@attalabs/vinaya 0.27.0 → 0.29.0

package/dist/checks/bin/check-dispatch-readiness.js

@@ -1647,6 +1647,52 @@ var systemEnv3 = {
   ...process.env,
   PATH: [process.env.PATH, "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].filter(Boolean).join(":")
 };
+var defaultExec = () => execFileAsync3("git", ["remote", "get-url", "origin"], { env: systemEnv3, timeout: 5000 });
+var cached;
+var inflight;
+async function resolveRepo(exec = defaultExec) {
+  if (cached !== undefined)
+    return cached;
+  const fromEnv = process.env.AEG_REPO;
+  if (fromEnv) {
+    const parsed = parseOwnerRepo(fromEnv);
+    if (parsed) {
+      cached = parsed;
+      return cached;
+    }
+  }
+  if (inflight)
+    return inflight;
+  inflight = (async () => {
+    try {
+      const { stdout } = await exec();
+      cached = parseGitRemoteUrl(stdout.trim());
+      return cached;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      console.warn(`[aeg-forge-state] resolveRepo: git remote lookup failed (will retry): ${message}`);
+      return null;
+    } finally {
+      inflight = undefined;
+    }
+  })();
+  return inflight;
+}
+function parseGitRemoteUrl(url) {
+  const ssh = url.match(/^git@github\.com:([^/]+)\/(.+?)(?:\.git)?$/);
+  if (ssh?.[1] && ssh[2])
+    return { owner: ssh[1], repo: ssh[2] };
+  const https = url.match(/^https?:\/\/(?:[^@]+@)?github\.com\/([^/]+)\/(.+?)(?:\.git)?\/?$/);
+  if (https?.[1] && https[2])
+    return { owner: https[1], repo: https[2] };
+  return null;
+}
+function parseOwnerRepo(value) {
+  const match = value.match(/^([^/]+)\/(.+)$/);
+  if (!match?.[1] || !match[2])
+    return null;
+  return { owner: match[1], repo: match[2] };
+}
 // ../../packages/aeg-core/src/anchored-region.ts
 function anchoredRegionBounds(body, field) {
   const masked = maskCode(body);
@@ -1957,6 +2003,9 @@ function parseInlineFieldList(section) {
 var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
 var OBJECTIVES_VERSION_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Objectives version:\s*([0-9a-f]{64})(?![A-Za-z0-9])/im;
 var RULING_ORDINAL_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Ruling ordinal:\s*(\d+)(?!\d)/im;
+var BRIEF_HASH_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Brief hash:\s*([0-9a-f]{64})(?![A-Za-z0-9])/im;
+var POLICY_DIGEST_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Policy digest:\s*([0-9a-f]{64})(?![A-Za-z0-9])/im;
+var BASE_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged base:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
 function firstFiveLines(comment) {
   return comment.split(`
 `).slice(0, 5).join(`
@@ -1979,6 +2028,35 @@ function extractRulingOrdinal(comment) {
   const m = firstSevenLines(comment).match(RULING_ORDINAL_PATTERN);
   return m ? Number.parseInt(m[1], 10) : null;
 }
+function firstElevenLines(comment) {
+  return comment.split(`
+`).slice(0, 11).join(`
+`);
+}
+function extractBriefHash(comment) {
+  const m = firstElevenLines(comment).match(BRIEF_HASH_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
+function extractPolicyDigest(comment) {
+  const m = firstElevenLines(comment).match(POLICY_DIGEST_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
+function firstThirteenLines(comment) {
+  return comment.split(`
+`).slice(0, 13).join(`
+`);
+}
+function extractBaseSha(comment) {
+  const m = firstThirteenLines(comment).match(BASE_SHA_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
+var FINDING_SEVERITY_LINE = /^\d+\.\s+\[([A-Z][A-Z]*)\]\s+(.+?)\s+—/gm;
+function extractFindingSeverities(comment) {
+  return [...comment.matchAll(FINDING_SEVERITY_LINE)].map((m) => ({
+    severity: m[1],
+    location: m[2]
+  }));
+}
 function extractVerdict(comments, valuePattern, missingLabel) {
   const candidates = comments.filter((c) => valuePattern.test(c));
   if (candidates.length === 0) {
@@ -1987,6 +2065,10 @@ function extractVerdict(comments, valuePattern, missingLabel) {
       headSha: null,
       objectivesVersion: null,
       rulingOrdinal: null,
+      briefHash: null,
+      policyDigest: null,
+      baseSha: null,
+      findingSeverities: [],
       danglingNote: `no ${missingLabel} verdict comment found on this PR`
     };
   }
@@ -1998,6 +2080,10 @@ function extractVerdict(comments, valuePattern, missingLabel) {
       headSha: null,
       objectivesVersion: null,
       rulingOrdinal: null,
+      briefHash: null,
+      policyDigest: null,
+      baseSha: null,
+      findingSeverities: [],
       danglingNote: `the most recent ${missingLabel} verdict comment carries a VERDICT-shaped line outside the first-five-line read window`
     };
   }
@@ -2006,6 +2092,10 @@ function extractVerdict(comments, valuePattern, missingLabel) {
     headSha: extractHeadSha(latest),
     objectivesVersion: extractObjectivesVersion(latest),
     rulingOrdinal: extractRulingOrdinal(latest),
+    briefHash: extractBriefHash(latest),
+    policyDigest: extractPolicyDigest(latest),
+    baseSha: extractBaseSha(latest),
+    findingSeverities: extractFindingSeverities(latest),
     danglingNote: null
   };
 }
@@ -2341,6 +2431,53 @@ function evaluateC5(changed, docOwnersContent, prBody, fileExists, waiverActive,
   }
   return out;
 }
+// ../../packages/aeg-core/src/review-policy.ts
+var CODE_REVIEW_SEVERITY_ORDER = ["BLOCKER", "MAJOR", "MINOR"];
+var SECURITY_SEVERITY_ORDER = ["CRITICAL", "HIGH", "MEDIUM", "LOW"];
+var DEFAULT_MAX_ROUNDS = 3;
+var DEFAULT_REVIEW_POLICY = {
+  codeReviewThreshold: "BLOCKER",
+  securityThreshold: "HIGH",
+  maxRounds: DEFAULT_MAX_ROUNDS
+};
+var FILE_SHAPED_LOCATION = /\.[a-zA-Z0-9]{1,10}(:\d+)?\s*$/;
+var PROSE_LOCATION_PATTERNS = [/\bpr\s*body\b/i, /\bcomment\b/i];
+var ROLE_FILE_LOCATION = /(^|\/)aeg-root\/roles\//i;
+function isProseLocation(location) {
+  if (ROLE_FILE_LOCATION.test(location))
+    return true;
+  if (FILE_SHAPED_LOCATION.test(location))
+    return false;
+  return PROSE_LOCATION_PATTERNS.some((pattern) => pattern.test(location));
+}
+var PROSE_CAP_SEVERITY = "MINOR";
+function blockingSeverities(scale, threshold) {
+  const idx = scale.indexOf(threshold);
+  if (idx === -1) {
+    throw new Error(`blockingSeverities: threshold "${threshold}" is not one of ${scale.join(" > ")}`);
+  }
+  return scale.slice(0, idx + 1);
+}
+function evaluateReviewFindings(findings, scale, threshold) {
+  const blocking = new Set(blockingSeverities(scale, threshold));
+  const blockingFindings = findings.filter((f) => {
+    if (!scale.includes(f.severity)) {
+      throw new Error(`evaluateReviewFindings: severity "${f.severity}" is not one of ${scale.join(" > ")}`);
+    }
+    const effectiveSeverity = f.location !== undefined && isProseLocation(f.location) ? PROSE_CAP_SEVERITY : f.severity;
+    return blocking.has(effectiveSeverity);
+  });
+  return { outcome: blockingFindings.length > 0 ? "blocked" : "clean", blockingFindings };
+}
+function evaluateCodeReview(findings, policy) {
+  return evaluateReviewFindings(findings, CODE_REVIEW_SEVERITY_ORDER, policy.codeReviewThreshold);
+}
+function evaluateSecurityReview(findings, policy) {
+  return evaluateReviewFindings(findings, SECURITY_SEVERITY_ORDER, policy.securityThreshold);
+}
+function isKnownSeverity(scale, value) {
+  return scale.includes(value);
+}
 // ../../packages/aeg-core/src/pr-tier.ts
 var TIER_FIELD = /(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i;
 function readTierFromPrBody(prBody) {
@@ -2711,7 +2848,7 @@ function checkForField(prBody) {
     ]
   };
 }
-function checkClosesN(prBody) {
+function checkClosesNPresence(prBody) {
   const closesPattern = /(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s{0,8}:?\s{0,8}#\d+/i;
   if (closesPattern.test(stripCode(prBody))) {
     return { status: "pass", errors: [] };
@@ -2743,10 +2880,22 @@ var COMMIT_TYPES = [
   "Test"
 ];
 var COMMIT_TYPE_STYLE = new RegExp(`^(${COMMIT_TYPES.join("|")})(\\([a-z0-9-]+\\))?: \\S`);
+function checkForgeTitle(title) {
+  const taskStyle = /^\[[a-z0-9._-]+\] \S+ — \S/;
+  if (COMMIT_TYPE_STYLE.test(title) || taskStyle.test(title))
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      `brief-validation title: "${title}" matches neither title grammar — expected \`Type: description\` / \`Type(scope): description\` (commitlint types + Plan) or \`[tranche] id — description\` (task form).`
+    ]
+  };
+}
 var BRIEF_SHAPE_MARKERS = [checkSurfaceMap, checkDocUpdateList, checkStopConditions, checkAutonomyClause];
 var TASK_BRANCH_PATTERN = /^task\/[^/]+\/[^/]+$/;
+var TASK_ISSUE_BRANCH_PATTERN = /^task\/issue-\d+$/;
 function isTaskBranch(branch) {
-  return TASK_BRANCH_PATTERN.test(branch);
+  return TASK_BRANCH_PATTERN.test(branch) || TASK_ISSUE_BRANCH_PATTERN.test(branch);
 }
 function isBriefShaped(prBody) {
   const stripped = stripCode(prBody);
@@ -2868,8 +3017,9 @@ function packagesNamedIn(text) {
 }
 function hasTestPathForConsumer(text, consumerDir) {
   const escaped = consumerDir.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const re = new RegExp(`${escaped}\\/[\\w./-]*\\.test\\.[A-Za-z0-9]+`);
-  return re.test(text);
+  const filePathRe = new RegExp(`${escaped}\\/[\\w./-]*\\.test\\.[A-Za-z0-9]+`);
+  const testDirRe = new RegExp(`${escaped}\\/(?:[\\w-]+\\/)*(?:tests|specs)(?:\\/|\\b)`);
+  return filePathRe.test(text) || testDirRe.test(text);
 }
 function checkConsumerTests(prBody, consumersOf) {
   const section4 = extractNumberedSection(prBody, 4);
@@ -2973,7 +3123,7 @@ function checkBriefSections(prBody, readTier, options = {}) {
     checkConsumerTests(prBody, consumersOf),
     checkDefeatCases(prBody),
     ...issueObjectives !== undefined ? [checkObjectivesCopy(prBody, issueObjectives), checkObjectivesCoverage(prBody)] : [],
-    ...requireClosesN ? [checkClosesN(prBody)] : []
+    ...requireClosesN ? [checkClosesNPresence(prBody)] : []
   ];
   return { errors: results.flatMap((r) => r.errors) };
 }
@@ -3263,6 +3413,28 @@ function topLevelSectionText(body, headingName) {
   const next = /^##[ \t]/m.exec(afterHeading);
   return next ? afterHeading.slice(0, next.index) : afterHeading;
 }
+function partHasBacktickedPath(text) {
+  let i = 0;
+  while (i < text.length) {
+    const start = text.indexOf("`", i);
+    if (start === -1)
+      return false;
+    const end = text.indexOf("`", start + 1);
+    if (end === -1)
+      return false;
+    if (text.slice(start + 1, end).includes("/"))
+      return true;
+    i = end + 1;
+  }
+  return false;
+}
+var PART_MIN_WORDS_OUTSIDE_BACKTICKS = 3;
+function stripPartBackticks(text) {
+  return text.replace(/`[^`\n]*`/g, " ");
+}
+function partWordCount(text) {
+  return text.split(/\s+/).filter((w) => /[a-z]/i.test(w)).length;
+}
 function looksLikeFilePath(entry2) {
   const stripped = entry2.replace(/\/\*\*?$/, "");
   const lastSegment = stripped.split("/").pop() ?? stripped;
@@ -3303,6 +3475,18 @@ function globCoversPath(glob, path) {
   const p = path.replace(/\/+$/, "");
   return g === p || g.startsWith(`${p}/`) || p.startsWith(`${g}/`);
 }
+function checkSurfaceGlobsResolve(body, resolvesToFile) {
+  const surface = parseIssueSurface(body);
+  if (!surface.ok)
+    return { status: "pass", errors: [] };
+  const errors = [];
+  for (const glob of surface.value.in) {
+    if (!resolvesToFile(glob)) {
+      errors.push(`issue-validation Surface: \`${glob}\` in \`## Surface\`'s \`in:\` list matches no tracked file — a Surface that cannot resolve cannot render a brief's file list.`);
+    }
+  }
+  return { status: errors.length > 0 ? "fail" : "pass", errors };
+}
 function checkSurfaceScope(changedFiles, outGlobs) {
   if (outGlobs.length === 0)
     return { ok: true };
@@ -3314,9 +3498,77 @@ function checkSurfaceScope(changedFiles, outGlobs) {
   }
   return violations.length > 0 ? { ok: false, violations } : { ok: true };
 }
+var ISSUE_PART_LINE_RE = /^Part\s+(\d+)\s*\(([^)]*)\)\s*[-—–]\s*(.*)$/i;
+function parseIssueParts(body) {
+  const section = topLevelSectionText(body, "Parts");
+  if (section === null)
+    return { ok: false, errors: ["no `## Parts` heading found in the body."] };
+  const lines = section.split(/\r?\n/).map((l) => l.trim()).filter((l) => l.length > 0);
+  const parts = [];
+  const errors = [];
+  for (const line of lines) {
+    const m = ISSUE_PART_LINE_RE.exec(line);
+    if (!m) {
+      errors.push(`"${line}" is not a well-formed Parts line — expected \`Part <n> (<refs>) — <outcome>\`.`);
+      continue;
+    }
+    const n = Number.parseInt(m[1], 10);
+    const refs = m[2];
+    const text = m[3].trim();
+    if (text.length === 0) {
+      errors.push(`Part ${n} has no outcome text after the dash — every Part states one observable outcome.`);
+      continue;
+    }
+    if (partHasBacktickedPath(text) && partWordCount(stripPartBackticks(text)) < PART_MIN_WORDS_OUTSIDE_BACKTICKS) {
+      errors.push(`Part ${n} is little more than a file path — a Part names an outcome and symbols, never a bare path.`);
+      continue;
+    }
+    const objectiveIds = [...refs.matchAll(/O(\d+)/g)].map((r) => Number.parseInt(r[1], 10));
+    parts.push({ n, objectiveIds, text });
+  }
+  if (parts.length === 0) {
+    errors.push("the `## Parts` section has no well-formed `Part <n> (<refs>) — <outcome>` lines.");
+  }
+  if (errors.length > 0)
+    return { ok: false, errors };
+  return { ok: true, value: parts };
+}
+function checkPartsCiteDefinedObjectives(body) {
+  const parts = parseIssueParts(body);
+  const objectives = objectivesOf(body);
+  if (!parts.ok || !objectives.ok)
+    return { status: "pass", errors: [] };
+  const definedIds = new Set(objectives.objectives.map((o) => Number.parseInt(o.id.slice(1), 10)));
+  const errors = [];
+  for (const part of parts.value) {
+    for (const objectiveId of part.objectiveIds) {
+      if (!definedIds.has(objectiveId)) {
+        errors.push(`issue-validation Parts: Part ${part.n} cites O${objectiveId}, which the Issue's own \`## Objectives\` section does not define.`);
+      }
+    }
+  }
+  return { status: errors.length > 0 ? "fail" : "pass", errors };
+}
 function isTaskIssueLabelSet(labels) {
   return hasLabel("tranche", labels);
 }
+function checkTrancheLabelPresence(_body, _labels) {
+  return { status: "pass", errors: [] };
+}
+function checkMilestoneAttach(labels, currentMilestoneTitle, resolvedMilestoneTitle) {
+  if (!isTaskIssueLabelSet(labels))
+    return { status: "pass", errors: [] };
+  if (resolvedMilestoneTitle === null)
+    return { status: "pass", errors: [] };
+  if (currentMilestoneTitle === resolvedMilestoneTitle)
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      `issue-validation milestone attach: this task Issue's tranche label resolves to Milestone "${resolvedMilestoneTitle}", but its live Milestone is ${currentMilestoneTitle === null ? "unset" : `"${currentMilestoneTitle}"`} — attach it to "${resolvedMilestoneTitle}".`
+    ]
+  };
+}
 var TYPE_LABEL_IDS = LABELS.filter((l) => l.category === "type").map((l) => l.id);
 function isControlCodePoint(codePoint) {
   return codePoint <= 31 || codePoint >= 127 && codePoint <= 159;
@@ -3381,6 +3633,19 @@ function checkProjectsRegistered(body, _labels, registeredNames) {
 var DOC_PATH_RE = /(?:(?:aeg-root|apps|packages|specs|docs|tools|\.claude|\.github)\/[\w./@-]*\.(?:md|mdx)|\.claude\/(?:skills|rules)\/[\w./-]+|\b(?:docs-index|decisions|projects|state-machine|enforcement|process|README|CLAUDE)\.md\b|\b[\w-]+-(?:spec|decisions|backlog)\.md\b)/i;
 var DOC_PATH_RE_GLOBAL = new RegExp(DOC_PATH_RE.source, "gi");
 
+// ../../packages/aeg-core/src/task-branch-identity.ts
+var ISSUE_BRANCH_PATTERN = /^task\/issue-(\d+)$/;
+var TRANCHE_BRANCH_PATTERN = /^task\/([^/]+)\/([^/]+)$/;
+function parseTaskBranchIdentity(branch) {
+  const issueMatch = ISSUE_BRANCH_PATTERN.exec(branch);
+  if (issueMatch)
+    return { kind: "issue", issueNumber: Number(issueMatch[1]) };
+  const trancheMatch = TRANCHE_BRANCH_PATTERN.exec(branch);
+  if (trancheMatch)
+    return { kind: "tranche", tranche: trancheMatch[1], taskId: trancheMatch[2] };
+  return null;
+}
+
 // ../../packages/aeg-core/src/coherence-checks.ts
 var COHERENCE_ENFORCED_FROM = "2026-07-01";
 function isGrandfathered(isoDate) {
@@ -3401,6 +3666,7 @@ function checkA1(entries, principalAllowlist = PRINCIPAL_ALLOWLIST) {
       if (handClosed)
         continue;
       failures.push({
+        code: "closed-without-merge",
         issue: e.task.issue,
         tranche: e.trancheSlug,
         task: e.task.id,
@@ -3425,6 +3691,7 @@ function checkA3(entries) {
       continue;
     if (e.facts.prState === "merged" && e.facts.issueState !== "closed") {
       failures.push({
+        code: "auto-close-misfire",
         issue: e.task.issue,
         tranche: e.trancheSlug,
         task: e.task.id,
@@ -3449,6 +3716,7 @@ function checkT1(entries) {
       continue;
     if (e.facts === undefined) {
       failures.push({
+        code: "phantom-issue-ref",
         issue: e.task.issue,
         tranche: e.trancheSlug,
         task: e.task.id,
@@ -3467,6 +3735,7 @@ function checkT2(openIssuesBySlug, topologyIssuesBySlug, ciTrancheSlug) {
     for (const num of openNums) {
       if (!topologySet.has(num)) {
         failures.push({
+          code: "orphan-task",
           issue: num,
           tranche: slug,
           reason: `Issue #${num} is open and labeled ${trancheLabel(slug)} but does not appear in the topology file`
@@ -3501,6 +3770,7 @@ function checkT3(entries, ciTrancheSlug, enrichedEntries, forgeUnavailableSlugs)
         continue;
       if (forgeUnavailableSlugs?.has(e.trancheSlug)) {
         failures.push({
+          code: "tbd-in-active-tranche",
           issue: null,
           tranche: e.trancheSlug,
           task: e.task.id,
@@ -3510,6 +3780,7 @@ function checkT3(entries, ciTrancheSlug, enrichedEntries, forgeUnavailableSlugs)
         continue;
       }
       failures.push({
+        code: "tbd-in-active-tranche",
         issue: null,
         tranche: e.trancheSlug,
         task: e.task.id,
@@ -3542,6 +3813,7 @@ function checkD1(entries, issueToEntry, taskToEntry) {
       const sameIssue = depEntry.task.issue !== null && e.task.issue !== null && depEntry.task.issue === e.task.issue;
       if (sameTask || sameIssue) {
         failures.push({
+          code: "d1-self-dependency",
           issue: e.task.issue,
           tranche: e.trancheSlug,
           task: e.task.id,
@@ -3553,6 +3825,7 @@ function checkD1(entries, issueToEntry, taskToEntry) {
       const depClosed = depFacts?.issueState === "closed";
       if (!depClosed) {
         failures.push({
+          code: "dispatched-on-unmet-deps",
           issue: e.task.issue,
           tranche: e.trancheSlug,
           task: e.task.id,
@@ -3578,11 +3851,13 @@ function checkR1(issuesBySlug, grandfatheredIssues, registeredNames = []) {
       const errors = [
         ...checkIssueRationale(issue.body).errors,
         ...checkProjectsRegistered(issue.body, issue.labels, registeredNames).errors,
-        ...checkIssueObjectives(issue.body, issue.number).errors
+        ...checkIssueObjectives(issue.body, issue.number).errors,
+        ...checkPartsCiteDefinedObjectives(issue.body).errors
       ];
       if (errors.length === 0)
         continue;
       failures.push({
+        code: "missing-rationale-field",
         issue: issue.number,
         tranche: slug,
         reason: `Issue #${issue.number} fails the rationale gate: ${errors.join(" | ")}`,
@@ -3611,6 +3886,7 @@ function checkL1(files, entriesBySlug) {
     const allClosed = withFacts.every((e) => e.facts?.issueState === "closed");
     if (allClosed) {
       failures.push({
+        code: "archive-recommended",
         tranche: f.slug,
         reason: "Active tranche has no open task-Issues — consider archiving to completed/"
       });
@@ -3642,27 +3918,38 @@ function extractClosesReferences(prBody) {
   }
   return referenced;
 }
-function checkClosesN2(branch, prBody, trancheFiles, taskIssueRefs) {
+function checkClosesNTopology(branch, prBody, trancheFiles, taskIssueRefs) {
   const referenced = extractClosesReferences(prBody);
   if (taskIssueRefs) {
     for (const n of referenced) {
-      const ref = taskIssueRefs.get(n);
-      if (!ref)
+      const ref2 = taskIssueRefs.get(n);
+      if (!ref2)
         continue;
-      const expectedBranch = `task/${ref.trancheSlug}/${ref.taskId}`;
+      const expectedBranch = `task/${ref2.trancheSlug}/${ref2.taskId}`;
       if (branch !== expectedBranch) {
         return {
           ok: false,
-          message: `closes-n-reverse: branch "${branch}" closes #${n} (task ${ref.taskId} of tranche "${ref.trancheSlug}") but is not named "${expectedBranch}" — rename the branch and re-push, or if this work is intentionally outside AEG's dispatch flow, remove the Closes reference.`
+          message: `closes-n-reverse: branch "${branch}" closes #${n} (task ${ref2.taskId} of tranche "${ref2.trancheSlug}") but is not named "${expectedBranch}" — rename the branch and re-push, or if this work is intentionally outside AEG's dispatch flow, remove the Closes reference.`
         };
       }
     }
   }
-  const m = branch.match(/^task\/([^/]+)\/([^/]+)$/);
-  if (!m)
+  const ref = parseTaskBranchIdentity(branch);
+  if (!ref)
     return { ok: true };
-  const trancheSlug = m[1];
-  const taskId = m[2];
+  if (ref.kind === "issue") {
+    const expectedIssue2 = ref.issueNumber;
+    if (!referenced.has(expectedIssue2)) {
+      return {
+        ok: false,
+        expectedIssue: expectedIssue2,
+        message: `closes-n: PR body does not contain \`Closes #${expectedIssue2}\` (required for branch "${branch}"). Add it to the PR body Summary section.`
+      };
+    }
+    return { ok: true, expectedIssue: expectedIssue2 };
+  }
+  const trancheSlug = ref.tranche;
+  const taskId = ref.taskId;
   const trancheFile = trancheFiles.find((f) => f.slug === trancheSlug);
   if (!trancheFile) {
     return {
@@ -3714,34 +4001,79 @@ function extractIssue(body) {
   const issue = headerNums.length > 0 ? headerNums[0] : bodyNums[0];
   return { issue, extraIssues: bodyNums.filter((n) => n !== issue), outsideHeader: headerNums.length === 0 };
 }
-// ../../packages/aeg-core/src/review-gate.ts
-function isBoundToHead(extraction, headSha) {
-  if (!extraction.headSha)
+// ../../packages/aeg-core/src/review-input-manifest.ts
+import { createHash as createHash4 } from "node:crypto";
+function briefHash(brief) {
+  return createHash4("sha256").update(`${brief}
+`).digest("hex");
+}
+function policyDigest(policy) {
+  return createHash4("sha256").update(JSON.stringify({
+    codeReviewThreshold: policy.codeReviewThreshold,
+    securityThreshold: policy.securityThreshold,
+    maxRounds: policy.maxRounds
+  })).digest("hex");
+}
+function isBoundToHead(echoed, headSha) {
+  if (!echoed.headSha)
     return false;
-  return headSha.toLowerCase().startsWith(extraction.headSha.toLowerCase());
+  return headSha.toLowerCase().startsWith(echoed.headSha.toLowerCase());
 }
-function isBoundByPatchIdentity(extraction, headSha, patchIdOf) {
-  if (patchIdOf === undefined || !extraction.headSha)
+function isBoundByPatchIdentity(echoed, headSha, patchIdOf) {
+  if (patchIdOf === undefined || !echoed.headSha)
     return false;
-  const judged = patchIdOf(extraction.headSha);
+  const judged = patchIdOf(echoed.headSha);
   const current = patchIdOf(headSha);
   if (judged === null || current === null)
     return false;
   return judged === current;
 }
-function isBoundToPatch(extraction, headSha, patchIdOf) {
-  return isBoundToHead(extraction, headSha) || isBoundByPatchIdentity(extraction, headSha, patchIdOf);
+function isBoundToBase(echoed, currentBase) {
+  if (currentBase === null)
+    return true;
+  if (!echoed.baseSha)
+    return false;
+  return currentBase.toLowerCase().startsWith(echoed.baseSha.toLowerCase());
 }
-function isBoundToObjectives(extraction, currentVersion) {
+function isBoundToObjectives(echoed, currentVersion) {
   if (currentVersion === null)
     return true;
-  return extraction.objectivesVersion === currentVersion;
+  return echoed.objectivesVersion === currentVersion;
 }
-function isBoundToRulings(extraction, currentOrdinal) {
-  if (extraction.rulingOrdinal === null)
+function isBoundToRulings(echoed, currentOrdinal) {
+  if (echoed.rulingOrdinal === null)
     return currentOrdinal === 0;
-  return extraction.rulingOrdinal === currentOrdinal;
+  return echoed.rulingOrdinal === currentOrdinal;
+}
+function isBoundToBriefHash(echoed, currentHash) {
+  if (currentHash === null)
+    return true;
+  return echoed.briefHash === currentHash;
+}
+function isBoundToPolicy(echoed, currentDigest) {
+  return echoed.policyDigest === currentDigest;
+}
+function compareManifest(echoed, current, patchIdOf) {
+  const exactHead = isBoundToHead(echoed, current.headSha);
+  const patchHead = exactHead ? false : isBoundByPatchIdentity(echoed, current.headSha, patchIdOf);
+  const head = exactHead || patchHead;
+  const base = patchHead ? true : isBoundToBase(echoed, current.baseSha);
+  const briefHashBound = isBoundToBriefHash(echoed, current.briefHash);
+  const objectivesVersion2 = isBoundToObjectives(echoed, current.objectivesVersion);
+  const rulingOrdinal = isBoundToRulings(echoed, current.rulingOrdinal);
+  const policyDigestBound = isBoundToPolicy(echoed, current.policyDigest);
+  return {
+    bound: head && base && briefHashBound && objectivesVersion2 && rulingOrdinal && policyDigestBound,
+    head,
+    base,
+    briefHash: briefHashBound,
+    objectivesVersion: objectivesVersion2,
+    rulingOrdinal,
+    policyDigest: policyDigestBound
+  };
 }
+
+// ../../packages/aeg-core/src/review-gate.ts
 function checkReviewGate(input) {
   const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const waived = isWaiverLabelActorVerified({
@@ -3764,15 +4096,58 @@ function checkReviewGate(input) {
   const verifiedBodies = verified.map((c) => c.body);
   const codeReview = extractCodeReviewVerdict(verifiedBodies);
   const security = extractSecurityReviewVerdict(verifiedBodies);
-  const codeReviewClean = codeReview.value === "APPROVE";
-  const securityClean = security.value === "PASS";
-  const codeReviewBound = isBoundToPatch(codeReview, input.headSha, input.patchIdOf);
-  const securityBound = isBoundToPatch(security, input.headSha, input.patchIdOf);
-  const codeReviewObjectivesBound = isBoundToObjectives(codeReview, input.objectivesVersion);
-  const securityObjectivesBound = isBoundToObjectives(security, input.objectivesVersion);
-  const codeReviewRulingsBound = isBoundToRulings(codeReview, input.rulingOrdinal);
-  const securityRulingsBound = isBoundToRulings(security, input.rulingOrdinal);
-  if (codeReviewClean && codeReviewBound && codeReviewObjectivesBound && codeReviewRulingsBound && securityClean && securityBound && securityObjectivesBound && securityRulingsBound && mechanicalChecksClean) {
+  const policy = input.policy ?? DEFAULT_REVIEW_POLICY;
+  let codeReviewPolicyEvaluation;
+  let securityPolicyEvaluation;
+  try {
+    codeReviewPolicyEvaluation = evaluateCodeReview(codeReview.findingSeverities, policy);
+    securityPolicyEvaluation = evaluateSecurityReview(security.findingSeverities, policy);
+  } catch (err) {
+    return {
+      verdict: "fail",
+      reason: `a verdict comment carries a finding severity this repository's policy does not recognize: ${err instanceof Error ? err.message : String(err)}`,
+      waived: false
+    };
+  }
+  const codeReviewTextClean = codeReview.value === "APPROVE";
+  const securityTextClean = security.value === "PASS";
+  const codeReviewPolicyClean = codeReviewPolicyEvaluation.outcome === "clean";
+  const securityPolicyClean = securityPolicyEvaluation.outcome === "clean";
+  const codeReviewClean = codeReviewTextClean && codeReviewPolicyClean;
+  const securityClean = securityTextClean && securityPolicyClean;
+  const currentManifest = {
+    headSha: input.headSha,
+    baseSha: input.baseSha ?? null,
+    briefHash: input.briefHash ?? null,
+    objectivesVersion: input.objectivesVersion,
+    rulingOrdinal: input.rulingOrdinal,
+    policyDigest: policyDigest(policy)
+  };
+  const codeReviewEchoed = {
+    headSha: codeReview.headSha,
+    baseSha: codeReview.baseSha,
+    briefHash: codeReview.briefHash,
+    objectivesVersion: codeReview.objectivesVersion,
+    rulingOrdinal: codeReview.rulingOrdinal,
+    policyDigest: codeReview.policyDigest
+  };
+  const securityEchoed = {
+    headSha: security.headSha,
+    baseSha: security.baseSha,
+    briefHash: security.briefHash,
+    objectivesVersion: security.objectivesVersion,
+    rulingOrdinal: security.rulingOrdinal,
+    policyDigest: security.policyDigest
+  };
+  const codeReviewBinding = compareManifest(codeReviewEchoed, currentManifest, input.patchIdOf);
+  const securityBinding = compareManifest(securityEchoed, currentManifest, input.patchIdOf);
+  const codeReviewBound = codeReviewBinding.head;
+  const securityBound = securityBinding.head;
+  const codeReviewObjectivesBound = codeReviewBinding.objectivesVersion;
+  const securityObjectivesBound = securityBinding.objectivesVersion;
+  const codeReviewRulingsBound = codeReviewBinding.rulingOrdinal;
+  const securityRulingsBound = securityBinding.rulingOrdinal;
+  if (codeReviewClean && codeReviewBinding.bound && securityClean && securityBinding.bound && mechanicalChecksClean) {
     return {
       verdict: "pass",
       reason: `code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS, both covering head ${input.headSha}, and every reported mechanical check is green.`,
@@ -3780,23 +4155,39 @@ function checkReviewGate(input) {
     };
   }
   const problems = [];
-  if (!codeReviewClean) {
+  if (!codeReviewTextClean) {
     problems.push(`code-reviewer verdict is not a clean APPROVE (found: ${codeReview.value})`);
+  } else if (!codeReviewPolicyClean) {
+    problems.push(`code-reviewer verdict says APPROVE but carries a finding (${codeReviewPolicyEvaluation.blockingFindings.map((f) => f.severity).join(", ")}) at or above this repository's code-review policy threshold (${policy.codeReviewThreshold}) — a reviewer's own APPROVE never overrides policy`);
   } else if (!codeReviewBound) {
     problems.push(`the newest code-review verdict covers ${codeReview.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  } else if (!codeReviewBinding.base) {
+    problems.push(`the newest code-review verdict was cast against base ${codeReview.baseSha ?? "no recorded base"}, the PR's base is now ${currentManifest.baseSha ?? "unresolved"} (a base-only change under an unchanged candidate — same patch text on a new base is not automatically equivalent)`);
   } else if (!codeReviewObjectivesBound) {
     problems.push(`the newest code-review verdict was cast against objectives version ${codeReview.objectivesVersion ?? "none"}, the Issue's list is now ${input.objectivesVersion}`);
   } else if (!codeReviewRulingsBound) {
     problems.push(`the newest code-review verdict was cast against ruling ordinal ${codeReview.rulingOrdinal ?? "none"}, a newer ruling (ruling ${input.rulingOrdinal}) is now posted on this PR`);
+  } else if (!codeReviewBinding.briefHash) {
+    problems.push(`the newest code-review verdict was cast against brief hash ${codeReview.briefHash ?? "none"}, the frozen brief's current hash is ${currentManifest.briefHash ?? "none"}`);
+  } else if (!codeReviewBinding.policyDigest) {
+    problems.push(`the newest code-review verdict was cast against review policy digest ${codeReview.policyDigest ?? "none"}, this repository's current policy digest is ${currentManifest.policyDigest}`);
   }
-  if (!securityClean) {
+  if (!securityTextClean) {
     problems.push(`security-review verdict is not a clean PASS (found: ${security.value})`);
+  } else if (!securityPolicyClean) {
+    problems.push(`security-review verdict says PASS but carries a finding (${securityPolicyEvaluation.blockingFindings.map((f) => f.severity).join(", ")}) at or above this repository's security policy threshold (${policy.securityThreshold}) — a reviewer's own PASS never overrides policy`);
   } else if (!securityBound) {
     problems.push(`the newest security-review verdict covers ${security.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  } else if (!securityBinding.base) {
+    problems.push(`the newest security-review verdict was cast against base ${security.baseSha ?? "no recorded base"}, the PR's base is now ${currentManifest.baseSha ?? "unresolved"} (a base-only change under an unchanged candidate — same patch text on a new base is not automatically equivalent)`);
   } else if (!securityObjectivesBound) {
     problems.push(`the newest security-review verdict was cast against objectives version ${security.objectivesVersion ?? "none"}, the Issue's list is now ${input.objectivesVersion}`);
   } else if (!securityRulingsBound) {
     problems.push(`the newest security-review verdict was cast against ruling ordinal ${security.rulingOrdinal ?? "none"}, a newer ruling (ruling ${input.rulingOrdinal}) is now posted on this PR`);
+  } else if (!securityBinding.briefHash) {
+    problems.push(`the newest security-review verdict was cast against brief hash ${security.briefHash ?? "none"}, the frozen brief's current hash is ${currentManifest.briefHash ?? "none"}`);
+  } else if (!securityBinding.policyDigest) {
+    problems.push(`the newest security-review verdict was cast against review policy digest ${security.policyDigest ?? "none"}, this repository's current policy digest is ${currentManifest.policyDigest}`);
   }
   if (!mechanicalChecksClean) {
     problems.push(reportedMechanicalChecks.length === 0 ? "no mechanical checks have reported for this head yet" : `mechanical check(s) not green: ${reportedMechanicalChecks.filter((c) => c.bucket !== "pass").map((c) => `${c.name} (${c.bucket})`).join(", ")}`);
@@ -4488,42 +4879,45 @@ function checkDispatchReadiness(input) {
   const { trancheSlug, task } = input;
   const taskLabel = `task ${task.id} (tranche ${trancheSlug})`;
   const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
-  const blockers = [];
+  const blockerDetails = [];
+  const push = (blockerClass, message) => {
+    blockerDetails.push({ class: blockerClass, message });
+  };
   if (task.issue === null) {
-    blockers.push(`dispatch-gate issue-existence: ${taskLabel} has no Issue (#TBD or blank) in the topology — not dispatchable until the Planner cuts the Issue.`);
+    push("issue-existence", `dispatch-gate issue-existence: ${taskLabel} has no Issue (#TBD or blank) in the topology — not dispatchable until the Planner cuts the Issue.`);
   } else if (input.issue === null) {
-    blockers.push(`dispatch-gate issue-existence: ${taskLabel} names Issue #${task.issue}, but it does not resolve to a real GitHub Issue (phantom reference).`);
+    push("issue-existence", `dispatch-gate issue-existence: ${taskLabel} names Issue #${task.issue}, but it does not resolve to a real GitHub Issue (phantom reference).`);
   }
   if (input.issue !== null && !input.issueRationalePass) {
-    blockers.push(`dispatch-gate rationale: Issue #${input.issue.number} for ${taskLabel} fails the rationale gate (checkIssueRationale) — the Planner must complete the eight-field rationale before this task is dispatchable.`);
+    push("rationale", `dispatch-gate rationale: Issue #${input.issue.number} for ${taskLabel} fails the rationale gate (checkIssueRationale) — the Planner must complete the eight-field rationale before this task is dispatchable.`);
   }
   for (const dep of input.dependsOn) {
     if (isSelfDependency(dep, task, input.issue)) {
       const issueStr = input.issue !== null ? `#${input.issue.number}` : "?";
-      blockers.push(`dispatch-gate INTERNAL: parsed a self-dependency for task ${task.id} (${issueStr}) — this is a parser bug in parseRationaleDeps, not a real dependency. Please report it upstream. Re-run once the rationale is corrected or the fix ships.`);
+      push("internal-self-dependency", `dispatch-gate INTERNAL: parsed a self-dependency for task ${task.id} (${issueStr}) — this is a parser bug in parseRationaleDeps, not a real dependency. Please report it upstream. Re-run once the rationale is corrected or the fix ships.`);
       continue;
     }
     if (dep.resolved === false) {
-      blockers.push(`dispatch-gate depends-on: ${taskLabel} depends on "${dep.id}", which is UNRESOLVABLE — the resolver could not find a matching tranche/task/Issue for this edge (not a claim about merge status). Not dispatchable until the edge is corrected.`);
+      push("depends-on-unresolvable", `dispatch-gate depends-on: ${taskLabel} depends on "${dep.id}", which is UNRESOLVABLE — the resolver could not find a matching tranche/task/Issue for this edge (not a claim about merge status). Not dispatchable until the edge is corrected.`);
       continue;
     }
     if (!dep.merged && !isHandClosedByRecognizedPrincipal(dep, principalAllowlist)) {
       const issueStr = dep.issue !== null ? ` (#${dep.issue})` : "";
-      blockers.push(`dispatch-gate depends-on: ${taskLabel} depends on ${dep.id}${issueStr}, whose PR is not merged yet — not dispatchable, it serializes behind it.`);
+      push("depends-on-not-merged", `dispatch-gate depends-on: ${taskLabel} depends on ${dep.id}${issueStr}, whose PR is not merged yet — not dispatchable, it serializes behind it.`);
     }
   }
   for (const c of input.conflictsWith) {
     if (c.openOrInFlight) {
       const issueStr = c.issue !== null ? ` (#${c.issue})` : "";
-      blockers.push(`dispatch-gate conflicts-with: ${taskLabel} conflicts with ${c.id}${issueStr}, whose PR is open or in-flight — not dispatchable until it merges.`);
+      push("conflicts-with", `dispatch-gate conflicts-with: ${taskLabel} conflicts with ${c.id}${issueStr}, whose PR is open or in-flight — not dispatchable until it merges.`);
     }
   }
   for (const proj of input.priorTrancheArchival) {
     if (proj.priorTrancheSlug !== null && !proj.archived) {
-      blockers.push(`dispatch-gate prior-tranche-archival: project \`${proj.project}\`'s previous tranche \`${proj.priorTrancheSlug}\` is not archived — the Tranche Archivist must run before new work on this product.`);
+      push("prior-tranche-archival", `dispatch-gate prior-tranche-archival: project \`${proj.project}\`'s previous tranche \`${proj.priorTrancheSlug}\` is not archived — the Tranche Archivist must run before new work on this product.`);
     }
   }
-  return { ready: blockers.length === 0, blockers };
+  return { ready: blockerDetails.length === 0, blockers: blockerDetails.map((b) => b.message), blockerDetails };
 }
 // ../../packages/aeg-core/src/single-plan-pr.ts
 function trancheSlugFromTopologyPath(path) {
@@ -4625,6 +5019,137 @@ function checkBranchTopology(input) {
     reason: `Branch \`${branch}\` matches topology row \`${taskId}\` in ${topoPath}.`
   };
 }
+// ../../packages/aeg-core/src/task-tools.ts
+import { z } from "zod";
+var TASK_TOOL_ERROR_KINDS = [
+  "validation",
+  "authority",
+  "precondition",
+  "capability",
+  "infrastructure",
+  "cancellation",
+  "timeout",
+  "uncertain_effect"
+];
+var TaskToolErrorSchema = z.object({
+  kind: z.enum(TASK_TOOL_ERROR_KINDS),
+  message: z.string().min(1),
+  detail: z.string().optional()
+});
+var TaskToolRefSchema = z.union([
+  z.object({ tranche: z.string().min(1), id: z.string().min(1) }).strict(),
+  z.object({ issue: z.number().int().positive() }).strict()
+]);
+var MAX_PAGE_LIMIT = 100;
+var PageRequestSchema = z.object({
+  cursor: z.string().optional(),
+  limit: z.number().int().positive().max(MAX_PAGE_LIMIT).optional()
+});
+var FreshnessSchema = z.enum(["fresh", "stale", "unknown"]);
+var ObservedSchema = z.object({
+  observedAt: z.string(),
+  freshness: FreshnessSchema
+});
+var TaskStatusInputSchema = z.object({
+  task: TaskToolRefSchema.optional()
+}).merge(PageRequestSchema).strict();
+var TaskStatusItemSchema = z.object({
+  task: TaskToolRefSchema,
+  issue: z.number().int().positive(),
+  pr: z.number().int().positive().nullable(),
+  state: z.string()
+}).merge(ObservedSchema);
+var TaskStatusResultSchema = z.object({
+  items: z.array(TaskStatusItemSchema),
+  nextCursor: z.string().nullable()
+});
+var RequestedAuthoritySchema = z.enum(["planner", "principal", "operator", "self"]);
+var EscalationInputsSchema = z.object({
+  task: z.number().int().positive(),
+  round: z.number().int().nonnegative(),
+  head: z.string(),
+  branch: z.string(),
+  prNumber: z.number().int().positive()
+});
+var EscalationEvidenceSchema = z.object({
+  round: z.number().int().nonnegative(),
+  reviewer: z.string().nullable(),
+  security: z.string().nullable()
+});
+var EscalationRunIdentitySchema = z.object({
+  runId: z.string(),
+  pid: z.number().int().positive(),
+  host: z.string()
+});
+var EscalationInputVersionsSchema = z.object({
+  briefHash: z.string().nullable(),
+  objectivesVersion: z.string().nullable(),
+  rulingOrdinal: z.number().int().nonnegative(),
+  policyDigest: z.string()
+});
+var TaskEscalationReadInputSchema = z.object({
+  task: TaskToolRefSchema
+}).merge(PageRequestSchema).strict();
+var TaskEscalationPacketSchema = z.object({
+  reason: z.string(),
+  detail: z.string().nullable(),
+  inputs: EscalationInputsSchema.nullable(),
+  evidence: EscalationEvidenceSchema.nullable(),
+  attemptedRecovery: z.string(),
+  requestedAuthority: RequestedAuthoritySchema,
+  permittedNextActions: z.array(z.string()),
+  runIdentity: EscalationRunIdentitySchema.nullable(),
+  inputVersions: EscalationInputVersionsSchema.nullable()
+}).merge(ObservedSchema);
+var TaskEscalationReadResultSchema = z.object({
+  items: z.array(TaskEscalationPacketSchema),
+  nextCursor: z.string().nullable()
+}).merge(ObservedSchema);
+var TaskStartInputSchema = z.object({
+  tranche: z.string().min(1),
+  id: z.string().min(1)
+}).strict();
+var TaskStartResultSchema = z.object({
+  requestId: z.string().min(1),
+  run: z.object({ tranche: z.string().min(1), id: z.string().min(1) }),
+  started: z.boolean(),
+  startedAt: z.string(),
+  mode: z.literal("attended")
+});
+var TaskResumeInputSchema = z.object({
+  task: TaskToolRefSchema
+}).strict();
+var TaskCancelInputSchema = z.object({
+  task: TaskToolRefSchema,
+  reason: z.string().min(1)
+}).strict();
+var TaskResumeResultSchema = z.object({
+  task: z.number().int().positive(),
+  pr: z.number().int().positive(),
+  escalationId: z.string().min(1),
+  outcome: z.enum(["started", "already_resumed"]),
+  authenticatedBy: z.string().min(1),
+  authenticatedFrom: z.string().min(1)
+});
+var TaskCancelOutcomeSchema = z.enum(["confirmed", "pending", "uncertain"]);
+var TaskCancelResultSchema = z.object({
+  task: z.number().int().positive(),
+  pr: z.number().int().positive(),
+  escalationId: z.string().min(1),
+  outcome: TaskCancelOutcomeSchema,
+  authenticatedBy: z.string().min(1),
+  authenticatedFrom: z.string().min(1),
+  fencedEffectKeys: z.array(z.string())
+});
+var TASK_TOOL_NAMES = [
+  "task_start",
+  "task_status",
+  "task_escalation_read",
+  "task_resume",
+  "task_cancel"
+];
+var OPERATOR_STATUS_FOLLOW = "task_status_follow";
+var OPERATOR_TOOL_GRANT = [...TASK_TOOL_NAMES, OPERATOR_STATUS_FOLLOW];
 // ../../packages/aeg-core/src/first-push-dispatch-gate.ts
 function parseTaskBranch(branch) {
   const m = /^task\/([^/]+)\/([^/]+)$/.exec(branch);
@@ -4708,7 +5233,6 @@ function decideIssueAssignment(input) {
   };
 }
 // ../../packages/aeg-core/src/test-plan-gate.ts
-var TASK_BRANCH_PATTERN2 = /^task\/[^/]+\/[^/]+$/;
 function evaluateTestPlanGate(body, branch) {
   if (!body) {
     return {
@@ -4721,7 +5245,7 @@ function evaluateTestPlanGate(body, branch) {
   }
   const located = locateTestPlanSection(body);
   if (!located.found) {
-    if (TASK_BRANCH_PATTERN2.test(branch)) {
+    if (parseTaskBranchIdentity(branch) !== null) {
       return {
         verdict: "fail",
         messages: [
@@ -4848,8 +5372,11 @@ function findWorkspaceEscapes(files, knownPaths, workspaceDirs = DEFAULT_WORKSPA
   }
   return findings;
 }
+// ../../packages/aeg-core/src/log/envelope.ts
+import { createHash as createHash5 } from "node:crypto";
+
 // ../../packages/aeg-core/src/log/schema.ts
-import { z } from "zod";
+import { z as z2 } from "zod";
 var ROLE_VALUES = [
   "planner",
   "developer",
@@ -4859,136 +5386,174 @@ var ROLE_VALUES = [
   "archivist",
   "architect"
 ];
-var RoleSchema = z.enum(ROLE_VALUES);
+var RoleSchema = z2.enum(ROLE_VALUES);
 var HOST_VALUES = ["hook", "ci", "cli", "loop"];
-var HostSchema = z.enum(HOST_VALUES);
+var HostSchema = z2.enum(HOST_VALUES);
 var RUN_ID_PATTERN = /^[A-Za-z0-9_.-]{1,128}$/;
-var HeaderMetaSchema = z.object({
-  schema: z.literal(1),
-  ts: z.string(),
-  run_id: z.string().regex(RUN_ID_PATTERN),
-  seq: z.number().int().nonnegative(),
-  repo: z.string().nullable(),
-  vinaya: z.string(),
-  doctrine: z.string(),
+var headerMetaCore = {
+  ts: z2.string(),
+  run_id: z2.string().regex(RUN_ID_PATTERN),
+  seq: z2.number().int().nonnegative(),
+  repo: z2.string().nullable(),
+  vinaya: z2.string(),
+  doctrine: z2.string(),
   host: HostSchema,
-  machine: z.string()
+  machine: z2.string()
+};
+var HeaderMetaV1Schema = z2.object({
+  schema: z2.literal(1),
+  ...headerMetaCore
+}).strict();
+var LineageSchema = z2.object({
+  run: z2.string().nullable(),
+  attempt: z2.number().int().nullable(),
+  parent: z2.string().nullable()
+}).strict();
+var InputVersionsSchema = z2.object({
+  objectives_version: z2.string().nullable(),
+  brief_hash: z2.string().nullable(),
+  ruling_ordinal: z2.number().int().nullable(),
+  policy_digest: z2.string().nullable()
 }).strict();
-var SubjectSchema = z.object({
-  issue: z.number().int().nullable(),
-  pr: z.number().int().optional(),
-  sha: z.string().optional(),
-  role: z.union([RoleSchema, z.literal("unattributed")]),
-  round: z.number().int().optional(),
-  objectives_version: z.string().optional()
+var ProvenanceSchema = z2.enum(["parent_attributed", "env_correlated", "self_reported", "unavailable"]);
+var HeaderMetaV2Schema = z2.object({
+  schema: z2.literal(2),
+  ...headerMetaCore,
+  event_id: z2.string().min(1),
+  process_id: z2.string().min(1),
+  actor_id: z2.string().nullable(),
+  lineage: LineageSchema,
+  input_versions: InputVersionsSchema,
+  provenance: ProvenanceSchema
 }).strict();
-var HeaderSchema = z.object({
+var HeaderMetaSchema = z2.discriminatedUnion("schema", [HeaderMetaV1Schema, HeaderMetaV2Schema]);
+var SubjectSchema = z2.object({
+  issue: z2.number().int().nullable(),
+  pr: z2.number().int().optional(),
+  sha: z2.string().optional(),
+  role: z2.union([RoleSchema, z2.literal("unattributed")]),
+  round: z2.number().int().optional(),
+  objectives_version: z2.string().optional()
+}).strict();
+var HeaderSchema = z2.object({
   meta: HeaderMetaSchema,
   subject: SubjectSchema
 }).strict();
 var envelopeTail = {
-  duration_ms: z.number().nonnegative().optional(),
-  payload: z.object({}).strict()
+  duration_ms: z2.number().nonnegative().optional(),
+  payload: z2.object({}).strict()
 };
-var DispatchOutcomeSchema = z.discriminatedUnion("type", [
-  z.object({ type: z.literal("pr_opened"), pr: z.number().int(), head: z.string() }).strict(),
-  z.object({
-    type: z.literal("round_pushed"),
-    pr: z.number().int(),
-    head: z.string(),
-    comment_id: z.number().int()
+var ReviewFindingSchema = z2.object({
+  id: z2.string(),
+  severity: z2.string(),
+  state: z2.string().optional(),
+  severity_scale: z2.string().optional(),
+  policy_treatment: z2.enum(["blocking", "non_blocking", "unavailable"]).optional(),
+  confidence: z2.number().min(0).max(1).optional(),
+  confidence_scale: z2.string().optional(),
+  confidence_source: z2.string().optional()
+}).strict();
+var DispatchOutcomeSchema = z2.discriminatedUnion("type", [
+  z2.object({ type: z2.literal("pr_opened"), pr: z2.number().int(), head: z2.string() }).strict(),
+  z2.object({
+    type: z2.literal("round_pushed"),
+    pr: z2.number().int(),
+    head: z2.string(),
+    comment_id: z2.number().int()
   }).strict(),
-  z.object({
-    type: z.literal("verdict"),
-    verdict: z.enum(["APPROVE", "REQUEST CHANGES", "PASS", "FAIL"]),
-    head: z.string(),
-    comment_id: z.number().int(),
-    objectives: z.array(z.object({ id: z.string(), met: z.boolean() }).strict()),
-    findings: z.array(z.object({ id: z.string(), severity: z.string(), state: z.string().optional() }).strict())
+  z2.object({
+    type: z2.literal("verdict"),
+    verdict: z2.enum(["APPROVE", "REQUEST CHANGES", "PASS", "FAIL"]),
+    head: z2.string(),
+    comment_id: z2.number().int(),
+    objectives: z2.array(z2.object({ id: z2.string(), met: z2.boolean() }).strict()),
+    findings: z2.array(ReviewFindingSchema)
   }).strict(),
-  z.object({
-    type: z.literal("escalation"),
-    class: z.enum(["authority", "strategy", "product"]),
-    comment_id: z.number().int()
+  z2.object({
+    type: z2.literal("escalation"),
+    class: z2.enum(["authority", "strategy", "product"]),
+    comment_id: z2.number().int()
   }).strict(),
-  z.object({ type: z.literal("brief"), comment_id: z.number().int(), hash: z.string() }).strict(),
-  z.object({ type: z.literal("plan"), issues: z.array(z.number().int()) }).strict(),
-  z.object({ type: z.literal("archive"), provenance_comment_id: z.number().int() }).strict()
+  z2.object({ type: z2.literal("brief"), comment_id: z2.number().int(), hash: z2.string() }).strict(),
+  z2.object({ type: z2.literal("plan"), issues: z2.array(z2.number().int()) }).strict(),
+  z2.object({ type: z2.literal("archive"), provenance_comment_id: z2.number().int() }).strict(),
+  z2.object({ type: z2.literal("completed") }).strict()
 ]);
 var dispatchShared = {
   meta: HeaderMetaSchema,
   subject: SubjectSchema,
-  kind: z.literal("dispatch"),
+  kind: z2.literal("dispatch"),
   ...envelopeTail,
   target_role: RoleSchema,
-  model: z.string(),
-  round: z.number().int().optional(),
-  effect_id: z.string()
+  model: z2.string(),
+  round: z2.number().int().optional(),
+  effect_id: z2.string()
 };
-var dispatchUsageField = z.object({ input: z.number().nonnegative(), output: z.number().nonnegative() }).strict().nullable();
-var DispatchEventSchema = z.discriminatedUnion("event", [
-  z.object({ ...dispatchShared, event: z.literal("dispatched"), prompt_hash: z.string() }).strict(),
-  z.object({
+var dispatchUsageField = z2.object({ input: z2.number().nonnegative(), output: z2.number().nonnegative() }).strict().nullable();
+var DispatchEventSchema = z2.discriminatedUnion("event", [
+  z2.object({ ...dispatchShared, event: z2.literal("dispatched"), prompt_hash: z2.string() }).strict(),
+  z2.object({
     ...dispatchShared,
-    event: z.literal("outcome_received"),
+    event: z2.literal("outcome_received"),
     outcome: DispatchOutcomeSchema,
     usage: dispatchUsageField
   }).strict(),
-  z.object({
+  z2.object({
     ...dispatchShared,
-    event: z.literal("dispatch_failed"),
-    reason: z.enum(["timeout", "crash", "refused", "unattributed_write"]),
+    event: z2.literal("dispatch_failed"),
+    reason: z2.enum(["timeout", "crash", "refused", "unattributed_write"]),
     usage: dispatchUsageField
   }).strict()
 ]);
 var loopShared = {
   meta: HeaderMetaSchema,
   subject: SubjectSchema,
-  kind: z.literal("dev_review_loop"),
+  kind: z2.literal("dev_review_loop"),
   ...envelopeTail,
-  loop_id: z.string()
+  loop_id: z2.string()
 };
-var DevReviewLoopEventSchema = z.discriminatedUnion("event", [
-  z.object({
+var DevReviewLoopEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
     ...loopShared,
-    event: z.literal("loop_started"),
-    task: z.number().int(),
-    policy: z.object({
-      max_rounds: z.number().int().nonnegative(),
-      reviewers: z.array(RoleSchema),
-      models: z.record(RoleSchema, z.string())
+    event: z2.literal("loop_started"),
+    task: z2.number().int(),
+    policy: z2.object({
+      max_rounds: z2.number().int().nonnegative(),
+      reviewers: z2.array(RoleSchema),
+      models: z2.record(RoleSchema, z2.string())
     }).strict()
   }).strict(),
-  z.object({ ...loopShared, event: z.literal("round_started"), round: z.number().int(), base_head: z.string() }).strict(),
-  z.object({
+  z2.object({ ...loopShared, event: z2.literal("round_started"), round: z2.number().int(), base_head: z2.string() }).strict(),
+  z2.object({
     ...loopShared,
-    event: z.literal("gate_result_read"),
-    round: z.number().int(),
-    head: z.string(),
-    green: z.boolean()
+    event: z2.literal("gate_result_read"),
+    round: z2.number().int(),
+    head: z2.string(),
+    green: z2.boolean()
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("verdicts_read"),
-    round: z.number().int(),
-    head: z.string(),
-    all_approve: z.boolean(),
-    blockers: z.number().int().nonnegative()
+    event: z2.literal("verdicts_read"),
+    round: z2.number().int(),
+    head: z2.string(),
+    all_approve: z2.boolean(),
+    blockers: z2.number().int().nonnegative(),
+    findings: z2.array(ReviewFindingSchema).optional()
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("findings_compared"),
-    round: z.number().int(),
-    open: z.array(z.string()),
-    resolved: z.array(z.string()),
-    new: z.array(z.string()),
-    recurring: z.array(z.string())
+    event: z2.literal("findings_compared"),
+    round: z2.number().int(),
+    open: z2.array(z2.string()),
+    resolved: z2.array(z2.string()),
+    new: z2.array(z2.string()),
+    recurring: z2.array(z2.string())
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("stop_condition_met"),
-    round: z.number().int(),
-    condition: z.enum([
+    event: z2.literal("stop_condition_met"),
+    round: z2.number().int(),
+    condition: z2.enum([
       "green",
       "max_rounds",
       "no_progress",
@@ -4998,42 +5563,49 @@ var DevReviewLoopEventSchema = z.discriminatedUnion("event", [
       "reappearance"
     ])
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("paused"),
-    round: z.number().int(),
-    reason: z.enum(["escalation", "principal_item", "refreeze_needed"])
+    event: z2.literal("paused"),
+    round: z2.number().int(),
+    reason: z2.enum(["escalation", "principal_item", "refreeze_needed"])
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("resumed"),
-    round: z.number().int(),
-    by: z.literal("principal")
+    event: z2.literal("resumed"),
+    round: z2.number().int(),
+    by: z2.literal("principal")
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("round_ended"),
-    round: z.number().int(),
-    base_head: z.string(),
-    head: z.string(),
-    files_changed: z.number().int().nonnegative(),
-    insertions: z.number().int().nonnegative(),
-    deletions: z.number().int().nonnegative(),
-    wall_ms: z.number().nonnegative(),
-    outcome: z.enum(["green", "changes_requested", "escalated"])
+    event: z2.literal("unpushed_work_resume"),
+    round: z2.number().int(),
+    branch: z2.string(),
+    detail: z2.string()
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("journal_finalized"),
-    rounds: z.number().int().nonnegative(),
-    total_wall_ms: z.number().nonnegative(),
-    time_to_green_ms: z.number().nonnegative().nullable(),
-    files_changed_total: z.number().int().nonnegative(),
-    final_head: z.string(),
-    result: z.enum(["merged_ready", "stopped"])
+    event: z2.literal("round_ended"),
+    round: z2.number().int(),
+    base_head: z2.string(),
+    head: z2.string(),
+    files_changed: z2.number().int().nonnegative(),
+    insertions: z2.number().int().nonnegative(),
+    deletions: z2.number().int().nonnegative(),
+    wall_ms: z2.number().nonnegative(),
+    outcome: z2.enum(["green", "changes_requested", "escalated"])
+  }).strict(),
+  z2.object({
+    ...loopShared,
+    event: z2.literal("journal_finalized"),
+    rounds: z2.number().int().nonnegative(),
+    total_wall_ms: z2.number().nonnegative(),
+    time_to_green_ms: z2.number().nonnegative().nullable(),
+    files_changed_total: z2.number().int().nonnegative(),
+    final_head: z2.string(),
+    result: z2.enum(["merged_ready", "stopped"])
   }).strict()
 ]);
-var ForgeOpSchema = z.enum([
+var ForgeOpSchema = z2.enum([
   "pr.create",
   "pr.comment",
   "pr.body.replace",
@@ -5047,24 +5619,434 @@ var ForgeOpSchema = z.enum([
   "label.add",
   "label.remove"
 ]);
-var ForgeWriteTargetSchema = z.object({
-  issue: z.number().int().optional(),
-  pr: z.number().int().optional()
+var ForgeWriteTargetSchema = z2.object({
+  issue: z2.number().int().optional(),
+  pr: z2.number().int().optional()
 }).strict();
 var forgeWriteShared = {
   meta: HeaderMetaSchema,
   subject: SubjectSchema,
-  kind: z.literal("forge_write"),
+  kind: z2.literal("forge_write"),
   ...envelopeTail,
   op: ForgeOpSchema,
   target: ForgeWriteTargetSchema
 };
-var ForgeWriteEventSchema = z.discriminatedUnion("event", [
-  z.object({ ...forgeWriteShared, event: z.literal("validated") }).strict(),
-  z.object({ ...forgeWriteShared, event: z.literal("refused"), reason: z.string() }).strict(),
-  z.object({ ...forgeWriteShared, event: z.literal("written"), comment_ids: z.array(z.string()) }).strict()
+var ForgeWriteEventSchema = z2.discriminatedUnion("event", [
+  z2.object({ ...forgeWriteShared, event: z2.literal("validated") }).strict(),
+  z2.object({ ...forgeWriteShared, event: z2.literal("refused"), reason: z2.string() }).strict(),
+  z2.object({ ...forgeWriteShared, event: z2.literal("written"), comment_ids: z2.array(z2.string()) }).strict()
+]);
+var GateOutcomeSchema = z2.enum([
+  "pass",
+  "fail",
+  "wait",
+  "skip",
+  "invalid_input",
+  "unavailable_dependency",
+  "timeout",
+  "cancelled"
+]);
+var gateShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("gate"),
+  ...envelopeTail,
+  check: z2.string(),
+  check_version: z2.string().nullable(),
+  policy_version: z2.string().nullable(),
+  input_fingerprint: z2.string().nullable()
+};
+var GateEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...gateShared,
+    event: z2.literal("checked"),
+    outcome: GateOutcomeSchema,
+    reason: z2.string().optional()
+  }).strict()
 ]);
-var LogEventSchema = z.union([DispatchEventSchema, DevReviewLoopEventSchema, ForgeWriteEventSchema]);
+var OperationResultSchema = z2.enum(["ok", "error", "refused", "timeout", "cancelled", "unavailable"]);
+var operationShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("operation"),
+  ...envelopeTail,
+  operation: z2.string(),
+  target: z2.string().nullable()
+};
+var OperationEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...operationShared,
+    event: z2.literal("completed"),
+    result: OperationResultSchema,
+    error_class: z2.string().nullable()
+  }).strict()
+]);
+var UsageUnitsSchema = z2.object({
+  input: z2.number().nonnegative().nullable(),
+  output: z2.number().nonnegative().nullable(),
+  cache: z2.number().nonnegative().nullable()
+}).strict();
+var usageShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("usage"),
+  ...envelopeTail,
+  model: z2.string().nullable(),
+  source: z2.string(),
+  semantics: z2.enum(["cumulative", "delta"])
+};
+var UsageEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...usageShared,
+    event: z2.literal("observed"),
+    units: UsageUnitsSchema,
+    unknown_reason: z2.string().nullable()
+  }).strict()
+]);
+var RoleAttemptOutcomeSchema = z2.enum([
+  "completed",
+  "incomplete",
+  "infrastructure_failed",
+  "cancelled",
+  "timed_out",
+  "capability_refused"
+]);
+var roleAttemptShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("role_attempt"),
+  ...envelopeTail,
+  actor: z2.string().nullable(),
+  attempt: z2.number().int().nullable(),
+  effect_id: z2.string(),
+  model: z2.string().nullable()
+};
+var RoleAttemptEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...roleAttemptShared,
+    event: z2.literal("attempted"),
+    outcome: RoleAttemptOutcomeSchema,
+    usage: dispatchUsageField
+  }).strict()
+]);
+var handoffShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("handoff"),
+  ...envelopeTail,
+  class: z2.enum(["authority", "strategy", "product"]),
+  reason: z2.string()
+};
+var HandoffEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...handoffShared,
+    event: z2.literal("raised"),
+    requested_decision: z2.string().nullable()
+  }).strict(),
+  z2.object({
+    ...handoffShared,
+    event: z2.literal("resolved"),
+    resolution: z2.string().nullable(),
+    resolved_by: z2.string().nullable()
+  }).strict()
+]);
+var EffectTargetSchema = z2.object({
+  kind: z2.string(),
+  ref: z2.string()
+}).strict();
+var effectShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("effect"),
+  ...envelopeTail,
+  effect_id: z2.string(),
+  target: EffectTargetSchema
+};
+var EffectEventSchema = z2.discriminatedUnion("event", [
+  z2.object({ ...effectShared, event: z2.literal("attempted") }).strict(),
+  z2.object({ ...effectShared, event: z2.literal("observed"), outcome: z2.enum(["success", "failure", "uncertain"]) }).strict(),
+  z2.object({ ...effectShared, event: z2.literal("verified"), outcome: z2.enum(["success", "failure", "uncertain"]) }).strict()
+]);
+var LogEventSchema = z2.union([
+  DispatchEventSchema,
+  DevReviewLoopEventSchema,
+  ForgeWriteEventSchema,
+  GateEventSchema,
+  OperationEventSchema,
+  UsageEventSchema,
+  RoleAttemptEventSchema,
+  HandoffEventSchema,
+  EffectEventSchema
+]);
+
+// ../../packages/aeg-core/src/log/envelope.ts
+function isRole(value) {
+  return value !== undefined && ROLE_VALUES.includes(value);
+}
+function actorIdFromEnv(role) {
+  return role === undefined || role === "" ? null : role;
+}
+function lineageFieldFromEnv(value) {
+  return value === undefined || value === "" ? null : value;
+}
+function attemptFromEnv(value) {
+  if (value === undefined || value === "")
+    return null;
+  const n = Number(value);
+  return Number.isInteger(n) ? n : null;
+}
+function provenanceFor(input) {
+  if (input.provenance)
+    return input.provenance;
+  if (input.env.role || input.env.task)
+    return "env_correlated";
+  return "unavailable";
+}
+function issueFromTask(task) {
+  if (task === undefined || task === "")
+    return null;
+  const n = Number(task);
+  return Number.isInteger(n) ? n : null;
+}
+function roundFromEnv(round) {
+  if (round === undefined || round === "")
+    return;
+  const n = Number(round);
+  return Number.isInteger(n) ? n : undefined;
+}
+function buildHeader(input) {
+  const role = isRole(input.env.role) ? input.env.role : "unattributed";
+  const round = roundFromEnv(input.env.round);
+  const subject = {
+    issue: issueFromTask(input.env.task),
+    role,
+    ...round !== undefined ? { round } : {},
+    ...input.subject ?? {}
+  };
+  return {
+    meta: {
+      schema: 2,
+      ts: input.now.toISOString(),
+      run_id: input.runId,
+      seq: input.seq,
+      repo: input.repo,
+      vinaya: input.vinaya,
+      doctrine: input.doctrine,
+      host: input.host,
+      machine: createHash5("sha256").update(input.hostname).digest("hex"),
+      event_id: input.eventId,
+      process_id: input.processId,
+      actor_id: actorIdFromEnv(input.env.role),
+      lineage: {
+        run: lineageFieldFromEnv(input.env.run),
+        attempt: attemptFromEnv(input.env.attempt),
+        parent: lineageFieldFromEnv(input.env.parent)
+      },
+      input_versions: {
+        objectives_version: input.inputVersions?.objectivesVersion ?? null,
+        brief_hash: input.inputVersions?.briefHash ?? null,
+        ruling_ordinal: input.inputVersions?.rulingOrdinal ?? null,
+        policy_digest: input.inputVersions?.policyDigest ?? null
+      },
+      provenance: provenanceFor(input)
+    },
+    subject
+  };
+}
+// ../../packages/aeg-core/src/log/redact.ts
+var GITHUB_TOKEN_PATTERN = /\b(?:gho_|ghp_|ghs_|ghu_|ghr_|github_pat_)[A-Za-z0-9_]+\b/g;
+var CLASSIC_GITHUB_PAT_PATTERN = /\b((?:token|GITHUB_TOKEN|PAT|api[_-]?key|api[_-]?token)\s*[:=]\s*)[a-f0-9]{40}\b/gi;
+var BEARER_TOKEN_PATTERN = /\bBearer\s+\S+/g;
+var AWS_ACCESS_KEY_PATTERN = /\bAKIA[0-9A-Z]{16}\b/g;
+var SLACK_TOKEN_PATTERN = /\bxox[baprs]-[0-9A-Za-z-]+\b/g;
+var STRIPE_KEY_PATTERN = /\b(?:sk|pk|rk)_(?:live|test)_[0-9A-Za-z]{10,}\b/g;
+var ANTHROPIC_KEY_PATTERN = /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g;
+var OPENAI_KEY_PATTERN = /\bsk-(?!ant-)[A-Za-z0-9]{20,}\b/g;
+var NPM_TOKEN_PATTERN = /\bnpm_[A-Za-z0-9]{36}\b/g;
+var JWT_PATTERN = /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g;
+var PEM_BLOCK_PATTERN = /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g;
+var BASIC_AUTH_URL_PATTERN = /(https?:\/\/)[^/\s:@]+:[^/\s@]+@/g;
+var GENERIC_SECRET_ASSIGNMENT_PATTERN = /\b((?:secret|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)\s*[:=]\s*)[A-Za-z0-9+/_=-]{16,}\b/gi;
+function redactString(value, home) {
+  let out = value.replace(GITHUB_TOKEN_PATTERN, "<redacted>").replace(CLASSIC_GITHUB_PAT_PATTERN, "$1<redacted>").replace(BEARER_TOKEN_PATTERN, "<redacted>").replace(AWS_ACCESS_KEY_PATTERN, "<redacted>").replace(SLACK_TOKEN_PATTERN, "<redacted>").replace(STRIPE_KEY_PATTERN, "<redacted>").replace(ANTHROPIC_KEY_PATTERN, "<redacted>").replace(OPENAI_KEY_PATTERN, "<redacted>").replace(NPM_TOKEN_PATTERN, "<redacted>").replace(JWT_PATTERN, "<redacted>").replace(PEM_BLOCK_PATTERN, "<redacted>").replace(BASIC_AUTH_URL_PATTERN, "$1<redacted>@").replace(GENERIC_SECRET_ASSIGNMENT_PATTERN, "$1<redacted>");
+  if (home.length > 0 && out.startsWith(home)) {
+    const rest = out.slice(home.length);
+    if (rest === "" || rest.startsWith("/"))
+      out = `~${rest}`;
+  }
+  return out;
+}
+function redact(value, home) {
+  if (typeof value === "string")
+    return redactString(value, home);
+  if (Array.isArray(value))
+    return value.map((v) => redact(v, home));
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = redact(v, home);
+    }
+    return out;
+  }
+  return value;
+}
+// ../../packages/aeg-core/src/log/store.ts
+function metaOf(obj) {
+  if (obj === null || typeof obj !== "object")
+    return null;
+  const meta = obj.meta;
+  if (meta === null || typeof meta !== "object")
+    return null;
+  return meta;
+}
+function recordIdentity(obj) {
+  const meta = metaOf(obj);
+  if (meta === null)
+    return null;
+  const eventId = meta.event_id;
+  if (typeof eventId === "string" && eventId.length > 0)
+    return eventId;
+  const runId = meta.run_id;
+  const seq = meta.seq;
+  if (typeof runId === "string" && runId.length > 0 && typeof seq === "number" && Number.isInteger(seq)) {
+    return `${runId}:${seq}`;
+  }
+  return null;
+}
+
+// ../../packages/aeg-core/src/log/artifact.ts
+var TASK_LOG_ARTIFACT_MAX_BYTES = 8 * 1024 * 1024;
+// ../../packages/aeg-core/src/dev-review-loop/journal-reconstruction.ts
+var STOPPED_CONDITIONS = new Set(["confidence", "reappearance", "no_progress", "max_rounds"]);
+// ../../packages/aeg-core/src/control-store/records.ts
+import { z as z3 } from "zod";
+var isoTimestamp = z3.string().min(1);
+var taskId = z3.number().int().positive();
+var epochNumber = z3.number().int().nonnegative();
+var RunRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("run"),
+  task: taskId,
+  runId: z3.string().min(1),
+  pid: z3.number().int().positive(),
+  host: z3.string().min(1),
+  startedAt: isoTimestamp,
+  childStartedAt: z3.string().min(1).nullable().optional(),
+  childCommand: z3.string().min(1).nullable().optional()
+}).strict();
+var InputRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("input"),
+  task: taskId,
+  runId: z3.string().min(1),
+  source: z3.union([z3.literal("fresh"), z3.literal("resume")]),
+  pr: z3.number().int().positive().nullable(),
+  round: z3.number().int().nonnegative(),
+  recordedAt: isoTimestamp
+}).strict();
+var OwnershipRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("ownership"),
+  task: taskId,
+  epoch: epochNumber,
+  ownerId: z3.string().min(1),
+  pid: z3.number().int().positive(),
+  host: z3.string().min(1),
+  acquiredAt: isoTimestamp
+}).strict();
+var TransitionRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("transition"),
+  task: taskId,
+  epoch: epochNumber,
+  seq: z3.number().int().nonnegative(),
+  from: z3.string().min(1),
+  to: z3.string().min(1),
+  detail: z3.string().optional(),
+  at: isoTimestamp
+}).strict();
+var ManifestRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("manifest"),
+  task: taskId,
+  round: epochNumber,
+  repository: z3.string().min(1),
+  pr: z3.number().int().positive(),
+  branch: z3.string().min(1),
+  baseSha: z3.string().min(1).nullable(),
+  headSha: z3.string().min(1),
+  briefHash: z3.string().min(1).nullable(),
+  objectivesVersion: z3.string().min(1).nullable(),
+  rulingOrdinal: epochNumber,
+  policyDigest: z3.string().min(1),
+  recordedAt: isoTimestamp
+}).strict();
+var roundHeadIdentity = z3.object({ round: z3.number().int().positive(), head: z3.string().min(1) }).strict();
+var LoopBudgetsSchema = z3.object({
+  mechanicalRetries: z3.number().int().nonnegative(),
+  reviewRounds: z3.number().int().nonnegative(),
+  infrastructureRetries: z3.number().int().nonnegative()
+}).strict();
+var LoopStateRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("loop_state"),
+  task: taskId,
+  round: z3.number().int().positive(),
+  phase: z3.string().min(1),
+  pauseReason: z3.string().min(1).nullable(),
+  budgets: LoopBudgetsSchema,
+  heldResult: roundHeadIdentity.nullable(),
+  deliveredFindings: roundHeadIdentity.nullable(),
+  recordedAt: isoTimestamp
+}).strict();
+var EffectRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("effect"),
+  task: taskId,
+  key: z3.string().min(1),
+  operation: z3.string().min(1),
+  target: z3.string().min(1),
+  inputVersion: z3.number().int().nonnegative(),
+  payloadDigest: z3.string().min(1),
+  status: z3.union([z3.literal("started"), z3.literal("verified"), z3.literal("uncertain")]),
+  url: z3.string().optional(),
+  recordedAt: isoTimestamp
+}).strict();
+var EscalationRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("escalation"),
+  task: taskId,
+  escalationId: z3.string().min(1),
+  round: epochNumber,
+  head: z3.string().min(1),
+  branch: z3.string().min(1),
+  pr: z3.number().int().positive().nullable(),
+  runId: z3.string().min(1),
+  pid: z3.number().int().positive(),
+  host: z3.string().min(1),
+  agent: z3.string().min(1).optional(),
+  reason: z3.string().min(1),
+  detail: z3.string().optional(),
+  evidence: z3.string().optional(),
+  attemptedRecovery: z3.string().min(1),
+  requestedDecision: z3.string().min(1),
+  recipient: z3.string().min(1),
+  briefHash: z3.string().min(1).nullable(),
+  objectivesVersion: z3.string().min(1).nullable(),
+  rulingOrdinal: epochNumber,
+  policyDigest: z3.string().min(1),
+  recordedAt: isoTimestamp
+}).strict();
+var ResolutionRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("resolution"),
+  task: taskId,
+  escalationId: z3.string().min(1),
+  decision: z3.union([z3.literal("resume"), z3.literal("cancel")]),
+  authenticatedBy: z3.string().min(1),
+  authenticatedFrom: z3.string().min(1),
+  consumedAt: isoTimestamp
+}).strict();
 // ../../packages/sources/src/commands.ts
 var COMMANDS = [
   {
@@ -5223,6 +6205,27 @@ var COMMANDS = [
     ],
     status: "shipped"
   },
+  {
+    name: "task status",
+    description: "Every open task with a frozen brief, its pull request, and whether its loop is running, paused, or published",
+    flags: [{ flag: "--json", description: "Enveloped JSON output (schema: 1)" }],
+    details: [
+      "Read-only: one `gh issue list` for every open task Issue across every tranche (title/label resolved through the same `resolveTaskIssueRef` `list-tasks.ts` already uses), the open pull request per branch, and the driver pid record / pause record / publish effect markers under `<outboxRoot>/dev-review-loop/<task>/` — never a `ps` scan, never a re-parse of posted verdict comments to decide `published`.",
+      "`running` names the driver's pid (`review-validity-v1` task 7's pid record); `paused` names the reason from the pause record; `published` means the newest round's reviewer and security verdict effect markers both read `posted`; `no driver` is the fallback when none of the above holds.",
+      "`vinaya task status <tranche> <n>` narrows to one task and adds the last round's held or published verdict lines (`round-<n>-reviewer.md`/`round-<n>-security.md`, whichever their outbox carries) plus the exact `vinaya dev-review-loop --resume <pr>` command when paused."
+    ],
+    status: "shipped"
+  },
+  {
+    name: "task-tools serve",
+    description: "Run the task-operator MCP tool server over stdio — the command both runtime adapters register",
+    details: [
+      "Exposes the task-operator tool catalog (`packages/aeg-core/src/task-tools.ts`) to an agent runtime as one MCP server speaking newline-delimited JSON-RPC 2.0 (`initialize`/`tools/list`/`tools/call`). Claude registers it through the generated `.mcp.json`; Codex through its documented `~/.codex/config.toml` `[mcp_servers]` table — both point at this same command.",
+      "stdout carries JSON-RPC and nothing else: any stray write from the CLI (a forge-read warning) is redirected to stderr, so the protocol stream is never corrupted.",
+      "`task_status`/`task_escalation_read` read; `task_start` starts a run in attended mode only, requiring an authenticated caller from the invocation context (`VINAYA_MCP_CALLER`) and refusing without one — MCP is a transport, not authorization. `task_resume`/`task_cancel` require the same authenticated caller, plus a current Principal ruling read fresh from the run's own PR — never a caller-supplied approval; `task_resume` triggers the existing `dev-review-loop --resume` continuation exactly once per escalation, and `task_cancel` reports a truthful `confirmed`/`pending`/`uncertain` outcome, idempotently, across repeated calls. No unattended start until the worker-isolation boundary and a capability flag land."
+    ],
+    status: "shipped"
+  },
   {
     name: "pr create",
     description: "Open a pull request after full brief-schema validation",
@@ -5367,6 +6370,30 @@ var COMMANDS = [
     ],
     status: "shipped"
   },
+  {
+    name: "log export-artifact",
+    description: "Copy this run's own local outbox into a file, for the generated task-path workflow's own upload step",
+    flags: [],
+    details: [
+      "Concatenates every `*.ndjson` file under `~/.vinaya/outbox/` into `<dest>`, verbatim — no filtering, no second redaction pass (lines are already redacted at `log()`'s own write boundary). Writes nothing when the outbox is empty, and exits 0 either way: no gate events this run is a legitimate outcome, never a failure.",
+      "Runs inside the generated `vinaya-checks.yml` job, which holds no forge-write credential — this command never calls the forge. Both this step and the `actions/upload-artifact` step after it run `if: always()`, so a cancelled or failed job still exports whatever partial outbox it has."
+    ],
+    status: "shipped"
+  },
+  {
+    name: "log collect-artifact",
+    description: "Validate a downloaded task-log artifact and publish the valid records through the existing flush path",
+    flags: [
+      { flag: "--pr", description: "The pull request this artifact belongs to" },
+      { flag: "--repo", description: "Expected `owner/repo` — a provenance cross-check against each record" }
+    ],
+    details: [
+      "Runs inside the generated `vinaya-task-log-collector.yml` workflow — a `workflow_run`-triggered job on the default branch, holding the write credential the task-path job that produced the artifact never gets. `<path>` is already downloaded by that workflow, scoped to a specific, API-verified run id — a provenance guarantee this command never re-derives from the artifact bytes.",
+      "Never executes, imports, or evaluates the artifact's content: every line is read as text and validated (schema, an 8 MiB whole-artifact size cap, redaction, and a repo cross-check) before anything is trusted. A rejected line becomes a named gap — printed, never a silent drop — and the artifact is never partially trusted past that check into executing anything.",
+      "The valid, re-redacted survivors are appended into the same local outbox `vinaya log flush` would read for that PR's Issue, then published through the existing `flushOutbox` unmodified — reusing its chunking, its `<!-- aeg:log:… -->` marker, and its idempotent-retry read, rather than a second publisher. A retried collector run (a fresh runner, the same forge state) therefore dedupes for free: the marker already on the forge is acknowledged, never re-posted."
+    ],
+    status: "shipped"
+  },
   {
     name: "milestone create",
     description: "Create a GitHub Milestone from a validated body",
@@ -5732,10 +6759,10 @@ function createForgeSource(config) {
   };
 }
 // ../../packages/sources/src/select-source.ts
-import { z as z2 } from "zod";
-var StateSourceConfigSchema = z2.discriminatedUnion("kind", [
-  z2.object({ kind: z2.literal("forge"), owner: z2.string(), repo: z2.string() }),
-  z2.object({ kind: z2.literal("file"), root: z2.string().optional() })
+import { z as z4 } from "zod";
+var StateSourceConfigSchema = z4.discriminatedUnion("kind", [
+  z4.object({ kind: z4.literal("forge"), owner: z4.string(), repo: z4.string() }),
+  z4.object({ kind: z4.literal("file"), root: z4.string().optional() })
 ]);
 // src/checks/contract.ts
 var CHECK_SCHEMA_VERSION = 1;
@@ -5749,27 +6776,29 @@ import { execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync as readFileSync2, realpathSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
-import { z as z3 } from "zod";
+import { z as z5 } from "zod";
 
 // src/lib/agent-vendors.ts
 var AGENT_VENDORS = ["skills", "claude", "gemini"];
 
 // src/lib/config.ts
-var EnvEntrySchema = z3.union([
-  z3.literal(true),
-  z3.object({ optional: z3.literal(true) }),
-  z3.object({ anyOf: z3.array(z3.string()).min(2) }),
-  z3.string()
+var EnvEntrySchema = z5.union([
+  z5.literal(true),
+  z5.object({ optional: z5.literal(true) }),
+  z5.object({ anyOf: z5.array(z5.string()).min(2) }),
+  z5.string()
 ]);
-var CheckEntrySchema = z3.object({
-  run: z3.string(),
-  scope: z3.enum(["diff", "full"]),
-  include: z3.array(z3.string()).optional(),
-  args: z3.array(z3.string()).optional(),
-  timeoutMs: z3.number().optional(),
-  env: z3.record(z3.string(), EnvEntrySchema).optional(),
-  requiresOpenPr: z3.boolean().optional(),
-  ownWorkflow: z3.boolean().optional()
+var CheckEntrySchema = z5.object({
+  run: z5.string(),
+  scope: z5.enum(["diff", "full"]),
+  include: z5.array(z5.string()).optional(),
+  args: z5.array(z5.string()).optional(),
+  timeoutMs: z5.number().optional(),
+  env: z5.record(z5.string(), EnvEntrySchema).optional(),
+  requiresOpenPr: z5.boolean().optional(),
+  ownWorkflow: z5.boolean().optional(),
+  principalOwed: z5.literal(true).optional(),
+  validates: z5.enum(["body", "issue"]).optional()
 }).superRefine((entry2, ctx) => {
   if (!entry2.env)
     return;
@@ -5779,25 +6808,26 @@ var CheckEntrySchema = z3.object({
     const members = value.anyOf;
     if (new Set(members).size !== members.length) {
       ctx.addIssue({
-        code: z3.ZodIssueCode.custom,
+        code: z5.ZodIssueCode.custom,
         message: `env.${key}.anyOf has duplicate members`,
         path: ["env", key, "anyOf"]
       });
     }
     if (!members.includes(key)) {
       ctx.addIssue({
-        code: z3.ZodIssueCode.custom,
+        code: z5.ZodIssueCode.custom,
         message: `env.${key}.anyOf must include "${key}" itself as a member`,
         path: ["env", key, "anyOf"]
       });
     }
   }
 });
-var RoleEntrySchema = z3.object({
-  contract: z3.string().refine((p) => p.includes("/"), {
+var RoleEntrySchema = z5.object({
+  contract: z5.string().refine((p) => p.includes("/"), {
     message: 'must be a path (contain at least one "/"), not a bare filename'
   })
 });
+var MAX_REPORT_COMMAND_TIMEOUT_MS = 3600000;
 var BRIEF_BUILTINS = [
   "tier",
   "testPlan",
@@ -5817,17 +6847,17 @@ var BRIEF_BUILTINS = [
   "briefSections",
   "milestoneShape"
 ];
-var BriefSectionSchema = z3.union([
-  z3.object({ builtin: z3.enum(BRIEF_BUILTINS) }),
-  z3.object({ heading: z3.string().min(1), name: z3.string().optional() }),
-  z3.object({ field: z3.string().min(1), name: z3.string().optional() }),
-  z3.object({ phrase: z3.string().min(1), name: z3.string().optional() })
+var BriefSectionSchema = z5.union([
+  z5.object({ builtin: z5.enum(BRIEF_BUILTINS) }),
+  z5.object({ heading: z5.string().min(1), name: z5.string().optional() }),
+  z5.object({ field: z5.string().min(1), name: z5.string().optional() }),
+  z5.object({ phrase: z5.string().min(1), name: z5.string().optional() })
 ]);
-var BriefSchemaSchema = z3.object({
-  pr: z3.object({ sections: z3.array(BriefSectionSchema) }).optional(),
-  issue: z3.object({ sections: z3.array(BriefSectionSchema) }).optional(),
-  milestone: z3.object({ sections: z3.array(BriefSectionSchema) }).optional(),
-  ack: z3.array(z3.enum(BRIEF_BUILTINS)).optional()
+var BriefSchemaSchema = z5.object({
+  pr: z5.object({ sections: z5.array(BriefSectionSchema) }).optional(),
+  issue: z5.object({ sections: z5.array(BriefSectionSchema) }).optional(),
+  milestone: z5.object({ sections: z5.array(BriefSectionSchema) }).optional(),
+  ack: z5.array(z5.enum(BRIEF_BUILTINS)).optional()
 });
 function isSafeRepoRelPath(p) {
   if (p.length === 0)
@@ -5836,7 +6866,7 @@ function isSafeRepoRelPath(p) {
     return false;
   return p.split(/[\\/]/).every((seg) => seg !== ".." && seg !== "");
 }
-var SafeRepoRelPath = z3.string().refine(isSafeRepoRelPath, {
+var SafeRepoRelPath = z5.string().refine(isSafeRepoRelPath, {
   message: "must be a repo-root-relative path with no `..` segment or absolute root"
 });
 var CANONICAL_HOOK_BLOCK_PREFIXES = [".git/", ".husky/", ".vinaya/hooks/", ".claude/hooks/"];
@@ -5846,22 +6876,22 @@ function isCanonicalHookBlockPath(p) {
 var ManagedHookBlockPath = SafeRepoRelPath.refine(isCanonicalHookBlockPath, {
   message: `must start with one of ${CANONICAL_HOOK_BLOCK_PREFIXES.join(", ")} (byte-exact, case-sensitive)`
 });
-var ManagedBlockRecordSchema = z3.object({
+var ManagedBlockRecordSchema = z5.object({
   path: ManagedHookBlockPath,
-  marker: z3.string(),
-  comment: z3.enum(["hash", "html"])
+  marker: z5.string(),
+  comment: z5.enum(["hash", "html"])
 });
-var ManagedManifestSchema = z3.object({
-  version: z3.number().int().positive(),
-  files: z3.array(SafeRepoRelPath),
-  blocks: z3.array(ManagedBlockRecordSchema),
-  labels: z3.array(z3.string()),
-  agents: z3.array(z3.enum(AGENT_VENDORS)).optional()
+var ManagedManifestSchema = z5.object({
+  version: z5.number().int().positive(),
+  files: z5.array(SafeRepoRelPath),
+  blocks: z5.array(ManagedBlockRecordSchema),
+  labels: z5.array(z5.string()),
+  agents: z5.array(z5.enum(AGENT_VENDORS)).optional()
 });
-var ProjectEntrySchema = z3.object({
-  name: z3.string().min(1),
-  description: z3.string().min(1).optional(),
-  path: z3.string().min(1).optional()
+var ProjectEntrySchema = z5.object({
+  name: z5.string().min(1),
+  description: z5.string().min(1).optional(),
+  path: z5.string().min(1).optional()
 });
 function parseTokensCollectDeclaration(value) {
   const m = value.trim().match(/^(\S+)\s+(\S+)$/);
@@ -5872,34 +6902,62 @@ function parseTokensCollectDeclaration(value) {
     return null;
   return { interpreter, script };
 }
-var VinayaConfigSchema = z3.object({
-  rings: z3.object({
-    ring1_forgeWriteInterception: z3.boolean(),
-    ring2_asyncAudits: z3.boolean()
+var VinayaConfigSchema = z5.object({
+  rings: z5.object({
+    ring1_forgeWriteInterception: z5.boolean(),
+    ring2_asyncAudits: z5.boolean()
   }).optional(),
-  checks: z3.record(z3.string(), CheckEntrySchema).optional(),
-  roles: z3.record(z3.string(), RoleEntrySchema).optional(),
+  checks: z5.record(z5.string(), CheckEntrySchema).optional(),
+  roles: z5.record(z5.string(), RoleEntrySchema).optional(),
   briefSchema: BriefSchemaSchema.optional(),
   managed: ManagedManifestSchema.optional(),
-  principals: z3.array(z3.string()).min(1).optional(),
-  releaseActor: z3.string().min(1).optional(),
-  ci: z3.object({ setup: z3.string().min(1) }).optional(),
-  tokens: z3.object({
-    collect: z3.string().min(1).refine((v) => parseTokensCollectDeclaration(v) !== null, {
+  principals: z5.array(z5.string()).min(1).optional(),
+  releaseActor: z5.string().min(1).optional(),
+  ci: z5.object({ setup: z5.string().min(1) }).optional(),
+  tokens: z5.object({
+    collect: z5.string().min(1).refine((v) => parseTokensCollectDeclaration(v) !== null, {
       message: 'tokens.collect must be exactly "<interpreter> <repo-relative-script-path>" — two whitespace-separated tokens, no flags, no shell syntax, no quoting'
     })
   }).optional(),
-  blastRadius: z3.object({ extraDomains: z3.array(z3.string()).optional() }).optional(),
-  proseGates: z3.object({
-    doctrineRoot: z3.string().min(1).optional(),
-    readerFacingPrefix: z3.string().min(1).optional(),
-    readerFacingSuffix: z3.string().min(1).optional(),
-    legacySlugDir: z3.string().min(1).optional()
+  blastRadius: z5.object({ extraDomains: z5.array(z5.string()).optional() }).optional(),
+  proseGates: z5.object({
+    doctrineRoot: z5.string().min(1).optional(),
+    readerFacingPrefix: z5.string().min(1).optional(),
+    readerFacingSuffix: z5.string().min(1).optional(),
+    legacySlugDir: z5.string().min(1).optional()
+  }).optional(),
+  projects: z5.array(ProjectEntrySchema).optional(),
+  dispatch: z5.object({
+    timeoutMs: z5.number().int().positive().optional(),
+    killGraceMs: z5.number().int().positive().optional(),
+    agent: z5.enum(["claude", "codex", "gemini"]).optional()
   }).optional(),
-  projects: z3.array(ProjectEntrySchema).optional(),
-  dispatch: z3.object({
-    timeoutMs: z3.number().int().positive().optional(),
-    agent: z3.enum(["claude", "codex", "gemini"]).optional()
+  reviewPolicy: z5.object({
+    codeReviewThreshold: z5.string().min(1).optional(),
+    securityThreshold: z5.string().min(1).optional(),
+    maxRounds: z5.number().optional()
+  }).optional(),
+  prePush: z5.object({
+    alwaysRun: z5.array(z5.string()).optional()
+  }).optional(),
+  report: z5.object({
+    commandTimeoutMs: z5.number().int().positive().optional()
+  }).superRefine((report, ctx) => {
+    const commandTimeoutMs = report.commandTimeoutMs;
+    if (commandTimeoutMs !== undefined && commandTimeoutMs > MAX_REPORT_COMMAND_TIMEOUT_MS) {
+      ctx.addIssue({
+        code: z5.ZodIssueCode.custom,
+        path: ["commandTimeoutMs"],
+        message: "must be at most 3600000 (1 hour)"
+      });
+    }
+  }).optional(),
+  logPublish: z5.object({
+    issue: z5.number().int().positive().optional(),
+    pr: z5.number().int().positive().optional(),
+    maxChunksPerFlush: z5.number().int().positive().optional()
+  }).refine((v) => !(v.issue !== undefined && v.pr !== undefined), {
+    message: "logPublish: set at most one of issue/pr, not both"
   }).optional()
 });
 var GLOBAL_VINAYA_HOME = join(homedir(), ".vinaya");
@@ -5974,6 +7032,28 @@ function resolvePrincipalAllowlist(config) {
 function resolveReleaseActor(config) {
   return config?.releaseActor ?? DEFAULT_RELEASE_ACTOR;
 }
+function resolveReviewPolicy(config) {
+  const raw = config?.reviewPolicy;
+  if (!raw)
+    return DEFAULT_REVIEW_POLICY;
+  const codeReviewThreshold = raw.codeReviewThreshold ?? DEFAULT_REVIEW_POLICY.codeReviewThreshold;
+  if (!isKnownSeverity(CODE_REVIEW_SEVERITY_ORDER, codeReviewThreshold)) {
+    throw new Error(`vinaya.config.json: reviewPolicy.codeReviewThreshold "${codeReviewThreshold}" is not one of ${CODE_REVIEW_SEVERITY_ORDER.join(" > ")} — fix the config, this never falls back to a default.`);
+  }
+  const securityThreshold = raw.securityThreshold ?? DEFAULT_REVIEW_POLICY.securityThreshold;
+  if (!isKnownSeverity(SECURITY_SEVERITY_ORDER, securityThreshold)) {
+    throw new Error(`vinaya.config.json: reviewPolicy.securityThreshold "${securityThreshold}" is not one of ${SECURITY_SEVERITY_ORDER.join(" > ")} — fix the config, this never falls back to a default.`);
+  }
+  const maxRounds = raw.maxRounds ?? DEFAULT_REVIEW_POLICY.maxRounds;
+  if (!Number.isInteger(maxRounds) || maxRounds < 1) {
+    throw new Error(`vinaya.config.json: reviewPolicy.maxRounds "${maxRounds}" is not a positive integer — fix the config, this never falls back to a default.`);
+  }
+  return {
+    codeReviewThreshold,
+    securityThreshold,
+    maxRounds
+  };
+}
 function trustAnchorRepo() {
   const wellFormed = (slug) => /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
   const fromRunner = process.env.GITHUB_REPOSITORY?.trim();
@@ -6311,14 +7391,99 @@ function containedRealPath(root, p) {
     return null;
   }
 }
+function fetchIssueJson(issueNumber) {
+  try {
+    const out = execFileSync4("gh", ["issue", "view", String(issueNumber), "--json", "number,state,body,labels"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    return JSON.parse(out);
+  } catch {
+    return null;
+  }
+}
+async function runIssueMode(issueNumber) {
+  const issueJson = fetchIssueJson(issueNumber);
+  if (!issueJson) {
+    fail(`dispatch-gate issue-existence: Issue #${issueNumber} does not resolve on the forge.`, "Confirm the Issue number is correct and `gh auth status` passes, then re-run `vinaya check dispatch-readiness`.");
+  }
+  if (issueJson.labels.some((l) => l.name.startsWith("vinaya/tranche:"))) {
+    fail(`dispatch-gate: Issue #${issueNumber} carries a vinaya/tranche:* label — it belongs to a tranche, not the tranche-less backlog path.`, "This Issue has a real tranche home — run this check on its tranche-shaped branch instead.");
+  }
+  const repo = resolveRepo2();
+  if (!repo) {
+    fail("dispatch-gate severity:infra — could not resolve owner/repo.", "Set AEG_REPO=owner/repo, or confirm `git remote get-url origin` resolves to a GitHub URL, then re-run `vinaya check dispatch-readiness`.");
+  }
+  const issueRationalePass = checkIssueRationale(issueJson.body).status !== "fail";
+  const { dependsOn: dependsOnIds, conflictsWith: conflictsWithIds } = parseRationaleDeps(issueJson.body);
+  const taskById = new Map;
+  const factsByTaskId = new Map;
+  const dependsOn = await Promise.all(dependsOnIds.map(async (dep) => {
+    const r = await resolveEdge(dep, taskById, factsByTaskId, repo);
+    return {
+      id: dep,
+      issue: r.issue,
+      merged: r.merged,
+      resolved: r.resolved,
+      issueState: r.issueState,
+      stateReason: r.stateReason,
+      closedByActor: r.closedByActor
+    };
+  }));
+  const conflictsWith = await Promise.all(conflictsWithIds.map(async (c) => {
+    const r = await resolveEdge(c, taskById, factsByTaskId, repo);
+    return { id: c, issue: r.issue, openOrInFlight: r.open };
+  }));
+  const task = {
+    id: String(issueNumber),
+    title: "",
+    issue: issueNumber,
+    projects: [],
+    dependsOn: dependsOnIds,
+    conflictsWith: conflictsWithIds,
+    rationaleMarkdown: ""
+  };
+  const input = {
+    trancheSlug: `issue-${issueNumber}`,
+    task,
+    issue: { number: issueNumber, state: issueJson.state === "OPEN" ? "open" : "closed" },
+    issueRationalePass,
+    dependsOn,
+    conflictsWith,
+    priorTask: null,
+    priorTrancheArchival: [],
+    principalAllowlist: resolvePrincipalAllowlist(loadTrustAnchorConfig())
+  };
+  const result = checkDispatchReadiness(input);
+  let ready = true;
+  if (!result.ready) {
+    for (const detail of result.blockerDetails) {
+      emitCheckError({
+        schema: CHECK_SCHEMA_VERSION,
+        check: CHECK_NAME,
+        severity: "error",
+        message: detail.message,
+        agent_recovery_prompt: recoveryPromptFor(detail.class)
+      });
+    }
+    ready = false;
+  }
+  if (!checkPremiseReassertion())
+    ready = false;
+  process.exit(ready ? 0 : 1);
+}
 async function main() {
   const branch = currentBranch();
-  const m = branch.match(/^task\/([^/]+)\/(.+)$/);
-  if (!m) {
+  const ref = parseTaskBranchIdentity(branch);
+  if (!ref) {
     process.exit(0);
   }
-  const trancheSlug = m[1];
-  const taskId = m[2];
+  if (ref.kind === "issue") {
+    await runIssueMode(ref.issueNumber);
+    return;
+  }
+  const trancheSlug = ref.tranche;
+  const taskId2 = ref.taskId;
   const repo = resolveRepo2();
   if (!repo) {
     fail("dispatch-gate severity:infra — could not resolve owner/repo.", "Set AEG_REPO=owner/repo, or confirm `git remote get-url origin` resolves to a GitHub URL, then re-run `vinaya check dispatch-readiness`.");
@@ -6330,9 +7495,9 @@ async function main() {
   } catch (err) {
     fail(`dispatch-gate severity:infra — could not derive tranche "${trancheSlug}" from the forge: ${err.message}`, "Confirm `gh auth status` passes and the tranche has a Milestone + labeled Issues on the forge, then re-run this check.");
   }
-  const task = tranche.tasks.find((t) => t.id === taskId);
+  const task = tranche.tasks.find((t) => t.id === taskId2);
   if (!task) {
-    fail(`dispatch-gate row-existence: task "${taskId}" is not present in tranche "${trancheSlug}"'s forge-derived task list.`, "Confirm the branch name matches a real, forge-registered task id, or wait for the Planner to open the task Issue before re-running.");
+    fail(`dispatch-gate row-existence: task "${taskId2}" is not present in tranche "${trancheSlug}"'s forge-derived task list.`, "Confirm the branch name matches a real, forge-registered task id, or wait for the Planner to open the task Issue before re-running.");
   }
   const taskRefs = tranche.tasks.map((t) => ({ id: t.id, issue: t.issue }));
   const snapshot = await fetchForgeFacts({
@@ -6381,13 +7546,13 @@ async function main() {
   const result = checkDispatchReadiness(input);
   let ready = true;
   if (!result.ready) {
-    for (const blocker of result.blockers) {
+    for (const detail of result.blockerDetails) {
       emitCheckError({
         schema: CHECK_SCHEMA_VERSION,
         check: CHECK_NAME,
         severity: "error",
-        message: blocker,
-        agent_recovery_prompt: recoveryPromptFor(blocker)
+        message: detail.message,
+        agent_recovery_prompt: recoveryPromptFor(detail.class)
       });
     }
     ready = false;
@@ -6396,29 +7561,28 @@ async function main() {
     ready = false;
   process.exit(ready ? 0 : 1);
 }
-function recoveryPromptFor(blocker) {
-  if (blocker.startsWith("dispatch-gate INTERNAL:")) {
-    return "This is an INTERNAL parser-bug report, not a real dispatch gate — a task cannot depend on itself, so there is nothing here to wait for or resolve. Do NOT work around it and do NOT skip the hook. Report it upstream, and re-run once the rationale text is corrected or the parser fix ships.";
-  }
-  if (blocker.startsWith("dispatch-gate issue-existence:")) {
-    return "This task has no resolvable Issue yet. Wait for the Planner to cut the Issue (or fix the phantom reference in the topology), then re-run `vinaya check dispatch-readiness`.";
-  }
-  if (blocker.startsWith("dispatch-gate rationale:")) {
-    return "The task's Issue fails the rationale gate. Ask the Planner to complete the eight-field rationale on the Issue body, then re-run `vinaya check dispatch-readiness`.";
-  }
-  if (blocker.startsWith("dispatch-gate depends-on:") && blocker.includes("UNRESOLVABLE")) {
-    return "A declared dependency edge could not be resolved to any tranche/task/Issue — check the tranche slug and task id in the edge text, then re-run `vinaya check dispatch-readiness`.";
-  }
-  if (blocker.startsWith("dispatch-gate depends-on:")) {
-    return "A declared dependency is not merged yet. Do not start this task — wait for the named dependency PR to merge, then re-run `vinaya check dispatch-readiness`.";
-  }
-  if (blocker.startsWith("dispatch-gate conflicts-with:")) {
-    return "A declared conflicting task has an open or in-flight PR. Wait for it to merge before continuing, then re-run `vinaya check dispatch-readiness`.";
-  }
-  if (blocker.startsWith("dispatch-gate prior-tranche-archival:")) {
-    return "This project's previous tranche is not archived. Ask the Tranche Archivist to run first, then re-run `vinaya check dispatch-readiness`.";
-  }
-  return "Resolve the named dispatch blocker before continuing work on this task, then re-run `vinaya check dispatch-readiness`.";
+function recoveryPromptFor(blockerClass) {
+  switch (blockerClass) {
+    case "internal-self-dependency":
+      return "This is an INTERNAL parser-bug report, not a real dispatch gate — a task cannot depend on itself, so there is nothing here to wait for or resolve. Do NOT work around it and do NOT skip the hook. Report it upstream, and re-run once the rationale text is corrected or the parser fix ships.";
+    case "issue-existence":
+      return "This task has no resolvable Issue yet. Wait for the Planner to cut the Issue (or fix the phantom reference in the topology), then re-run `vinaya check dispatch-readiness`.";
+    case "rationale":
+      return "The task's Issue fails the rationale gate. Ask the Planner to complete the eight-field rationale on the Issue body, then re-run `vinaya check dispatch-readiness`.";
+    case "depends-on-unresolvable":
+      return "A declared dependency edge could not be resolved to any tranche/task/Issue — check the tranche slug and task id in the edge text, then re-run `vinaya check dispatch-readiness`.";
+    case "depends-on-not-merged":
+      return "A declared dependency is not merged yet. Do not start this task — wait for the named dependency PR to merge, then re-run `vinaya check dispatch-readiness`.";
+    case "conflicts-with":
+      return "A declared conflicting task has an open or in-flight PR. Wait for it to merge before continuing, then re-run `vinaya check dispatch-readiness`.";
+    case "prior-tranche-archival":
+      return "This project's previous tranche is not archived. Ask the Tranche Archivist to run first, then re-run `vinaya check dispatch-readiness`.";
+    default:
+      return assertNeverBlockerClass(blockerClass);
+  }
+}
+function assertNeverBlockerClass(x) {
+  throw new Error(`Unhandled DispatchBlockerClass: ${JSON.stringify(x)}`);
 }
 if (__require.main == __require.module) {
   main();