.number().nonnegative().nullable(),
+  output: z2.number().nonnegative().nullable(),
+  cache: z2.number().nonnegative().nullable()
+}).strict();
+var usageShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("usage"),
+  ...envelopeTail,
+  model: z2.string().nullable(),
+  source: z2.string(),
+  semantics: z2.enum(["cumulative", "delta"])
+};
+var UsageEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...usageShared,
+    event: z2.literal("observed"),
+    units: UsageUnitsSchema,
+    unknown_reason: z2.string().nullable()
+  }).strict()
+]);
+var RoleAttemptOutcomeSchema = z2.enum([
+  "completed",
+  "incomplete",
+  "infrastructure_failed",
+  "cancelled",
+  "timed_out",
+  "capability_refused"
+]);
+var roleAttemptShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("role_attempt"),
+  ...envelopeTail,
+  actor: z2.string().nullable(),
+  attempt: z2.number().int().nullable()
+};
+var RoleAttemptEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...roleAttemptShared,
+    event: z2.literal("attempted"),
+    outcome: RoleAttemptOutcomeSchema,
+    usage: dispatchUsageField
+  }).strict()
+]);
+var handoffShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("handoff"),
+  ...envelopeTail,
+  class: z2.enum(["authority", "strategy", "product"]),
+  reason: z2.string()
+};
+var HandoffEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...handoffShared,
+    event: z2.literal("raised"),
+    requested_decision: z2.string().nullable()
+  }).strict(),
+  z2.object({
+    ...handoffShared,
+    event: z2.literal("resolved"),
+    resolution: z2.string().nullable(),
+    resolved_by: z2.string().nullable()
+  }).strict()
+]);
+var EffectTargetSchema = z2.object({
+  kind: z2.string(),
+  ref: z2.string()
+}).strict();
+var effectShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("effect"),
+  ...envelopeTail,
+  effect_id: z2.string(),
+  target: EffectTargetSchema
+};
+var EffectEventSchema = z2.discriminatedUnion("event", [
+  z2.object({ ...effectShared, event: z2.literal("attempted") }).strict(),
+  z2.object({ ...effectShared, event: z2.literal("observed"), outcome: z2.enum(["success", "failure", "uncertain"]) }).strict(),
+  z2.object({ ...effectShared, event: z2.literal("verified"), outcome: z2.enum(["success", "failure", "uncertain"]) }).strict()
+]);
+var LogEventSchema = z2.union([
+  DispatchEventSchema,
+  DevReviewLoopEventSchema,
+  ForgeWriteEventSchema,
+  GateEventSchema,
+  OperationEventSchema,
+  UsageEventSchema,
+  RoleAttemptEventSchema,
+  HandoffEventSchema,
+  EffectEventSchema
+]);
+// ../../packages/aeg-core/src/dev-review-loop/journal-reconstruction.ts
+var STOPPED_CONDITIONS = new Set(["confidence", "reappearance", "no_progress", "max_rounds"]);
+// ../../packages/aeg-core/src/control-store/records.ts
+import { z as z3 } from "zod";
+var isoTimestamp = z3.string().min(1);
+var taskId = z3.number().int().positive();
+var epochNumber = z3.number().int().nonnegative();
+var RunRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("run"),
+  task: taskId,
+  runId: z3.string().min(1),
+  pid: z3.number().int().positive(),
+  host: z3.string().min(1),
+  startedAt: isoTimestamp
+}).strict();
+var InputRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("input"),
+  task: taskId,
+  runId: z3.string().min(1),
+  source: z3.union([z3.literal("fresh"), z3.literal("resume")]),
+  pr: z3.number().int().positive().nullable(),
+  round: z3.number().int().nonnegative(),
+  recordedAt: isoTimestamp
+}).strict();
+var OwnershipRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("ownership"),
+  task: taskId,
+  epoch: epochNumber,
+  ownerId: z3.string().min(1),
+  pid: z3.number().int().positive(),
+  host: z3.string().min(1),
+  acquiredAt: isoTimestamp
+}).strict();
+var TransitionRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("transition"),
+  task: taskId,
+  epoch: epochNumber,
+  seq: z3.number().int().nonnegative(),
+  from: z3.string().min(1),
+  to: z3.string().min(1),
+  detail: z3.string().optional(),
+  at: isoTimestamp
+}).strict();
 // src/lib/config.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync as readFileSync2, realpathSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
-import { z as z2 } from "zod";
+import { z as z4 } from "zod";
 
 // src/lib/agent-vendors.ts
 var AGENT_VENDORS = ["skills", "claude", "gemini"];
 
 // src/lib/config.ts
-var EnvEntrySchema = z2.union([
-  z2.literal(true),
-  z2.object({ optional: z2.literal(true) }),
-  z2.object({ anyOf: z2.array(z2.string()).min(2) }),
-  z2.string()
+var EnvEntrySchema = z4.union([
+  z4.literal(true),
+  z4.object({ optional: z4.literal(true) }),
+  z4.object({ anyOf: z4.array(z4.string()).min(2) }),
+  z4.string()
 ]);
-var CheckEntrySchema = z2.object({
-  run: z2.string(),
-  scope: z2.enum(["diff", "full"]),
-  include: z2.array(z2.string()).optional(),
-  args: z2.array(z2.string()).optional(),
-  timeoutMs: z2.number().optional(),
-  env: z2.record(z2.string(), EnvEntrySchema).optional(),
-  requiresOpenPr: z2.boolean().optional(),
-  ownWorkflow: z2.boolean().optional()
+var CheckEntrySchema = z4.object({
+  run: z4.string(),
+  scope: z4.enum(["diff", "full"]),
+  include: z4.array(z4.string()).optional(),
+  args: z4.array(z4.string()).optional(),
+  timeoutMs: z4.number().optional(),
+  env: z4.record(z4.string(), EnvEntrySchema).optional(),
+  requiresOpenPr: z4.boolean().optional(),
+  ownWorkflow: z4.boolean().optional(),
+  principalOwed: z4.literal(true).optional(),
+  validates: z4.enum(["body", "issue"]).optional()
 }).superRefine((entry2, ctx) => {
   if (!entry2.env)
     return;
@@ -5109,25 +5740,26 @@ var CheckEntrySchema = z2.object({
     const members = value.anyOf;
     if (new Set(members).size !== members.length) {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z4.ZodIssueCode.custom,
         message: `env.${key}.anyOf has duplicate members`,
         path: ["env", key, "anyOf"]
       });
     }
     if (!members.includes(key)) {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z4.ZodIssueCode.custom,
         message: `env.${key}.anyOf must include "${key}" itself as a member`,
         path: ["env", key, "anyOf"]
       });
     }
   }
 });
-var RoleEntrySchema = z2.object({
-  contract: z2.string().refine((p) => p.includes("/"), {
+var RoleEntrySchema = z4.object({
+  contract: z4.string().refine((p) => p.includes("/"), {
     message: 'must be a path (contain at least one "/"), not a bare filename'
   })
 });
+var MAX_REPORT_COMMAND_TIMEOUT_MS = 3600000;
 var BRIEF_BUILTINS = [
   "tier",
   "testPlan",
@@ -5147,17 +5779,17 @@ var BRIEF_BUILTINS = [
   "briefSections",
   "milestoneShape"
 ];
-var BriefSectionSchema = z2.union([
-  z2.object({ builtin: z2.enum(BRIEF_BUILTINS) }),
-  z2.object({ heading: z2.string().min(1), name: z2.string().optional() }),
-  z2.object({ field: z2.string().min(1), name: z2.string().optional() }),
-  z2.object({ phrase: z2.string().min(1), name: z2.string().optional() })
+var BriefSectionSchema = z4.union([
+  z4.object({ builtin: z4.enum(BRIEF_BUILTINS) }),
+  z4.object({ heading: z4.string().min(1), name: z4.string().optional() }),
+  z4.object({ field: z4.string().min(1), name: z4.string().optional() }),
+  z4.object({ phrase: z4.string().min(1), name: z4.string().optional() })
 ]);
-var BriefSchemaSchema = z2.object({
-  pr: z2.object({ sections: z2.array(BriefSectionSchema) }).optional(),
-  issue: z2.object({ sections: z2.array(BriefSectionSchema) }).optional(),
-  milestone: z2.object({ sections: z2.array(BriefSectionSchema) }).optional(),
-  ack: z2.array(z2.enum(BRIEF_BUILTINS)).optional()
+var BriefSchemaSchema = z4.object({
+  pr: z4.object({ sections: z4.array(BriefSectionSchema) }).optional(),
+  issue: z4.object({ sections: z4.array(BriefSectionSchema) }).optional(),
+  milestone: z4.object({ sections: z4.array(BriefSectionSchema) }).optional(),
+  ack: z4.array(z4.enum(BRIEF_BUILTINS)).optional()
 });
 function isSafeRepoRelPath(p) {
   if (p.length === 0)
@@ -5166,7 +5798,7 @@ function isSafeRepoRelPath(p) {
     return false;
   return p.split(/[\\/]/).every((seg) => seg !== ".." && seg !== "");
 }
-var SafeRepoRelPath = z2.string().refine(isSafeRepoRelPath, {
+var SafeRepoRelPath = z4.string().refine(isSafeRepoRelPath, {
   message: "must be a repo-root-relative path with no `..` segment or absolute root"
 });
 var CANONICAL_HOOK_BLOCK_PREFIXES = [".git/", ".husky/", ".vinaya/hooks/", ".claude/hooks/"];
@@ -5176,22 +5808,22 @@ function isCanonicalHookBlockPath(p) {
 var ManagedHookBlockPath = SafeRepoRelPath.refine(isCanonicalHookBlockPath, {
   message: `must start with one of ${CANONICAL_HOOK_BLOCK_PREFIXES.join(", ")} (byte-exact, case-sensitive)`
 });
-var ManagedBlockRecordSchema = z2.object({
+var ManagedBlockRecordSchema = z4.object({
   path: ManagedHookBlockPath,
-  marker: z2.string(),
-  comment: z2.enum(["hash", "html"])
+  marker: z4.string(),
+  comment: z4.enum(["hash", "html"])
 });
-var ManagedManifestSchema = z2.object({
-  version: z2.number().int().positive(),
-  files: z2.array(SafeRepoRelPath),
-  blocks: z2.array(ManagedBlockRecordSchema),
-  labels: z2.array(z2.string()),
-  agents: z2.array(z2.enum(AGENT_VENDORS)).optional()
+var ManagedManifestSchema = z4.object({
+  version: z4.number().int().positive(),
+  files: z4.array(SafeRepoRelPath),
+  blocks: z4.array(ManagedBlockRecordSchema),
+  labels: z4.array(z4.string()),
+  agents: z4.array(z4.enum(AGENT_VENDORS)).optional()
 });
-var ProjectEntrySchema = z2.object({
-  name: z2.string().min(1),
-  description: z2.string().min(1).optional(),
-  path: z2.string().min(1).optional()
+var ProjectEntrySchema = z4.object({
+  name: z4.string().min(1),
+  description: z4.string().min(1).optional(),
+  path: z4.string().min(1).optional()
 });
 function parseTokensCollectDeclaration(value) {
   const m = value.trim().match(/^(\S+)\s+(\S+)$/);
@@ -5202,34 +5834,55 @@ function parseTokensCollectDeclaration(value) {
     return null;
   return { interpreter, script };
 }
-var VinayaConfigSchema = z2.object({
-  rings: z2.object({
-    ring1_forgeWriteInterception: z2.boolean(),
-    ring2_asyncAudits: z2.boolean()
+var VinayaConfigSchema = z4.object({
+  rings: z4.object({
+    ring1_forgeWriteInterception: z4.boolean(),
+    ring2_asyncAudits: z4.boolean()
   }).optional(),
-  checks: z2.record(z2.string(), CheckEntrySchema).optional(),
-  roles: z2.record(z2.string(), RoleEntrySchema).optional(),
+  checks: z4.record(z4.string(), CheckEntrySchema).optional(),
+  roles: z4.record(z4.string(), RoleEntrySchema).optional(),
   briefSchema: BriefSchemaSchema.optional(),
   managed: ManagedManifestSchema.optional(),
-  principals: z2.array(z2.string()).min(1).optional(),
-  releaseActor: z2.string().min(1).optional(),
-  ci: z2.object({ setup: z2.string().min(1) }).optional(),
-  tokens: z2.object({
-    collect: z2.string().min(1).refine((v) => parseTokensCollectDeclaration(v) !== null, {
+  principals: z4.array(z4.string()).min(1).optional(),
+  releaseActor: z4.string().min(1).optional(),
+  ci: z4.object({ setup: z4.string().min(1) }).optional(),
+  tokens: z4.object({
+    collect: z4.string().min(1).refine((v) => parseTokensCollectDeclaration(v) !== null, {
       message: 'tokens.collect must be exactly "<interpreter> <repo-relative-script-path>" — two whitespace-separated tokens, no flags, no shell syntax, no quoting'
     })
   }).optional(),
-  blastRadius: z2.object({ extraDomains: z2.array(z2.string()).optional() }).optional(),
-  proseGates: z2.object({
-    doctrineRoot: z2.string().min(1).optional(),
-    readerFacingPrefix: z2.string().min(1).optional(),
-    readerFacingSuffix: z2.string().min(1).optional(),
-    legacySlugDir: z2.string().min(1).optional()
+  blastRadius: z4.object({ extraDomains: z4.array(z4.string()).optional() }).optional(),
+  proseGates: z4.object({
+    doctrineRoot: z4.string().min(1).optional(),
+    readerFacingPrefix: z4.string().min(1).optional(),
+    readerFacingSuffix: z4.string().min(1).optional(),
+    legacySlugDir: z4.string().min(1).optional()
   }).optional(),
-  projects: z2.array(ProjectEntrySchema).optional(),
-  dispatch: z2.object({
-    timeoutMs: z2.number().int().positive().optional(),
-    agent: z2.enum(["claude", "codex", "gemini"]).optional()
+  projects: z4.array(ProjectEntrySchema).optional(),
+  dispatch: z4.object({
+    timeoutMs: z4.number().int().positive().optional(),
+    killGraceMs: z4.number().int().positive().optional(),
+    agent: z4.enum(["claude", "codex", "gemini"]).optional()
+  }).optional(),
+  reviewPolicy: z4.object({
+    codeReviewThreshold: z4.string().min(1).optional(),
+    securityThreshold: z4.string().min(1).optional(),
+    maxRounds: z4.number().optional()
+  }).optional(),
+  prePush: z4.object({
+    alwaysRun: z4.array(z4.string()).optional()
+  }).optional(),
+  report: z4.object({
+    commandTimeoutMs: z4.number().int().positive().optional()
+  }).superRefine((report, ctx) => {
+    const commandTimeoutMs = report.commandTimeoutMs;
+    if (commandTimeoutMs !== undefined && commandTimeoutMs > MAX_REPORT_COMMAND_TIMEOUT_MS) {
+      ctx.addIssue({
+        code: z4.ZodIssueCode.custom,
+        path: ["commandTimeoutMs"],
+        message: "must be at most 3600000 (1 hour)"
+      });
+    }
   }).optional()
 });
 var GLOBAL_VINAYA_HOME = join(homedir(), ".vinaya");
@@ -5304,6 +5957,28 @@ function resolvePrincipalAllowlist(config) {
 function resolveReleaseActor(config) {
   return config?.releaseActor ?? DEFAULT_RELEASE_ACTOR;
 }
+function resolveReviewPolicy(config) {
+  const raw = config?.reviewPolicy;
+  if (!raw)
+    return DEFAULT_REVIEW_POLICY;
+  const codeReviewThreshold = raw.codeReviewThreshold ?? DEFAULT_REVIEW_POLICY.codeReviewThreshold;
+  if (!isKnownSeverity(CODE_REVIEW_SEVERITY_ORDER, codeReviewThreshold)) {
+    throw new Error(`vinaya.config.json: reviewPolicy.codeReviewThreshold "${codeReviewThreshold}" is not one of ${CODE_REVIEW_SEVERITY_ORDER.join(" > ")} — fix the config, this never falls back to a default.`);
+  }
+  const securityThreshold = raw.securityThreshold ?? DEFAULT_REVIEW_POLICY.securityThreshold;
+  if (!isKnownSeverity(SECURITY_SEVERITY_ORDER, securityThreshold)) {
+    throw new Error(`vinaya.config.json: reviewPolicy.securityThreshold "${securityThreshold}" is not one of ${SECURITY_SEVERITY_ORDER.join(" > ")} — fix the config, this never falls back to a default.`);
+  }
+  const maxRounds = raw.maxRounds ?? DEFAULT_REVIEW_POLICY.maxRounds;
+  if (!Number.isInteger(maxRounds) || maxRounds < 1) {
+    throw new Error(`vinaya.config.json: reviewPolicy.maxRounds "${maxRounds}" is not a positive integer — fix the config, this never falls back to a default.`);
+  }
+  return {
+    codeReviewThreshold,
+    securityThreshold,
+    maxRounds
+  };
+}
 function trustAnchorRepo() {
   const wellFormed = (slug) => /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
   const fromRunner = process.env.GITHUB_REPOSITORY?.trim();
@@ -5383,6 +6058,9 @@ function loadConfig() {
 }
 var TOKENS_COLLECT_TRUST_PATH = join(GLOBAL_VINAYA_HOME, "tokens-collect-trust.json");
 
+// src/lib/brief-assembly.ts
+import { execFileSync as execFileSync4 } from "node:child_process";
+
 // ../../packages/sources/src/commands.ts
 var COMMANDS = [
   {
@@ -5541,6 +6219,17 @@ var COMMANDS = [
     ],
     status: "shipped"
   },
+  {
+    name: "task status",
+    description: "Every open task with a frozen brief, its pull request, and whether its loop is running, paused, or published",
+    flags: [{ flag: "--json", description: "Enveloped JSON output (schema: 1)" }],
+    details: [
+      "Read-only: one `gh issue list` for every open task Issue across every tranche (title/label resolved through the same `resolveTaskIssueRef` `list-tasks.ts` already uses), the open pull request per branch, and the driver pid record / pause record / publish effect markers under `<outboxRoot>/dev-review-loop/<task>/` — never a `ps` scan, never a re-parse of posted verdict comments to decide `published`.",
+      "`running` names the driver's pid (`review-validity-v1` task 7's pid record); `paused` names the reason from the pause record; `published` means the newest round's reviewer and security verdict effect markers both read `posted`; `no driver` is the fallback when none of the above holds.",
+      "`vinaya task status <tranche> <n>` narrows to one task and adds the last round's held or published verdict lines (`round-<n>-reviewer.md`/`round-<n>-security.md`, whichever their outbox carries) plus the exact `vinaya dev-review-loop --resume <pr>` command when paused."
+    ],
+    status: "shipped"
+  },
   {
     name: "pr create",
     description: "Open a pull request after full brief-schema validation",
@@ -6050,10 +6739,10 @@ function createForgeSource(config) {
   };
 }
 // ../../packages/sources/src/select-source.ts
-import { z as z3 } from "zod";
-var StateSourceConfigSchema = z3.discriminatedUnion("kind", [
-  z3.object({ kind: z3.literal("forge"), owner: z3.string(), repo: z3.string() }),
-  z3.object({ kind: z3.literal("file"), root: z3.string().optional() })
+import { z as z5 } from "zod";
+var StateSourceConfigSchema = z5.discriminatedUnion("kind", [
+  z5.object({ kind: z5.literal("forge"), owner: z5.string(), repo: z5.string() }),
+  z5.object({ kind: z5.literal("file"), root: z5.string().optional() })
 ]);
 // src/checks/edge-resolve.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
@@ -6173,6 +6862,589 @@ async function resolveEdge(id, taskById, factsByTaskId, repo, resolveSibling = d
   };
 }
 
+// src/lib/brief-assembly.ts
+function git(args) {
+  try {
+    return execFileSync4("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+  } catch {
+    return "";
+  }
+}
+function expandGlob(glob) {
+  const out = git(["ls-files", "--", glob]);
+  return out.split(`
+`).map((s) => s.trim()).filter(Boolean);
+}
+var DRAFT_ISSUE_SENTINEL = Number.MAX_SAFE_INTEGER;
+
+// src/checks/registry.ts
+import { existsSync as existsSync3 } from "node:fs";
+import { join as join3 } from "node:path";
+
+// src/lib/package-root.ts
+import { existsSync as existsSync2 } from "node:fs";
+import { dirname as dirname2, join as join2 } from "node:path";
+import { fileURLToPath } from "node:url";
+function packageRoot(moduleUrl) {
+  let dir = dirname2(fileURLToPath(moduleUrl));
+  while (!existsSync2(join2(dir, "package.json"))) {
+    if (existsSync2(join2(dir, ".git")))
+      break;
+    const parent = dirname2(dir);
+    if (parent === dir)
+      break;
+    dir = parent;
+  }
+  return dir;
+}
+
+// src/checks/registry.ts
+var DIST_BIN_DIR = join3(packageRoot(import.meta.url), "dist", "checks", "bin");
+var SRC_BIN_DIR = join3(packageRoot(import.meta.url), "src", "checks", "bin");
+var BIN_DIR = existsSync3(DIST_BIN_DIR) ? DIST_BIN_DIR : SRC_BIN_DIR;
+var BIN_EXT = BIN_DIR === DIST_BIN_DIR ? ".js" : ".ts";
+function bin(name) {
+  return join3(BIN_DIR, `${name}${BIN_EXT}`);
+}
+var REGISTRY = [
+  [
+    {
+      name: "brief-shape",
+      validates: "body",
+      run: bin("check-brief-shape"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {
+        PR_BODY: { optional: true },
+        BRANCH: { optional: true },
+        PR_NUMBER: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "pr-report-density",
+      validates: "body",
+      run: bin("check-pr-report-density"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {
+        PR_BODY: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "doc-coverage",
+      validates: "body",
+      run: bin("check-doc-coverage"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {
+        BASE_SHA: { optional: true },
+        PR_BODY: { optional: true },
+        PR_BODY_FILE: { optional: true },
+        PR_NUMBER: { optional: true },
+        GITHUB_REPOSITORY: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "coherence",
+      run: bin("check-coherence"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: {
+        AEG_REPO: { optional: true },
+        BRANCH: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "pr-premise-reassert",
+      validates: "body",
+      run: bin("check-pr-premise-reassert"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {
+        PR_BODY: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "dispatch-readiness",
+      run: bin("check-dispatch-readiness"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: {
+        AEG_REPO: { optional: true },
+        BRANCH: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true },
+        PREMISE_FILE: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "closes-n",
+      validates: "body",
+      run: bin("check-closes-n"),
+      scope: "diff",
+      timeoutMs: 15000,
+      requiresOpenPr: true,
+      env: {
+        BRANCH: { optional: true },
+        PR_BODY: { optional: true },
+        AEG_REPO: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    1
+  ],
+  [
+    {
+      name: "single-plan-pr",
+      run: bin("check-single-plan-pr"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {
+        BASE_SHA: { optional: true },
+        PR_NUMBER: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "surface-scope",
+      run: bin("check-surface-scope"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {
+        AEG_REPO: { optional: true },
+        BASE_SHA: { optional: true },
+        BRANCH: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "test-plan",
+      validates: "body",
+      run: bin("check-test-plan"),
+      scope: "diff",
+      timeoutMs: 15000,
+      requiresOpenPr: true,
+      principalOwed: true,
+      env: {
+        PR_BODY: { optional: true },
+        BRANCH: { optional: true }
+      }
+    },
+    1
+  ],
+  [
+    {
+      name: "body-bare-digits",
+      validates: "body",
+      run: bin("check-body-bare-digits"),
+      scope: "diff",
+      timeoutMs: 15000,
+      requiresOpenPr: true,
+      ownWorkflow: true,
+      env: {
+        PR_BODY: { optional: true },
+        PR_NUMBER: { optional: true },
+        GITHUB_REPOSITORY: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    1
+  ],
+  [
+    {
+      name: "token-report",
+      validates: "body",
+      run: bin("check-token-report"),
+      scope: "diff",
+      timeoutMs: 15000,
+      requiresOpenPr: true,
+      env: {
+        PR_BODY: { optional: true },
+        BRANCH: { optional: true },
+        CLAUDE_PROJECT_DIR: { optional: true },
+        CLAUDE_CODE_SESSION_ID: { optional: true }
+      }
+    },
+    1
+  ],
+  [
+    {
+      name: "no-disk-state",
+      run: bin("check-no-disk-state"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: { BASE_SHA: { optional: true } }
+    },
+    0
+  ],
+  [
+    {
+      name: "registry-gates",
+      run: bin("check-registry-gates"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: {
+        AEG_REPO: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "review-gate",
+      run: bin("check-review-gate"),
+      scope: "full",
+      timeoutMs: 30000,
+      ownWorkflow: true,
+      env: {
+        PR_NUMBER: { optional: true },
+        GITHUB_REPOSITORY: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    1
+  ],
+  [
+    {
+      name: "branch-topology",
+      run: bin("check-branch-topology"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: {
+        BRANCH: { optional: true },
+        AEG_REPO: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "dead-branch-push",
+      run: bin("check-dead-branch-push"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: {
+        BRANCH: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "first-push-dispatch",
+      run: bin("check-first-push-dispatch"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: {
+        BRANCH: { optional: true },
+        AEG_REPO: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "doc-coverage-push",
+      validates: "body",
+      run: bin("check-doc-coverage-push"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {
+        OVERRIDE_DOCS: { optional: true },
+        BASE_SHA: { optional: true },
+        PR_BODY: { optional: true },
+        PR_BODY_FILE: { optional: true },
+        PR_LABELS: { optional: true },
+        WAIVER_LABEL_ACTOR: { optional: true },
+        GITHUB_REPOSITORY: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "issue-assignment",
+      run: bin("check-issue-assignment"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: {
+        AEG_REPO: { optional: true },
+        BRANCH: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "evidence-fresh",
+      validates: "body",
+      run: bin("check-evidence-fresh"),
+      scope: "diff",
+      timeoutMs: 15000,
+      requiresOpenPr: true,
+      env: {
+        PR_NUMBER: { optional: true },
+        PR_BODY: { optional: true },
+        BASE_SHA: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    },
+    1
+  ],
+  [
+    {
+      name: "reader-resolvable-prose",
+      run: bin("check-reader-resolvable-prose"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: {},
+      include: [
+        "aeg-root/**/*.md",
+        "apps/cli/src/**",
+        ".github/workflows/**",
+        ".vinaya/**",
+        "apps/cli/README.md",
+        "packages/sources/README.md"
+      ]
+    },
+    0
+  ],
+  [
+    {
+      name: "retired-vocabulary",
+      run: bin("check-retired-vocabulary"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: {},
+      include: ["aeg-root/**/*.md"]
+    },
+    0
+  ],
+  [
+    {
+      name: "doctrine-portability",
+      run: bin("check-doctrine-portability"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: { BASE_SHA: { optional: true } },
+      include: ["aeg-root/**/*.md"]
+    },
+    0
+  ],
+  [
+    {
+      name: "doctrine-no-procedures",
+      run: bin("check-doctrine-no-procedures"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: {},
+      include: ["aeg-root/**/*.md"]
+    },
+    0
+  ],
+  [
+    {
+      name: "exec-bits",
+      run: bin("check-exec-bits"),
+      scope: "diff",
+      timeoutMs: 30000,
+      env: {}
+    },
+    0
+  ],
+  [
+    {
+      name: "workspace-escape",
+      run: bin("check-workspace-escape"),
+      scope: "full",
+      timeoutMs: 30000,
+      env: {},
+      include: ["aeg-root/**/*.md"]
+    },
+    0
+  ],
+  [
+    {
+      name: "changeset-coverage",
+      run: bin("check-changeset-coverage"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {}
+    },
+    0
+  ],
+  [
+    {
+      name: "quoted-command",
+      run: bin("check-quoted-command"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {}
+    },
+    0
+  ],
+  [
+    {
+      name: "main-branch-refusal",
+      run: bin("check-main-branch-refusal"),
+      scope: "full",
+      timeoutMs: 15000,
+      env: { VINAYA_PUSH_REFS: { optional: true } }
+    },
+    0
+  ],
+  [
+    {
+      name: "token-collection-wired",
+      run: bin("check-token-collection-wired"),
+      scope: "full",
+      timeoutMs: 15000,
+      env: {
+        CLAUDE_PROJECT_DIR: { optional: true },
+        CLAUDE_CODE_SESSION_ID: { optional: true }
+      }
+    },
+    0
+  ],
+  [
+    {
+      name: "issue-title-grammar",
+      run: bin("check-issue-title-grammar"),
+      validates: "issue",
+      scope: "full",
+      ownWorkflow: true,
+      timeoutMs: 15000,
+      env: { ISSUE_TITLE: { optional: true } }
+    },
+    1
+  ],
+  [
+    {
+      name: "issue-objectives-numbering",
+      run: bin("check-issue-objectives-numbering"),
+      validates: "issue",
+      scope: "full",
+      ownWorkflow: true,
+      timeoutMs: 15000,
+      env: { ISSUE_BODY: { optional: true }, ISSUE_NUMBER: { optional: true } }
+    },
+    1
+  ],
+  [
+    {
+      name: "issue-parts-coverage",
+      run: bin("check-issue-parts-coverage"),
+      validates: "issue",
+      scope: "full",
+      ownWorkflow: true,
+      timeoutMs: 15000,
+      env: { ISSUE_BODY: { optional: true } }
+    },
+    1
+  ],
+  [
+    {
+      name: "issue-surface-globs",
+      run: bin("check-issue-surface-globs"),
+      validates: "issue",
+      scope: "full",
+      ownWorkflow: true,
+      timeoutMs: 15000,
+      env: { ISSUE_BODY: { optional: true } }
+    },
+    1
+  ],
+  [
+    {
+      name: "issue-tranche-label",
+      run: bin("check-issue-tranche-label"),
+      validates: "issue",
+      scope: "full",
+      ownWorkflow: true,
+      timeoutMs: 15000,
+      env: { ISSUE_BODY: { optional: true }, ISSUE_LABELS: { optional: true } }
+    },
+    1
+  ],
+  [
+    {
+      name: "issue-milestone-attach",
+      run: bin("check-issue-milestone-attach"),
+      validates: "issue",
+      scope: "full",
+      ownWorkflow: true,
+      timeoutMs: 15000,
+      env: {
+        ISSUE_LABELS: { optional: true },
+        CURRENT_MILESTONE_TITLE: { optional: true },
+        RESOLVED_MILESTONE_TITLE: { optional: true }
+      }
+    },
+    1
+  ]
+];
+function coreCheckRegistry() {
+  return REGISTRY.map(([spec]) => spec);
+}
+var CORE_CHECK_RING = Object.fromEntries(REGISTRY.map(([spec, ring]) => [spec.name, ring]));
+
+// src/checks/runner.ts
+var activeKillers = new Set;
+
+// src/lib/forge-write.ts
+var INFORMATIONAL_DISPATCH_BLOCKER_CLASSES = new Set([
+  "depends-on-not-merged",
+  "conflicts-with"
+]);
+
 // src/commands/review-post.ts
 function parseChangedLineRanges(diffOutput) {
   const result = {};
@@ -6204,7 +7476,7 @@ function parseChangedLineRanges(diffOutput) {
 function fileDiffAgainst(ref, path) {
   let out;
   try {
-    out = execFileSync4("git", ["diff", `${ref}...HEAD`, "--", path], {
+    out = execFileSync5("git", ["diff", `${ref}...HEAD`, "--", path], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     }).trim();
@@ -6215,7 +7487,7 @@ function fileDiffAgainst(ref, path) {
 }
 function revParse(ref) {
   try {
-    return execFileSync4("git", ["rev-parse", "--verify", ref], {
+    return execFileSync5("git", ["rev-parse", "--verify", ref], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     }).trim();
@@ -6225,7 +7497,7 @@ function revParse(ref) {
 }
 function repoRoot() {
   try {
-    return execFileSync4("git", ["rev-parse", "--show-toplevel"], {
+    return execFileSync5("git", ["rev-parse", "--show-toplevel"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     }).trim();
@@ -6236,7 +7508,7 @@ function repoRoot() {
 function changedFiles(base) {
   let out;
   try {
-    out = execFileSync4("git", ["diff", "--name-only", `${base}...HEAD`], {
+    out = execFileSync5("git", ["diff", "--name-only", `${base}...HEAD`], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     }).trim();
@@ -6261,7 +7533,7 @@ function resolveDiff(base = process.env.BASE_SHA || "origin/main") {
     const relPaths = changedFiles(ref);
     if (relPaths === null)
       continue;
-    return { base: ref, root, files: relPaths.map((p) => join2(root, p)) };
+    return { base: ref, root, files: relPaths.map((p) => join4(root, p)) };
   }
   return null;
 }
@@ -6295,15 +7567,15 @@ function findingsInThisDiff(findings) {
 // src/checks/bin/check-exec-bits.ts
 var CHECK_NAME = "exec-bits";
 var EXECUTABLE_MODE = "100755";
-function git(args) {
+function git2(args) {
   try {
-    return execFileSync5("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync6("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch {
     return null;
   }
 }
 function indexMode(path) {
-  const out = git(["ls-files", "-s", "--", path]);
+  const out = git2(["ls-files", "-s", "--", path]);
   if (out === null || out === "")
     return null;
   const mode = out.split(/\s+/)[0] ?? "";