@attalabs/vinaya 0.27.0 → 0.29.0

package/dist/checks/bin/check-review-gate.js

@@ -1644,6 +1644,52 @@ var systemEnv3 = {
   ...process.env,
   PATH: [process.env.PATH, "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].filter(Boolean).join(":")
 };
+var defaultExec = () => execFileAsync3("git", ["remote", "get-url", "origin"], { env: systemEnv3, timeout: 5000 });
+var cached;
+var inflight;
+async function resolveRepo(exec = defaultExec) {
+  if (cached !== undefined)
+    return cached;
+  const fromEnv = process.env.AEG_REPO;
+  if (fromEnv) {
+    const parsed = parseOwnerRepo(fromEnv);
+    if (parsed) {
+      cached = parsed;
+      return cached;
+    }
+  }
+  if (inflight)
+    return inflight;
+  inflight = (async () => {
+    try {
+      const { stdout } = await exec();
+      cached = parseGitRemoteUrl(stdout.trim());
+      return cached;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      console.warn(`[aeg-forge-state] resolveRepo: git remote lookup failed (will retry): ${message}`);
+      return null;
+    } finally {
+      inflight = undefined;
+    }
+  })();
+  return inflight;
+}
+function parseGitRemoteUrl(url) {
+  const ssh = url.match(/^git@github\.com:([^/]+)\/(.+?)(?:\.git)?$/);
+  if (ssh?.[1] && ssh[2])
+    return { owner: ssh[1], repo: ssh[2] };
+  const https = url.match(/^https?:\/\/(?:[^@]+@)?github\.com\/([^/]+)\/(.+?)(?:\.git)?\/?$/);
+  if (https?.[1] && https[2])
+    return { owner: https[1], repo: https[2] };
+  return null;
+}
+function parseOwnerRepo(value) {
+  const match = value.match(/^([^/]+)\/(.+)$/);
+  if (!match?.[1] || !match[2])
+    return null;
+  return { owner: match[1], repo: match[2] };
+}
 // ../../packages/aeg-core/src/anchored-region.ts
 function anchoredRegionBounds(body, field) {
   const masked = maskCode(body);
@@ -1954,6 +2000,9 @@ function parseInlineFieldList(section) {
 var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
 var OBJECTIVES_VERSION_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Objectives version:\s*([0-9a-f]{64})(?![A-Za-z0-9])/im;
 var RULING_ORDINAL_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Ruling ordinal:\s*(\d+)(?!\d)/im;
+var BRIEF_HASH_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Brief hash:\s*([0-9a-f]{64})(?![A-Za-z0-9])/im;
+var POLICY_DIGEST_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Policy digest:\s*([0-9a-f]{64})(?![A-Za-z0-9])/im;
+var BASE_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged base:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
 function firstFiveLines(comment) {
   return comment.split(`
 `).slice(0, 5).join(`
@@ -1976,6 +2025,35 @@ function extractRulingOrdinal(comment) {
   const m = firstSevenLines(comment).match(RULING_ORDINAL_PATTERN);
   return m ? Number.parseInt(m[1], 10) : null;
 }
+function firstElevenLines(comment) {
+  return comment.split(`
+`).slice(0, 11).join(`
+`);
+}
+function extractBriefHash(comment) {
+  const m = firstElevenLines(comment).match(BRIEF_HASH_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
+function extractPolicyDigest(comment) {
+  const m = firstElevenLines(comment).match(POLICY_DIGEST_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
+function firstThirteenLines(comment) {
+  return comment.split(`
+`).slice(0, 13).join(`
+`);
+}
+function extractBaseSha(comment) {
+  const m = firstThirteenLines(comment).match(BASE_SHA_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
+var FINDING_SEVERITY_LINE = /^\d+\.\s+\[([A-Z][A-Z]*)\]\s+(.+?)\s+—/gm;
+function extractFindingSeverities(comment) {
+  return [...comment.matchAll(FINDING_SEVERITY_LINE)].map((m) => ({
+    severity: m[1],
+    location: m[2]
+  }));
+}
 function extractVerdict(comments, valuePattern, missingLabel) {
   const candidates = comments.filter((c) => valuePattern.test(c));
   if (candidates.length === 0) {
@@ -1984,6 +2062,10 @@ function extractVerdict(comments, valuePattern, missingLabel) {
       headSha: null,
       objectivesVersion: null,
       rulingOrdinal: null,
+      briefHash: null,
+      policyDigest: null,
+      baseSha: null,
+      findingSeverities: [],
       danglingNote: `no ${missingLabel} verdict comment found on this PR`
     };
   }
@@ -1995,6 +2077,10 @@ function extractVerdict(comments, valuePattern, missingLabel) {
       headSha: null,
       objectivesVersion: null,
       rulingOrdinal: null,
+      briefHash: null,
+      policyDigest: null,
+      baseSha: null,
+      findingSeverities: [],
       danglingNote: `the most recent ${missingLabel} verdict comment carries a VERDICT-shaped line outside the first-five-line read window`
     };
   }
@@ -2003,6 +2089,10 @@ function extractVerdict(comments, valuePattern, missingLabel) {
     headSha: extractHeadSha(latest),
     objectivesVersion: extractObjectivesVersion(latest),
     rulingOrdinal: extractRulingOrdinal(latest),
+    briefHash: extractBriefHash(latest),
+    policyDigest: extractPolicyDigest(latest),
+    baseSha: extractBaseSha(latest),
+    findingSeverities: extractFindingSeverities(latest),
     danglingNote: null
   };
 }
@@ -2338,6 +2428,53 @@ function evaluateC5(changed, docOwnersContent, prBody, fileExists, waiverActive,
   }
   return out;
 }
+// ../../packages/aeg-core/src/review-policy.ts
+var CODE_REVIEW_SEVERITY_ORDER = ["BLOCKER", "MAJOR", "MINOR"];
+var SECURITY_SEVERITY_ORDER = ["CRITICAL", "HIGH", "MEDIUM", "LOW"];
+var DEFAULT_MAX_ROUNDS = 3;
+var DEFAULT_REVIEW_POLICY = {
+  codeReviewThreshold: "BLOCKER",
+  securityThreshold: "HIGH",
+  maxRounds: DEFAULT_MAX_ROUNDS
+};
+var FILE_SHAPED_LOCATION = /\.[a-zA-Z0-9]{1,10}(:\d+)?\s*$/;
+var PROSE_LOCATION_PATTERNS = [/\bpr\s*body\b/i, /\bcomment\b/i];
+var ROLE_FILE_LOCATION = /(^|\/)aeg-root\/roles\//i;
+function isProseLocation(location) {
+  if (ROLE_FILE_LOCATION.test(location))
+    return true;
+  if (FILE_SHAPED_LOCATION.test(location))
+    return false;
+  return PROSE_LOCATION_PATTERNS.some((pattern) => pattern.test(location));
+}
+var PROSE_CAP_SEVERITY = "MINOR";
+function blockingSeverities(scale, threshold) {
+  const idx = scale.indexOf(threshold);
+  if (idx === -1) {
+    throw new Error(`blockingSeverities: threshold "${threshold}" is not one of ${scale.join(" > ")}`);
+  }
+  return scale.slice(0, idx + 1);
+}
+function evaluateReviewFindings(findings, scale, threshold) {
+  const blocking = new Set(blockingSeverities(scale, threshold));
+  const blockingFindings = findings.filter((f) => {
+    if (!scale.includes(f.severity)) {
+      throw new Error(`evaluateReviewFindings: severity "${f.severity}" is not one of ${scale.join(" > ")}`);
+    }
+    const effectiveSeverity = f.location !== undefined && isProseLocation(f.location) ? PROSE_CAP_SEVERITY : f.severity;
+    return blocking.has(effectiveSeverity);
+  });
+  return { outcome: blockingFindings.length > 0 ? "blocked" : "clean", blockingFindings };
+}
+function evaluateCodeReview(findings, policy) {
+  return evaluateReviewFindings(findings, CODE_REVIEW_SEVERITY_ORDER, policy.codeReviewThreshold);
+}
+function evaluateSecurityReview(findings, policy) {
+  return evaluateReviewFindings(findings, SECURITY_SEVERITY_ORDER, policy.securityThreshold);
+}
+function isKnownSeverity(scale, value) {
+  return scale.includes(value);
+}
 // ../../packages/aeg-core/src/pr-tier.ts
 var TIER_FIELD = /(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i;
 function readTierFromPrBody(prBody) {
@@ -2708,7 +2845,7 @@ function checkForField(prBody) {
     ]
   };
 }
-function checkClosesN(prBody) {
+function checkClosesNPresence(prBody) {
   const closesPattern = /(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s{0,8}:?\s{0,8}#\d+/i;
   if (closesPattern.test(stripCode(prBody))) {
     return { status: "pass", errors: [] };
@@ -2740,10 +2877,22 @@ var COMMIT_TYPES = [
   "Test"
 ];
 var COMMIT_TYPE_STYLE = new RegExp(`^(${COMMIT_TYPES.join("|")})(\\([a-z0-9-]+\\))?: \\S`);
+function checkForgeTitle(title) {
+  const taskStyle = /^\[[a-z0-9._-]+\] \S+ — \S/;
+  if (COMMIT_TYPE_STYLE.test(title) || taskStyle.test(title))
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      `brief-validation title: "${title}" matches neither title grammar — expected \`Type: description\` / \`Type(scope): description\` (commitlint types + Plan) or \`[tranche] id — description\` (task form).`
+    ]
+  };
+}
 var BRIEF_SHAPE_MARKERS = [checkSurfaceMap, checkDocUpdateList, checkStopConditions, checkAutonomyClause];
 var TASK_BRANCH_PATTERN = /^task\/[^/]+\/[^/]+$/;
+var TASK_ISSUE_BRANCH_PATTERN = /^task\/issue-\d+$/;
 function isTaskBranch(branch) {
-  return TASK_BRANCH_PATTERN.test(branch);
+  return TASK_BRANCH_PATTERN.test(branch) || TASK_ISSUE_BRANCH_PATTERN.test(branch);
 }
 function isBriefShaped(prBody) {
   const stripped = stripCode(prBody);
@@ -2865,8 +3014,9 @@ function packagesNamedIn(text) {
 }
 function hasTestPathForConsumer(text, consumerDir) {
   const escaped = consumerDir.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const re = new RegExp(`${escaped}\\/[\\w./-]*\\.test\\.[A-Za-z0-9]+`);
-  return re.test(text);
+  const filePathRe = new RegExp(`${escaped}\\/[\\w./-]*\\.test\\.[A-Za-z0-9]+`);
+  const testDirRe = new RegExp(`${escaped}\\/(?:[\\w-]+\\/)*(?:tests|specs)(?:\\/|\\b)`);
+  return filePathRe.test(text) || testDirRe.test(text);
 }
 function checkConsumerTests(prBody, consumersOf) {
   const section4 = extractNumberedSection(prBody, 4);
@@ -2970,7 +3120,7 @@ function checkBriefSections(prBody, readTier, options = {}) {
     checkConsumerTests(prBody, consumersOf),
     checkDefeatCases(prBody),
     ...issueObjectives !== undefined ? [checkObjectivesCopy(prBody, issueObjectives), checkObjectivesCoverage(prBody)] : [],
-    ...requireClosesN ? [checkClosesN(prBody)] : []
+    ...requireClosesN ? [checkClosesNPresence(prBody)] : []
   ];
   return { errors: results.flatMap((r) => r.errors) };
 }
@@ -3260,6 +3410,28 @@ function topLevelSectionText(body, headingName) {
   const next = /^##[ \t]/m.exec(afterHeading);
   return next ? afterHeading.slice(0, next.index) : afterHeading;
 }
+function partHasBacktickedPath(text) {
+  let i = 0;
+  while (i < text.length) {
+    const start = text.indexOf("`", i);
+    if (start === -1)
+      return false;
+    const end = text.indexOf("`", start + 1);
+    if (end === -1)
+      return false;
+    if (text.slice(start + 1, end).includes("/"))
+      return true;
+    i = end + 1;
+  }
+  return false;
+}
+var PART_MIN_WORDS_OUTSIDE_BACKTICKS = 3;
+function stripPartBackticks(text) {
+  return text.replace(/`[^`\n]*`/g, " ");
+}
+function partWordCount(text) {
+  return text.split(/\s+/).filter((w) => /[a-z]/i.test(w)).length;
+}
 function looksLikeFilePath(entry2) {
   const stripped = entry2.replace(/\/\*\*?$/, "");
   const lastSegment = stripped.split("/").pop() ?? stripped;
@@ -3300,6 +3472,18 @@ function globCoversPath(glob, path) {
   const p = path.replace(/\/+$/, "");
   return g === p || g.startsWith(`${p}/`) || p.startsWith(`${g}/`);
 }
+function checkSurfaceGlobsResolve(body, resolvesToFile) {
+  const surface = parseIssueSurface(body);
+  if (!surface.ok)
+    return { status: "pass", errors: [] };
+  const errors = [];
+  for (const glob of surface.value.in) {
+    if (!resolvesToFile(glob)) {
+      errors.push(`issue-validation Surface: \`${glob}\` in \`## Surface\`'s \`in:\` list matches no tracked file — a Surface that cannot resolve cannot render a brief's file list.`);
+    }
+  }
+  return { status: errors.length > 0 ? "fail" : "pass", errors };
+}
 function checkSurfaceScope(changedFiles, outGlobs) {
   if (outGlobs.length === 0)
     return { ok: true };
@@ -3311,9 +3495,77 @@ function checkSurfaceScope(changedFiles, outGlobs) {
   }
   return violations.length > 0 ? { ok: false, violations } : { ok: true };
 }
+var ISSUE_PART_LINE_RE = /^Part\s+(\d+)\s*\(([^)]*)\)\s*[-—–]\s*(.*)$/i;
+function parseIssueParts(body) {
+  const section = topLevelSectionText(body, "Parts");
+  if (section === null)
+    return { ok: false, errors: ["no `## Parts` heading found in the body."] };
+  const lines = section.split(/\r?\n/).map((l) => l.trim()).filter((l) => l.length > 0);
+  const parts = [];
+  const errors = [];
+  for (const line of lines) {
+    const m = ISSUE_PART_LINE_RE.exec(line);
+    if (!m) {
+      errors.push(`"${line}" is not a well-formed Parts line — expected \`Part <n> (<refs>) — <outcome>\`.`);
+      continue;
+    }
+    const n = Number.parseInt(m[1], 10);
+    const refs = m[2];
+    const text = m[3].trim();
+    if (text.length === 0) {
+      errors.push(`Part ${n} has no outcome text after the dash — every Part states one observable outcome.`);
+      continue;
+    }
+    if (partHasBacktickedPath(text) && partWordCount(stripPartBackticks(text)) < PART_MIN_WORDS_OUTSIDE_BACKTICKS) {
+      errors.push(`Part ${n} is little more than a file path — a Part names an outcome and symbols, never a bare path.`);
+      continue;
+    }
+    const objectiveIds = [...refs.matchAll(/O(\d+)/g)].map((r) => Number.parseInt(r[1], 10));
+    parts.push({ n, objectiveIds, text });
+  }
+  if (parts.length === 0) {
+    errors.push("the `## Parts` section has no well-formed `Part <n> (<refs>) — <outcome>` lines.");
+  }
+  if (errors.length > 0)
+    return { ok: false, errors };
+  return { ok: true, value: parts };
+}
+function checkPartsCiteDefinedObjectives(body) {
+  const parts = parseIssueParts(body);
+  const objectives = objectivesOf(body);
+  if (!parts.ok || !objectives.ok)
+    return { status: "pass", errors: [] };
+  const definedIds = new Set(objectives.objectives.map((o) => Number.parseInt(o.id.slice(1), 10)));
+  const errors = [];
+  for (const part of parts.value) {
+    for (const objectiveId of part.objectiveIds) {
+      if (!definedIds.has(objectiveId)) {
+        errors.push(`issue-validation Parts: Part ${part.n} cites O${objectiveId}, which the Issue's own \`## Objectives\` section does not define.`);
+      }
+    }
+  }
+  return { status: errors.length > 0 ? "fail" : "pass", errors };
+}
 function isTaskIssueLabelSet(labels) {
   return hasLabel("tranche", labels);
 }
+function checkTrancheLabelPresence(_body, _labels) {
+  return { status: "pass", errors: [] };
+}
+function checkMilestoneAttach(labels, currentMilestoneTitle, resolvedMilestoneTitle) {
+  if (!isTaskIssueLabelSet(labels))
+    return { status: "pass", errors: [] };
+  if (resolvedMilestoneTitle === null)
+    return { status: "pass", errors: [] };
+  if (currentMilestoneTitle === resolvedMilestoneTitle)
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      `issue-validation milestone attach: this task Issue's tranche label resolves to Milestone "${resolvedMilestoneTitle}", but its live Milestone is ${currentMilestoneTitle === null ? "unset" : `"${currentMilestoneTitle}"`} — attach it to "${resolvedMilestoneTitle}".`
+    ]
+  };
+}
 var TYPE_LABEL_IDS = LABELS.filter((l) => l.category === "type").map((l) => l.id);
 function isControlCodePoint(codePoint) {
   return codePoint <= 31 || codePoint >= 127 && codePoint <= 159;
@@ -3378,6 +3630,19 @@ function checkProjectsRegistered(body, _labels, registeredNames) {
 var DOC_PATH_RE = /(?:(?:aeg-root|apps|packages|specs|docs|tools|\.claude|\.github)\/[\w./@-]*\.(?:md|mdx)|\.claude\/(?:skills|rules)\/[\w./-]+|\b(?:docs-index|decisions|projects|state-machine|enforcement|process|README|CLAUDE)\.md\b|\b[\w-]+-(?:spec|decisions|backlog)\.md\b)/i;
 var DOC_PATH_RE_GLOBAL = new RegExp(DOC_PATH_RE.source, "gi");
 
+// ../../packages/aeg-core/src/task-branch-identity.ts
+var ISSUE_BRANCH_PATTERN = /^task\/issue-(\d+)$/;
+var TRANCHE_BRANCH_PATTERN = /^task\/([^/]+)\/([^/]+)$/;
+function parseTaskBranchIdentity(branch) {
+  const issueMatch = ISSUE_BRANCH_PATTERN.exec(branch);
+  if (issueMatch)
+    return { kind: "issue", issueNumber: Number(issueMatch[1]) };
+  const trancheMatch = TRANCHE_BRANCH_PATTERN.exec(branch);
+  if (trancheMatch)
+    return { kind: "tranche", tranche: trancheMatch[1], taskId: trancheMatch[2] };
+  return null;
+}
+
 // ../../packages/aeg-core/src/coherence-checks.ts
 var COHERENCE_ENFORCED_FROM = "2026-07-01";
 function isGrandfathered(isoDate) {
@@ -3398,6 +3663,7 @@ function checkA1(entries, principalAllowlist = PRINCIPAL_ALLOWLIST) {
       if (handClosed)
         continue;
       failures.push({
+        code: "closed-without-merge",
         issue: e.task.issue,
         tranche: e.trancheSlug,
         task: e.task.id,
@@ -3422,6 +3688,7 @@ function checkA3(entries) {
       continue;
     if (e.facts.prState === "merged" && e.facts.issueState !== "closed") {
       failures.push({
+        code: "auto-close-misfire",
         issue: e.task.issue,
         tranche: e.trancheSlug,
         task: e.task.id,
@@ -3446,6 +3713,7 @@ function checkT1(entries) {
       continue;
     if (e.facts === undefined) {
       failures.push({
+        code: "phantom-issue-ref",
         issue: e.task.issue,
         tranche: e.trancheSlug,
         task: e.task.id,
@@ -3464,6 +3732,7 @@ function checkT2(openIssuesBySlug, topologyIssuesBySlug, ciTrancheSlug) {
     for (const num of openNums) {
       if (!topologySet.has(num)) {
         failures.push({
+          code: "orphan-task",
           issue: num,
           tranche: slug,
           reason: `Issue #${num} is open and labeled ${trancheLabel(slug)} but does not appear in the topology file`
@@ -3498,6 +3767,7 @@ function checkT3(entries, ciTrancheSlug, enrichedEntries, forgeUnavailableSlugs)
         continue;
       if (forgeUnavailableSlugs?.has(e.trancheSlug)) {
         failures.push({
+          code: "tbd-in-active-tranche",
           issue: null,
           tranche: e.trancheSlug,
           task: e.task.id,
@@ -3507,6 +3777,7 @@ function checkT3(entries, ciTrancheSlug, enrichedEntries, forgeUnavailableSlugs)
         continue;
       }
       failures.push({
+        code: "tbd-in-active-tranche",
         issue: null,
         tranche: e.trancheSlug,
         task: e.task.id,
@@ -3539,6 +3810,7 @@ function checkD1(entries, issueToEntry, taskToEntry) {
       const sameIssue = depEntry.task.issue !== null && e.task.issue !== null && depEntry.task.issue === e.task.issue;
       if (sameTask || sameIssue) {
         failures.push({
+          code: "d1-self-dependency",
           issue: e.task.issue,
           tranche: e.trancheSlug,
           task: e.task.id,
@@ -3550,6 +3822,7 @@ function checkD1(entries, issueToEntry, taskToEntry) {
       const depClosed = depFacts?.issueState === "closed";
       if (!depClosed) {
         failures.push({
+          code: "dispatched-on-unmet-deps",
           issue: e.task.issue,
           tranche: e.trancheSlug,
           task: e.task.id,
@@ -3575,11 +3848,13 @@ function checkR1(issuesBySlug, grandfatheredIssues, registeredNames = []) {
       const errors = [
         ...checkIssueRationale(issue.body).errors,
         ...checkProjectsRegistered(issue.body, issue.labels, registeredNames).errors,
-        ...checkIssueObjectives(issue.body, issue.number).errors
+        ...checkIssueObjectives(issue.body, issue.number).errors,
+        ...checkPartsCiteDefinedObjectives(issue.body).errors
       ];
       if (errors.length === 0)
         continue;
       failures.push({
+        code: "missing-rationale-field",
         issue: issue.number,
         tranche: slug,
         reason: `Issue #${issue.number} fails the rationale gate: ${errors.join(" | ")}`,
@@ -3608,6 +3883,7 @@ function checkL1(files, entriesBySlug) {
     const allClosed = withFacts.every((e) => e.facts?.issueState === "closed");
     if (allClosed) {
       failures.push({
+        code: "archive-recommended",
         tranche: f.slug,
         reason: "Active tranche has no open task-Issues — consider archiving to completed/"
       });
@@ -3639,27 +3915,38 @@ function extractClosesReferences(prBody) {
   }
   return referenced;
 }
-function checkClosesN2(branch, prBody, trancheFiles, taskIssueRefs) {
+function checkClosesNTopology(branch, prBody, trancheFiles, taskIssueRefs) {
   const referenced = extractClosesReferences(prBody);
   if (taskIssueRefs) {
     for (const n of referenced) {
-      const ref = taskIssueRefs.get(n);
-      if (!ref)
+      const ref2 = taskIssueRefs.get(n);
+      if (!ref2)
         continue;
-      const expectedBranch = `task/${ref.trancheSlug}/${ref.taskId}`;
+      const expectedBranch = `task/${ref2.trancheSlug}/${ref2.taskId}`;
       if (branch !== expectedBranch) {
         return {
           ok: false,
-          message: `closes-n-reverse: branch "${branch}" closes #${n} (task ${ref.taskId} of tranche "${ref.trancheSlug}") but is not named "${expectedBranch}" — rename the branch and re-push, or if this work is intentionally outside AEG's dispatch flow, remove the Closes reference.`
+          message: `closes-n-reverse: branch "${branch}" closes #${n} (task ${ref2.taskId} of tranche "${ref2.trancheSlug}") but is not named "${expectedBranch}" — rename the branch and re-push, or if this work is intentionally outside AEG's dispatch flow, remove the Closes reference.`
         };
       }
     }
   }
-  const m = branch.match(/^task\/([^/]+)\/([^/]+)$/);
-  if (!m)
+  const ref = parseTaskBranchIdentity(branch);
+  if (!ref)
     return { ok: true };
-  const trancheSlug = m[1];
-  const taskId = m[2];
+  if (ref.kind === "issue") {
+    const expectedIssue2 = ref.issueNumber;
+    if (!referenced.has(expectedIssue2)) {
+      return {
+        ok: false,
+        expectedIssue: expectedIssue2,
+        message: `closes-n: PR body does not contain \`Closes #${expectedIssue2}\` (required for branch "${branch}"). Add it to the PR body Summary section.`
+      };
+    }
+    return { ok: true, expectedIssue: expectedIssue2 };
+  }
+  const trancheSlug = ref.tranche;
+  const taskId = ref.taskId;
   const trancheFile = trancheFiles.find((f) => f.slug === trancheSlug);
   if (!trancheFile) {
     return {
@@ -3711,34 +3998,79 @@ function extractIssue(body) {
   const issue = headerNums.length > 0 ? headerNums[0] : bodyNums[0];
   return { issue, extraIssues: bodyNums.filter((n) => n !== issue), outsideHeader: headerNums.length === 0 };
 }
-// ../../packages/aeg-core/src/review-gate.ts
-function isBoundToHead(extraction, headSha) {
-  if (!extraction.headSha)
+// ../../packages/aeg-core/src/review-input-manifest.ts
+import { createHash as createHash4 } from "node:crypto";
+function briefHash(brief) {
+  return createHash4("sha256").update(`${brief}
+`).digest("hex");
+}
+function policyDigest(policy) {
+  return createHash4("sha256").update(JSON.stringify({
+    codeReviewThreshold: policy.codeReviewThreshold,
+    securityThreshold: policy.securityThreshold,
+    maxRounds: policy.maxRounds
+  })).digest("hex");
+}
+function isBoundToHead(echoed, headSha) {
+  if (!echoed.headSha)
     return false;
-  return headSha.toLowerCase().startsWith(extraction.headSha.toLowerCase());
+  return headSha.toLowerCase().startsWith(echoed.headSha.toLowerCase());
 }
-function isBoundByPatchIdentity(extraction, headSha, patchIdOf) {
-  if (patchIdOf === undefined || !extraction.headSha)
+function isBoundByPatchIdentity(echoed, headSha, patchIdOf) {
+  if (patchIdOf === undefined || !echoed.headSha)
     return false;
-  const judged = patchIdOf(extraction.headSha);
+  const judged = patchIdOf(echoed.headSha);
   const current = patchIdOf(headSha);
   if (judged === null || current === null)
     return false;
   return judged === current;
 }
-function isBoundToPatch(extraction, headSha, patchIdOf) {
-  return isBoundToHead(extraction, headSha) || isBoundByPatchIdentity(extraction, headSha, patchIdOf);
+function isBoundToBase(echoed, currentBase) {
+  if (currentBase === null)
+    return true;
+  if (!echoed.baseSha)
+    return false;
+  return currentBase.toLowerCase().startsWith(echoed.baseSha.toLowerCase());
 }
-function isBoundToObjectives(extraction, currentVersion) {
+function isBoundToObjectives(echoed, currentVersion) {
   if (currentVersion === null)
     return true;
-  return extraction.objectivesVersion === currentVersion;
+  return echoed.objectivesVersion === currentVersion;
 }
-function isBoundToRulings(extraction, currentOrdinal) {
-  if (extraction.rulingOrdinal === null)
+function isBoundToRulings(echoed, currentOrdinal) {
+  if (echoed.rulingOrdinal === null)
     return currentOrdinal === 0;
-  return extraction.rulingOrdinal === currentOrdinal;
+  return echoed.rulingOrdinal === currentOrdinal;
 }
+function isBoundToBriefHash(echoed, currentHash) {
+  if (currentHash === null)
+    return true;
+  return echoed.briefHash === currentHash;
+}
+function isBoundToPolicy(echoed, currentDigest) {
+  return echoed.policyDigest === currentDigest;
+}
+function compareManifest(echoed, current, patchIdOf) {
+  const exactHead = isBoundToHead(echoed, current.headSha);
+  const patchHead = exactHead ? false : isBoundByPatchIdentity(echoed, current.headSha, patchIdOf);
+  const head = exactHead || patchHead;
+  const base = patchHead ? true : isBoundToBase(echoed, current.baseSha);
+  const briefHashBound = isBoundToBriefHash(echoed, current.briefHash);
+  const objectivesVersion2 = isBoundToObjectives(echoed, current.objectivesVersion);
+  const rulingOrdinal = isBoundToRulings(echoed, current.rulingOrdinal);
+  const policyDigestBound = isBoundToPolicy(echoed, current.policyDigest);
+  return {
+    bound: head && base && briefHashBound && objectivesVersion2 && rulingOrdinal && policyDigestBound,
+    head,
+    base,
+    briefHash: briefHashBound,
+    objectivesVersion: objectivesVersion2,
+    rulingOrdinal,
+    policyDigest: policyDigestBound
+  };
+}
+
+// ../../packages/aeg-core/src/review-gate.ts
 function checkReviewGate(input) {
   const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const waived = isWaiverLabelActorVerified({
@@ -3761,15 +4093,58 @@ function checkReviewGate(input) {
   const verifiedBodies = verified.map((c) => c.body);
   const codeReview = extractCodeReviewVerdict(verifiedBodies);
   const security = extractSecurityReviewVerdict(verifiedBodies);
-  const codeReviewClean = codeReview.value === "APPROVE";
-  const securityClean = security.value === "PASS";
-  const codeReviewBound = isBoundToPatch(codeReview, input.headSha, input.patchIdOf);
-  const securityBound = isBoundToPatch(security, input.headSha, input.patchIdOf);
-  const codeReviewObjectivesBound = isBoundToObjectives(codeReview, input.objectivesVersion);
-  const securityObjectivesBound = isBoundToObjectives(security, input.objectivesVersion);
-  const codeReviewRulingsBound = isBoundToRulings(codeReview, input.rulingOrdinal);
-  const securityRulingsBound = isBoundToRulings(security, input.rulingOrdinal);
-  if (codeReviewClean && codeReviewBound && codeReviewObjectivesBound && codeReviewRulingsBound && securityClean && securityBound && securityObjectivesBound && securityRulingsBound && mechanicalChecksClean) {
+  const policy = input.policy ?? DEFAULT_REVIEW_POLICY;
+  let codeReviewPolicyEvaluation;
+  let securityPolicyEvaluation;
+  try {
+    codeReviewPolicyEvaluation = evaluateCodeReview(codeReview.findingSeverities, policy);
+    securityPolicyEvaluation = evaluateSecurityReview(security.findingSeverities, policy);
+  } catch (err) {
+    return {
+      verdict: "fail",
+      reason: `a verdict comment carries a finding severity this repository's policy does not recognize: ${err instanceof Error ? err.message : String(err)}`,
+      waived: false
+    };
+  }
+  const codeReviewTextClean = codeReview.value === "APPROVE";
+  const securityTextClean = security.value === "PASS";
+  const codeReviewPolicyClean = codeReviewPolicyEvaluation.outcome === "clean";
+  const securityPolicyClean = securityPolicyEvaluation.outcome === "clean";
+  const codeReviewClean = codeReviewTextClean && codeReviewPolicyClean;
+  const securityClean = securityTextClean && securityPolicyClean;
+  const currentManifest = {
+    headSha: input.headSha,
+    baseSha: input.baseSha ?? null,
+    briefHash: input.briefHash ?? null,
+    objectivesVersion: input.objectivesVersion,
+    rulingOrdinal: input.rulingOrdinal,
+    policyDigest: policyDigest(policy)
+  };
+  const codeReviewEchoed = {
+    headSha: codeReview.headSha,
+    baseSha: codeReview.baseSha,
+    briefHash: codeReview.briefHash,
+    objectivesVersion: codeReview.objectivesVersion,
+    rulingOrdinal: codeReview.rulingOrdinal,
+    policyDigest: codeReview.policyDigest
+  };
+  const securityEchoed = {
+    headSha: security.headSha,
+    baseSha: security.baseSha,
+    briefHash: security.briefHash,
+    objectivesVersion: security.objectivesVersion,
+    rulingOrdinal: security.rulingOrdinal,
+    policyDigest: security.policyDigest
+  };
+  const codeReviewBinding = compareManifest(codeReviewEchoed, currentManifest, input.patchIdOf);
+  const securityBinding = compareManifest(securityEchoed, currentManifest, input.patchIdOf);
+  const codeReviewBound = codeReviewBinding.head;
+  const securityBound = securityBinding.head;
+  const codeReviewObjectivesBound = codeReviewBinding.objectivesVersion;
+  const securityObjectivesBound = securityBinding.objectivesVersion;
+  const codeReviewRulingsBound = codeReviewBinding.rulingOrdinal;
+  const securityRulingsBound = securityBinding.rulingOrdinal;
+  if (codeReviewClean && codeReviewBinding.bound && securityClean && securityBinding.bound && mechanicalChecksClean) {
     return {
       verdict: "pass",
       reason: `code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS, both covering head ${input.headSha}, and every reported mechanical check is green.`,
@@ -3777,23 +4152,39 @@ function checkReviewGate(input) {
     };
   }
   const problems = [];
-  if (!codeReviewClean) {
+  if (!codeReviewTextClean) {
     problems.push(`code-reviewer verdict is not a clean APPROVE (found: ${codeReview.value})`);
+  } else if (!codeReviewPolicyClean) {
+    problems.push(`code-reviewer verdict says APPROVE but carries a finding (${codeReviewPolicyEvaluation.blockingFindings.map((f) => f.severity).join(", ")}) at or above this repository's code-review policy threshold (${policy.codeReviewThreshold}) — a reviewer's own APPROVE never overrides policy`);
   } else if (!codeReviewBound) {
     problems.push(`the newest code-review verdict covers ${codeReview.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  } else if (!codeReviewBinding.base) {
+    problems.push(`the newest code-review verdict was cast against base ${codeReview.baseSha ?? "no recorded base"}, the PR's base is now ${currentManifest.baseSha ?? "unresolved"} (a base-only change under an unchanged candidate — same patch text on a new base is not automatically equivalent)`);
   } else if (!codeReviewObjectivesBound) {
     problems.push(`the newest code-review verdict was cast against objectives version ${codeReview.objectivesVersion ?? "none"}, the Issue's list is now ${input.objectivesVersion}`);
   } else if (!codeReviewRulingsBound) {
     problems.push(`the newest code-review verdict was cast against ruling ordinal ${codeReview.rulingOrdinal ?? "none"}, a newer ruling (ruling ${input.rulingOrdinal}) is now posted on this PR`);
+  } else if (!codeReviewBinding.briefHash) {
+    problems.push(`the newest code-review verdict was cast against brief hash ${codeReview.briefHash ?? "none"}, the frozen brief's current hash is ${currentManifest.briefHash ?? "none"}`);
+  } else if (!codeReviewBinding.policyDigest) {
+    problems.push(`the newest code-review verdict was cast against review policy digest ${codeReview.policyDigest ?? "none"}, this repository's current policy digest is ${currentManifest.policyDigest}`);
   }
-  if (!securityClean) {
+  if (!securityTextClean) {
     problems.push(`security-review verdict is not a clean PASS (found: ${security.value})`);
+  } else if (!securityPolicyClean) {
+    problems.push(`security-review verdict says PASS but carries a finding (${securityPolicyEvaluation.blockingFindings.map((f) => f.severity).join(", ")}) at or above this repository's security policy threshold (${policy.securityThreshold}) — a reviewer's own PASS never overrides policy`);
   } else if (!securityBound) {
     problems.push(`the newest security-review verdict covers ${security.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
+  } else if (!securityBinding.base) {
+    problems.push(`the newest security-review verdict was cast against base ${security.baseSha ?? "no recorded base"}, the PR's base is now ${currentManifest.baseSha ?? "unresolved"} (a base-only change under an unchanged candidate — same patch text on a new base is not automatically equivalent)`);
   } else if (!securityObjectivesBound) {
     problems.push(`the newest security-review verdict was cast against objectives version ${security.objectivesVersion ?? "none"}, the Issue's list is now ${input.objectivesVersion}`);
   } else if (!securityRulingsBound) {
     problems.push(`the newest security-review verdict was cast against ruling ordinal ${security.rulingOrdinal ?? "none"}, a newer ruling (ruling ${input.rulingOrdinal}) is now posted on this PR`);
+  } else if (!securityBinding.briefHash) {
+    problems.push(`the newest security-review verdict was cast against brief hash ${security.briefHash ?? "none"}, the frozen brief's current hash is ${currentManifest.briefHash ?? "none"}`);
+  } else if (!securityBinding.policyDigest) {
+    problems.push(`the newest security-review verdict was cast against review policy digest ${security.policyDigest ?? "none"}, this repository's current policy digest is ${currentManifest.policyDigest}`);
   }
   if (!mechanicalChecksClean) {
     problems.push(reportedMechanicalChecks.length === 0 ? "no mechanical checks have reported for this head yet" : `mechanical check(s) not green: ${reportedMechanicalChecks.filter((c) => c.bucket !== "pass").map((c) => `${c.name} (${c.bucket})`).join(", ")}`);
@@ -4485,42 +4876,45 @@ function checkDispatchReadiness(input) {
   const { trancheSlug, task } = input;
   const taskLabel = `task ${task.id} (tranche ${trancheSlug})`;
   const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
-  const blockers = [];
+  const blockerDetails = [];
+  const push = (blockerClass, message) => {
+    blockerDetails.push({ class: blockerClass, message });
+  };
   if (task.issue === null) {
-    blockers.push(`dispatch-gate issue-existence: ${taskLabel} has no Issue (#TBD or blank) in the topology — not dispatchable until the Planner cuts the Issue.`);
+    push("issue-existence", `dispatch-gate issue-existence: ${taskLabel} has no Issue (#TBD or blank) in the topology — not dispatchable until the Planner cuts the Issue.`);
   } else if (input.issue === null) {
-    blockers.push(`dispatch-gate issue-existence: ${taskLabel} names Issue #${task.issue}, but it does not resolve to a real GitHub Issue (phantom reference).`);
+    push("issue-existence", `dispatch-gate issue-existence: ${taskLabel} names Issue #${task.issue}, but it does not resolve to a real GitHub Issue (phantom reference).`);
   }
   if (input.issue !== null && !input.issueRationalePass) {
-    blockers.push(`dispatch-gate rationale: Issue #${input.issue.number} for ${taskLabel} fails the rationale gate (checkIssueRationale) — the Planner must complete the eight-field rationale before this task is dispatchable.`);
+    push("rationale", `dispatch-gate rationale: Issue #${input.issue.number} for ${taskLabel} fails the rationale gate (checkIssueRationale) — the Planner must complete the eight-field rationale before this task is dispatchable.`);
   }
   for (const dep of input.dependsOn) {
     if (isSelfDependency(dep, task, input.issue)) {
       const issueStr = input.issue !== null ? `#${input.issue.number}` : "?";
-      blockers.push(`dispatch-gate INTERNAL: parsed a self-dependency for task ${task.id} (${issueStr}) — this is a parser bug in parseRationaleDeps, not a real dependency. Please report it upstream. Re-run once the rationale is corrected or the fix ships.`);
+      push("internal-self-dependency", `dispatch-gate INTERNAL: parsed a self-dependency for task ${task.id} (${issueStr}) — this is a parser bug in parseRationaleDeps, not a real dependency. Please report it upstream. Re-run once the rationale is corrected or the fix ships.`);
       continue;
     }
     if (dep.resolved === false) {
-      blockers.push(`dispatch-gate depends-on: ${taskLabel} depends on "${dep.id}", which is UNRESOLVABLE — the resolver could not find a matching tranche/task/Issue for this edge (not a claim about merge status). Not dispatchable until the edge is corrected.`);
+      push("depends-on-unresolvable", `dispatch-gate depends-on: ${taskLabel} depends on "${dep.id}", which is UNRESOLVABLE — the resolver could not find a matching tranche/task/Issue for this edge (not a claim about merge status). Not dispatchable until the edge is corrected.`);
       continue;
     }
     if (!dep.merged && !isHandClosedByRecognizedPrincipal(dep, principalAllowlist)) {
       const issueStr = dep.issue !== null ? ` (#${dep.issue})` : "";
-      blockers.push(`dispatch-gate depends-on: ${taskLabel} depends on ${dep.id}${issueStr}, whose PR is not merged yet — not dispatchable, it serializes behind it.`);
+      push("depends-on-not-merged", `dispatch-gate depends-on: ${taskLabel} depends on ${dep.id}${issueStr}, whose PR is not merged yet — not dispatchable, it serializes behind it.`);
     }
   }
   for (const c of input.conflictsWith) {
     if (c.openOrInFlight) {
       const issueStr = c.issue !== null ? ` (#${c.issue})` : "";
-      blockers.push(`dispatch-gate conflicts-with: ${taskLabel} conflicts with ${c.id}${issueStr}, whose PR is open or in-flight — not dispatchable until it merges.`);
+      push("conflicts-with", `dispatch-gate conflicts-with: ${taskLabel} conflicts with ${c.id}${issueStr}, whose PR is open or in-flight — not dispatchable until it merges.`);
     }
   }
   for (const proj of input.priorTrancheArchival) {
     if (proj.priorTrancheSlug !== null && !proj.archived) {
-      blockers.push(`dispatch-gate prior-tranche-archival: project \`${proj.project}\`'s previous tranche \`${proj.priorTrancheSlug}\` is not archived — the Tranche Archivist must run before new work on this product.`);
+      push("prior-tranche-archival", `dispatch-gate prior-tranche-archival: project \`${proj.project}\`'s previous tranche \`${proj.priorTrancheSlug}\` is not archived — the Tranche Archivist must run before new work on this product.`);
     }
   }
-  return { ready: blockers.length === 0, blockers };
+  return { ready: blockerDetails.length === 0, blockers: blockerDetails.map((b) => b.message), blockerDetails };
 }
 // ../../packages/aeg-core/src/single-plan-pr.ts
 function trancheSlugFromTopologyPath(path) {
@@ -4622,6 +5016,137 @@ function checkBranchTopology(input) {
     reason: `Branch \`${branch}\` matches topology row \`${taskId}\` in ${topoPath}.`
   };
 }
+// ../../packages/aeg-core/src/task-tools.ts
+import { z } from "zod";
+var TASK_TOOL_ERROR_KINDS = [
+  "validation",
+  "authority",
+  "precondition",
+  "capability",
+  "infrastructure",
+  "cancellation",
+  "timeout",
+  "uncertain_effect"
+];
+var TaskToolErrorSchema = z.object({
+  kind: z.enum(TASK_TOOL_ERROR_KINDS),
+  message: z.string().min(1),
+  detail: z.string().optional()
+});
+var TaskToolRefSchema = z.union([
+  z.object({ tranche: z.string().min(1), id: z.string().min(1) }).strict(),
+  z.object({ issue: z.number().int().positive() }).strict()
+]);
+var MAX_PAGE_LIMIT = 100;
+var PageRequestSchema = z.object({
+  cursor: z.string().optional(),
+  limit: z.number().int().positive().max(MAX_PAGE_LIMIT).optional()
+});
+var FreshnessSchema = z.enum(["fresh", "stale", "unknown"]);
+var ObservedSchema = z.object({
+  observedAt: z.string(),
+  freshness: FreshnessSchema
+});
+var TaskStatusInputSchema = z.object({
+  task: TaskToolRefSchema.optional()
+}).merge(PageRequestSchema).strict();
+var TaskStatusItemSchema = z.object({
+  task: TaskToolRefSchema,
+  issue: z.number().int().positive(),
+  pr: z.number().int().positive().nullable(),
+  state: z.string()
+}).merge(ObservedSchema);
+var TaskStatusResultSchema = z.object({
+  items: z.array(TaskStatusItemSchema),
+  nextCursor: z.string().nullable()
+});
+var RequestedAuthoritySchema = z.enum(["planner", "principal", "operator", "self"]);
+var EscalationInputsSchema = z.object({
+  task: z.number().int().positive(),
+  round: z.number().int().nonnegative(),
+  head: z.string(),
+  branch: z.string(),
+  prNumber: z.number().int().positive()
+});
+var EscalationEvidenceSchema = z.object({
+  round: z.number().int().nonnegative(),
+  reviewer: z.string().nullable(),
+  security: z.string().nullable()
+});
+var EscalationRunIdentitySchema = z.object({
+  runId: z.string(),
+  pid: z.number().int().positive(),
+  host: z.string()
+});
+var EscalationInputVersionsSchema = z.object({
+  briefHash: z.string().nullable(),
+  objectivesVersion: z.string().nullable(),
+  rulingOrdinal: z.number().int().nonnegative(),
+  policyDigest: z.string()
+});
+var TaskEscalationReadInputSchema = z.object({
+  task: TaskToolRefSchema
+}).merge(PageRequestSchema).strict();
+var TaskEscalationPacketSchema = z.object({
+  reason: z.string(),
+  detail: z.string().nullable(),
+  inputs: EscalationInputsSchema.nullable(),
+  evidence: EscalationEvidenceSchema.nullable(),
+  attemptedRecovery: z.string(),
+  requestedAuthority: RequestedAuthoritySchema,
+  permittedNextActions: z.array(z.string()),
+  runIdentity: EscalationRunIdentitySchema.nullable(),
+  inputVersions: EscalationInputVersionsSchema.nullable()
+}).merge(ObservedSchema);
+var TaskEscalationReadResultSchema = z.object({
+  items: z.array(TaskEscalationPacketSchema),
+  nextCursor: z.string().nullable()
+}).merge(ObservedSchema);
+var TaskStartInputSchema = z.object({
+  tranche: z.string().min(1),
+  id: z.string().min(1)
+}).strict();
+var TaskStartResultSchema = z.object({
+  requestId: z.string().min(1),
+  run: z.object({ tranche: z.string().min(1), id: z.string().min(1) }),
+  started: z.boolean(),
+  startedAt: z.string(),
+  mode: z.literal("attended")
+});
+var TaskResumeInputSchema = z.object({
+  task: TaskToolRefSchema
+}).strict();
+var TaskCancelInputSchema = z.object({
+  task: TaskToolRefSchema,
+  reason: z.string().min(1)
+}).strict();
+var TaskResumeResultSchema = z.object({
+  task: z.number().int().positive(),
+  pr: z.number().int().positive(),
+  escalationId: z.string().min(1),
+  outcome: z.enum(["started", "already_resumed"]),
+  authenticatedBy: z.string().min(1),
+  authenticatedFrom: z.string().min(1)
+});
+var TaskCancelOutcomeSchema = z.enum(["confirmed", "pending", "uncertain"]);
+var TaskCancelResultSchema = z.object({
+  task: z.number().int().positive(),
+  pr: z.number().int().positive(),
+  escalationId: z.string().min(1),
+  outcome: TaskCancelOutcomeSchema,
+  authenticatedBy: z.string().min(1),
+  authenticatedFrom: z.string().min(1),
+  fencedEffectKeys: z.array(z.string())
+});
+var TASK_TOOL_NAMES = [
+  "task_start",
+  "task_status",
+  "task_escalation_read",
+  "task_resume",
+  "task_cancel"
+];
+var OPERATOR_STATUS_FOLLOW = "task_status_follow";
+var OPERATOR_TOOL_GRANT = [...TASK_TOOL_NAMES, OPERATOR_STATUS_FOLLOW];
 // ../../packages/aeg-core/src/first-push-dispatch-gate.ts
 function parseTaskBranch(branch) {
   const m = /^task\/([^/]+)\/([^/]+)$/.exec(branch);
@@ -4705,7 +5230,6 @@ function decideIssueAssignment(input) {
   };
 }
 // ../../packages/aeg-core/src/test-plan-gate.ts
-var TASK_BRANCH_PATTERN2 = /^task\/[^/]+\/[^/]+$/;
 function evaluateTestPlanGate(body, branch) {
   if (!body) {
     return {
@@ -4718,7 +5242,7 @@ function evaluateTestPlanGate(body, branch) {
   }
   const located = locateTestPlanSection(body);
   if (!located.found) {
-    if (TASK_BRANCH_PATTERN2.test(branch)) {
+    if (parseTaskBranchIdentity(branch) !== null) {
       return {
         verdict: "fail",
         messages: [
@@ -4845,8 +5369,11 @@ function findWorkspaceEscapes(files, knownPaths, workspaceDirs = DEFAULT_WORKSPA
   }
   return findings;
 }
+// ../../packages/aeg-core/src/log/envelope.ts
+import { createHash as createHash5 } from "node:crypto";
+
 // ../../packages/aeg-core/src/log/schema.ts
-import { z } from "zod";
+import { z as z2 } from "zod";
 var ROLE_VALUES = [
   "planner",
   "developer",
@@ -4856,136 +5383,174 @@ var ROLE_VALUES = [
   "archivist",
   "architect"
 ];
-var RoleSchema = z.enum(ROLE_VALUES);
+var RoleSchema = z2.enum(ROLE_VALUES);
 var HOST_VALUES = ["hook", "ci", "cli", "loop"];
-var HostSchema = z.enum(HOST_VALUES);
+var HostSchema = z2.enum(HOST_VALUES);
 var RUN_ID_PATTERN = /^[A-Za-z0-9_.-]{1,128}$/;
-var HeaderMetaSchema = z.object({
-  schema: z.literal(1),
-  ts: z.string(),
-  run_id: z.string().regex(RUN_ID_PATTERN),
-  seq: z.number().int().nonnegative(),
-  repo: z.string().nullable(),
-  vinaya: z.string(),
-  doctrine: z.string(),
+var headerMetaCore = {
+  ts: z2.string(),
+  run_id: z2.string().regex(RUN_ID_PATTERN),
+  seq: z2.number().int().nonnegative(),
+  repo: z2.string().nullable(),
+  vinaya: z2.string(),
+  doctrine: z2.string(),
   host: HostSchema,
-  machine: z.string()
+  machine: z2.string()
+};
+var HeaderMetaV1Schema = z2.object({
+  schema: z2.literal(1),
+  ...headerMetaCore
 }).strict();
-var SubjectSchema = z.object({
-  issue: z.number().int().nullable(),
-  pr: z.number().int().optional(),
-  sha: z.string().optional(),
-  role: z.union([RoleSchema, z.literal("unattributed")]),
-  round: z.number().int().optional(),
-  objectives_version: z.string().optional()
+var LineageSchema = z2.object({
+  run: z2.string().nullable(),
+  attempt: z2.number().int().nullable(),
+  parent: z2.string().nullable()
 }).strict();
-var HeaderSchema = z.object({
+var InputVersionsSchema = z2.object({
+  objectives_version: z2.string().nullable(),
+  brief_hash: z2.string().nullable(),
+  ruling_ordinal: z2.number().int().nullable(),
+  policy_digest: z2.string().nullable()
+}).strict();
+var ProvenanceSchema = z2.enum(["parent_attributed", "env_correlated", "self_reported", "unavailable"]);
+var HeaderMetaV2Schema = z2.object({
+  schema: z2.literal(2),
+  ...headerMetaCore,
+  event_id: z2.string().min(1),
+  process_id: z2.string().min(1),
+  actor_id: z2.string().nullable(),
+  lineage: LineageSchema,
+  input_versions: InputVersionsSchema,
+  provenance: ProvenanceSchema
+}).strict();
+var HeaderMetaSchema = z2.discriminatedUnion("schema", [HeaderMetaV1Schema, HeaderMetaV2Schema]);
+var SubjectSchema = z2.object({
+  issue: z2.number().int().nullable(),
+  pr: z2.number().int().optional(),
+  sha: z2.string().optional(),
+  role: z2.union([RoleSchema, z2.literal("unattributed")]),
+  round: z2.number().int().optional(),
+  objectives_version: z2.string().optional()
+}).strict();
+var HeaderSchema = z2.object({
   meta: HeaderMetaSchema,
   subject: SubjectSchema
 }).strict();
 var envelopeTail = {
-  duration_ms: z.number().nonnegative().optional(),
-  payload: z.object({}).strict()
+  duration_ms: z2.number().nonnegative().optional(),
+  payload: z2.object({}).strict()
 };
-var DispatchOutcomeSchema = z.discriminatedUnion("type", [
-  z.object({ type: z.literal("pr_opened"), pr: z.number().int(), head: z.string() }).strict(),
-  z.object({
-    type: z.literal("round_pushed"),
-    pr: z.number().int(),
-    head: z.string(),
-    comment_id: z.number().int()
+var ReviewFindingSchema = z2.object({
+  id: z2.string(),
+  severity: z2.string(),
+  state: z2.string().optional(),
+  severity_scale: z2.string().optional(),
+  policy_treatment: z2.enum(["blocking", "non_blocking", "unavailable"]).optional(),
+  confidence: z2.number().min(0).max(1).optional(),
+  confidence_scale: z2.string().optional(),
+  confidence_source: z2.string().optional()
+}).strict();
+var DispatchOutcomeSchema = z2.discriminatedUnion("type", [
+  z2.object({ type: z2.literal("pr_opened"), pr: z2.number().int(), head: z2.string() }).strict(),
+  z2.object({
+    type: z2.literal("round_pushed"),
+    pr: z2.number().int(),
+    head: z2.string(),
+    comment_id: z2.number().int()
   }).strict(),
-  z.object({
-    type: z.literal("verdict"),
-    verdict: z.enum(["APPROVE", "REQUEST CHANGES", "PASS", "FAIL"]),
-    head: z.string(),
-    comment_id: z.number().int(),
-    objectives: z.array(z.object({ id: z.string(), met: z.boolean() }).strict()),
-    findings: z.array(z.object({ id: z.string(), severity: z.string(), state: z.string().optional() }).strict())
+  z2.object({
+    type: z2.literal("verdict"),
+    verdict: z2.enum(["APPROVE", "REQUEST CHANGES", "PASS", "FAIL"]),
+    head: z2.string(),
+    comment_id: z2.number().int(),
+    objectives: z2.array(z2.object({ id: z2.string(), met: z2.boolean() }).strict()),
+    findings: z2.array(ReviewFindingSchema)
   }).strict(),
-  z.object({
-    type: z.literal("escalation"),
-    class: z.enum(["authority", "strategy", "product"]),
-    comment_id: z.number().int()
+  z2.object({
+    type: z2.literal("escalation"),
+    class: z2.enum(["authority", "strategy", "product"]),
+    comment_id: z2.number().int()
   }).strict(),
-  z.object({ type: z.literal("brief"), comment_id: z.number().int(), hash: z.string() }).strict(),
-  z.object({ type: z.literal("plan"), issues: z.array(z.number().int()) }).strict(),
-  z.object({ type: z.literal("archive"), provenance_comment_id: z.number().int() }).strict()
+  z2.object({ type: z2.literal("brief"), comment_id: z2.number().int(), hash: z2.string() }).strict(),
+  z2.object({ type: z2.literal("plan"), issues: z2.array(z2.number().int()) }).strict(),
+  z2.object({ type: z2.literal("archive"), provenance_comment_id: z2.number().int() }).strict(),
+  z2.object({ type: z2.literal("completed") }).strict()
 ]);
 var dispatchShared = {
   meta: HeaderMetaSchema,
   subject: SubjectSchema,
-  kind: z.literal("dispatch"),
+  kind: z2.literal("dispatch"),
   ...envelopeTail,
   target_role: RoleSchema,
-  model: z.string(),
-  round: z.number().int().optional(),
-  effect_id: z.string()
+  model: z2.string(),
+  round: z2.number().int().optional(),
+  effect_id: z2.string()
 };
-var dispatchUsageField = z.object({ input: z.number().nonnegative(), output: z.number().nonnegative() }).strict().nullable();
-var DispatchEventSchema = z.discriminatedUnion("event", [
-  z.object({ ...dispatchShared, event: z.literal("dispatched"), prompt_hash: z.string() }).strict(),
-  z.object({
+var dispatchUsageField = z2.object({ input: z2.number().nonnegative(), output: z2.number().nonnegative() }).strict().nullable();
+var DispatchEventSchema = z2.discriminatedUnion("event", [
+  z2.object({ ...dispatchShared, event: z2.literal("dispatched"), prompt_hash: z2.string() }).strict(),
+  z2.object({
     ...dispatchShared,
-    event: z.literal("outcome_received"),
+    event: z2.literal("outcome_received"),
     outcome: DispatchOutcomeSchema,
     usage: dispatchUsageField
   }).strict(),
-  z.object({
+  z2.object({
     ...dispatchShared,
-    event: z.literal("dispatch_failed"),
-    reason: z.enum(["timeout", "crash", "refused", "unattributed_write"]),
+    event: z2.literal("dispatch_failed"),
+    reason: z2.enum(["timeout", "crash", "refused", "unattributed_write"]),
     usage: dispatchUsageField
   }).strict()
 ]);
 var loopShared = {
   meta: HeaderMetaSchema,
   subject: SubjectSchema,
-  kind: z.literal("dev_review_loop"),
+  kind: z2.literal("dev_review_loop"),
   ...envelopeTail,
-  loop_id: z.string()
+  loop_id: z2.string()
 };
-var DevReviewLoopEventSchema = z.discriminatedUnion("event", [
-  z.object({
+var DevReviewLoopEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
     ...loopShared,
-    event: z.literal("loop_started"),
-    task: z.number().int(),
-    policy: z.object({
-      max_rounds: z.number().int().nonnegative(),
-      reviewers: z.array(RoleSchema),
-      models: z.record(RoleSchema, z.string())
+    event: z2.literal("loop_started"),
+    task: z2.number().int(),
+    policy: z2.object({
+      max_rounds: z2.number().int().nonnegative(),
+      reviewers: z2.array(RoleSchema),
+      models: z2.record(RoleSchema, z2.string())
     }).strict()
   }).strict(),
-  z.object({ ...loopShared, event: z.literal("round_started"), round: z.number().int(), base_head: z.string() }).strict(),
-  z.object({
+  z2.object({ ...loopShared, event: z2.literal("round_started"), round: z2.number().int(), base_head: z2.string() }).strict(),
+  z2.object({
     ...loopShared,
-    event: z.literal("gate_result_read"),
-    round: z.number().int(),
-    head: z.string(),
-    green: z.boolean()
+    event: z2.literal("gate_result_read"),
+    round: z2.number().int(),
+    head: z2.string(),
+    green: z2.boolean()
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("verdicts_read"),
-    round: z.number().int(),
-    head: z.string(),
-    all_approve: z.boolean(),
-    blockers: z.number().int().nonnegative()
+    event: z2.literal("verdicts_read"),
+    round: z2.number().int(),
+    head: z2.string(),
+    all_approve: z2.boolean(),
+    blockers: z2.number().int().nonnegative(),
+    findings: z2.array(ReviewFindingSchema).optional()
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("findings_compared"),
-    round: z.number().int(),
-    open: z.array(z.string()),
-    resolved: z.array(z.string()),
-    new: z.array(z.string()),
-    recurring: z.array(z.string())
+    event: z2.literal("findings_compared"),
+    round: z2.number().int(),
+    open: z2.array(z2.string()),
+    resolved: z2.array(z2.string()),
+    new: z2.array(z2.string()),
+    recurring: z2.array(z2.string())
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("stop_condition_met"),
-    round: z.number().int(),
-    condition: z.enum([
+    event: z2.literal("stop_condition_met"),
+    round: z2.number().int(),
+    condition: z2.enum([
       "green",
       "max_rounds",
       "no_progress",
@@ -4995,42 +5560,49 @@ var DevReviewLoopEventSchema = z.discriminatedUnion("event", [
       "reappearance"
     ])
   }).strict(),
-  z.object({
+  z2.object({
+    ...loopShared,
+    event: z2.literal("paused"),
+    round: z2.number().int(),
+    reason: z2.enum(["escalation", "principal_item", "refreeze_needed"])
+  }).strict(),
+  z2.object({
     ...loopShared,
-    event: z.literal("paused"),
-    round: z.number().int(),
-    reason: z.enum(["escalation", "principal_item", "refreeze_needed"])
+    event: z2.literal("resumed"),
+    round: z2.number().int(),
+    by: z2.literal("principal")
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("resumed"),
-    round: z.number().int(),
-    by: z.literal("principal")
+    event: z2.literal("unpushed_work_resume"),
+    round: z2.number().int(),
+    branch: z2.string(),
+    detail: z2.string()
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("round_ended"),
-    round: z.number().int(),
-    base_head: z.string(),
-    head: z.string(),
-    files_changed: z.number().int().nonnegative(),
-    insertions: z.number().int().nonnegative(),
-    deletions: z.number().int().nonnegative(),
-    wall_ms: z.number().nonnegative(),
-    outcome: z.enum(["green", "changes_requested", "escalated"])
+    event: z2.literal("round_ended"),
+    round: z2.number().int(),
+    base_head: z2.string(),
+    head: z2.string(),
+    files_changed: z2.number().int().nonnegative(),
+    insertions: z2.number().int().nonnegative(),
+    deletions: z2.number().int().nonnegative(),
+    wall_ms: z2.number().nonnegative(),
+    outcome: z2.enum(["green", "changes_requested", "escalated"])
   }).strict(),
-  z.object({
+  z2.object({
     ...loopShared,
-    event: z.literal("journal_finalized"),
-    rounds: z.number().int().nonnegative(),
-    total_wall_ms: z.number().nonnegative(),
-    time_to_green_ms: z.number().nonnegative().nullable(),
-    files_changed_total: z.number().int().nonnegative(),
-    final_head: z.string(),
-    result: z.enum(["merged_ready", "stopped"])
+    event: z2.literal("journal_finalized"),
+    rounds: z2.number().int().nonnegative(),
+    total_wall_ms: z2.number().nonnegative(),
+    time_to_green_ms: z2.number().nonnegative().nullable(),
+    files_changed_total: z2.number().int().nonnegative(),
+    final_head: z2.string(),
+    result: z2.enum(["merged_ready", "stopped"])
   }).strict()
 ]);
-var ForgeOpSchema = z.enum([
+var ForgeOpSchema = z2.enum([
   "pr.create",
   "pr.comment",
   "pr.body.replace",
@@ -5044,24 +5616,434 @@ var ForgeOpSchema = z.enum([
   "label.add",
   "label.remove"
 ]);
-var ForgeWriteTargetSchema = z.object({
-  issue: z.number().int().optional(),
-  pr: z.number().int().optional()
+var ForgeWriteTargetSchema = z2.object({
+  issue: z2.number().int().optional(),
+  pr: z2.number().int().optional()
 }).strict();
 var forgeWriteShared = {
   meta: HeaderMetaSchema,
   subject: SubjectSchema,
-  kind: z.literal("forge_write"),
+  kind: z2.literal("forge_write"),
   ...envelopeTail,
   op: ForgeOpSchema,
   target: ForgeWriteTargetSchema
 };
-var ForgeWriteEventSchema = z.discriminatedUnion("event", [
-  z.object({ ...forgeWriteShared, event: z.literal("validated") }).strict(),
-  z.object({ ...forgeWriteShared, event: z.literal("refused"), reason: z.string() }).strict(),
-  z.object({ ...forgeWriteShared, event: z.literal("written"), comment_ids: z.array(z.string()) }).strict()
+var ForgeWriteEventSchema = z2.discriminatedUnion("event", [
+  z2.object({ ...forgeWriteShared, event: z2.literal("validated") }).strict(),
+  z2.object({ ...forgeWriteShared, event: z2.literal("refused"), reason: z2.string() }).strict(),
+  z2.object({ ...forgeWriteShared, event: z2.literal("written"), comment_ids: z2.array(z2.string()) }).strict()
+]);
+var GateOutcomeSchema = z2.enum([
+  "pass",
+  "fail",
+  "wait",
+  "skip",
+  "invalid_input",
+  "unavailable_dependency",
+  "timeout",
+  "cancelled"
+]);
+var gateShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("gate"),
+  ...envelopeTail,
+  check: z2.string(),
+  check_version: z2.string().nullable(),
+  policy_version: z2.string().nullable(),
+  input_fingerprint: z2.string().nullable()
+};
+var GateEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...gateShared,
+    event: z2.literal("checked"),
+    outcome: GateOutcomeSchema,
+    reason: z2.string().optional()
+  }).strict()
+]);
+var OperationResultSchema = z2.enum(["ok", "error", "refused", "timeout", "cancelled", "unavailable"]);
+var operationShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("operation"),
+  ...envelopeTail,
+  operation: z2.string(),
+  target: z2.string().nullable()
+};
+var OperationEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...operationShared,
+    event: z2.literal("completed"),
+    result: OperationResultSchema,
+    error_class: z2.string().nullable()
+  }).strict()
+]);
+var UsageUnitsSchema = z2.object({
+  input: z2.number().nonnegative().nullable(),
+  output: z2.number().nonnegative().nullable(),
+  cache: z2.number().nonnegative().nullable()
+}).strict();
+var usageShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("usage"),
+  ...envelopeTail,
+  model: z2.string().nullable(),
+  source: z2.string(),
+  semantics: z2.enum(["cumulative", "delta"])
+};
+var UsageEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...usageShared,
+    event: z2.literal("observed"),
+    units: UsageUnitsSchema,
+    unknown_reason: z2.string().nullable()
+  }).strict()
+]);
+var RoleAttemptOutcomeSchema = z2.enum([
+  "completed",
+  "incomplete",
+  "infrastructure_failed",
+  "cancelled",
+  "timed_out",
+  "capability_refused"
+]);
+var roleAttemptShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("role_attempt"),
+  ...envelopeTail,
+  actor: z2.string().nullable(),
+  attempt: z2.number().int().nullable(),
+  effect_id: z2.string(),
+  model: z2.string().nullable()
+};
+var RoleAttemptEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...roleAttemptShared,
+    event: z2.literal("attempted"),
+    outcome: RoleAttemptOutcomeSchema,
+    usage: dispatchUsageField
+  }).strict()
+]);
+var handoffShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("handoff"),
+  ...envelopeTail,
+  class: z2.enum(["authority", "strategy", "product"]),
+  reason: z2.string()
+};
+var HandoffEventSchema = z2.discriminatedUnion("event", [
+  z2.object({
+    ...handoffShared,
+    event: z2.literal("raised"),
+    requested_decision: z2.string().nullable()
+  }).strict(),
+  z2.object({
+    ...handoffShared,
+    event: z2.literal("resolved"),
+    resolution: z2.string().nullable(),
+    resolved_by: z2.string().nullable()
+  }).strict()
+]);
+var EffectTargetSchema = z2.object({
+  kind: z2.string(),
+  ref: z2.string()
+}).strict();
+var effectShared = {
+  meta: HeaderMetaSchema,
+  subject: SubjectSchema,
+  kind: z2.literal("effect"),
+  ...envelopeTail,
+  effect_id: z2.string(),
+  target: EffectTargetSchema
+};
+var EffectEventSchema = z2.discriminatedUnion("event", [
+  z2.object({ ...effectShared, event: z2.literal("attempted") }).strict(),
+  z2.object({ ...effectShared, event: z2.literal("observed"), outcome: z2.enum(["success", "failure", "uncertain"]) }).strict(),
+  z2.object({ ...effectShared, event: z2.literal("verified"), outcome: z2.enum(["success", "failure", "uncertain"]) }).strict()
+]);
+var LogEventSchema = z2.union([
+  DispatchEventSchema,
+  DevReviewLoopEventSchema,
+  ForgeWriteEventSchema,
+  GateEventSchema,
+  OperationEventSchema,
+  UsageEventSchema,
+  RoleAttemptEventSchema,
+  HandoffEventSchema,
+  EffectEventSchema
 ]);
-var LogEventSchema = z.union([DispatchEventSchema, DevReviewLoopEventSchema, ForgeWriteEventSchema]);
+
+// ../../packages/aeg-core/src/log/envelope.ts
+function isRole(value) {
+  return value !== undefined && ROLE_VALUES.includes(value);
+}
+function actorIdFromEnv(role) {
+  return role === undefined || role === "" ? null : role;
+}
+function lineageFieldFromEnv(value) {
+  return value === undefined || value === "" ? null : value;
+}
+function attemptFromEnv(value) {
+  if (value === undefined || value === "")
+    return null;
+  const n = Number(value);
+  return Number.isInteger(n) ? n : null;
+}
+function provenanceFor(input) {
+  if (input.provenance)
+    return input.provenance;
+  if (input.env.role || input.env.task)
+    return "env_correlated";
+  return "unavailable";
+}
+function issueFromTask(task) {
+  if (task === undefined || task === "")
+    return null;
+  const n = Number(task);
+  return Number.isInteger(n) ? n : null;
+}
+function roundFromEnv(round) {
+  if (round === undefined || round === "")
+    return;
+  const n = Number(round);
+  return Number.isInteger(n) ? n : undefined;
+}
+function buildHeader(input) {
+  const role = isRole(input.env.role) ? input.env.role : "unattributed";
+  const round = roundFromEnv(input.env.round);
+  const subject = {
+    issue: issueFromTask(input.env.task),
+    role,
+    ...round !== undefined ? { round } : {},
+    ...input.subject ?? {}
+  };
+  return {
+    meta: {
+      schema: 2,
+      ts: input.now.toISOString(),
+      run_id: input.runId,
+      seq: input.seq,
+      repo: input.repo,
+      vinaya: input.vinaya,
+      doctrine: input.doctrine,
+      host: input.host,
+      machine: createHash5("sha256").update(input.hostname).digest("hex"),
+      event_id: input.eventId,
+      process_id: input.processId,
+      actor_id: actorIdFromEnv(input.env.role),
+      lineage: {
+        run: lineageFieldFromEnv(input.env.run),
+        attempt: attemptFromEnv(input.env.attempt),
+        parent: lineageFieldFromEnv(input.env.parent)
+      },
+      input_versions: {
+        objectives_version: input.inputVersions?.objectivesVersion ?? null,
+        brief_hash: input.inputVersions?.briefHash ?? null,
+        ruling_ordinal: input.inputVersions?.rulingOrdinal ?? null,
+        policy_digest: input.inputVersions?.policyDigest ?? null
+      },
+      provenance: provenanceFor(input)
+    },
+    subject
+  };
+}
+// ../../packages/aeg-core/src/log/redact.ts
+var GITHUB_TOKEN_PATTERN = /\b(?:gho_|ghp_|ghs_|ghu_|ghr_|github_pat_)[A-Za-z0-9_]+\b/g;
+var CLASSIC_GITHUB_PAT_PATTERN = /\b((?:token|GITHUB_TOKEN|PAT|api[_-]?key|api[_-]?token)\s*[:=]\s*)[a-f0-9]{40}\b/gi;
+var BEARER_TOKEN_PATTERN = /\bBearer\s+\S+/g;
+var AWS_ACCESS_KEY_PATTERN = /\bAKIA[0-9A-Z]{16}\b/g;
+var SLACK_TOKEN_PATTERN = /\bxox[baprs]-[0-9A-Za-z-]+\b/g;
+var STRIPE_KEY_PATTERN = /\b(?:sk|pk|rk)_(?:live|test)_[0-9A-Za-z]{10,}\b/g;
+var ANTHROPIC_KEY_PATTERN = /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g;
+var OPENAI_KEY_PATTERN = /\bsk-(?!ant-)[A-Za-z0-9]{20,}\b/g;
+var NPM_TOKEN_PATTERN = /\bnpm_[A-Za-z0-9]{36}\b/g;
+var JWT_PATTERN = /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g;
+var PEM_BLOCK_PATTERN = /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g;
+var BASIC_AUTH_URL_PATTERN = /(https?:\/\/)[^/\s:@]+:[^/\s@]+@/g;
+var GENERIC_SECRET_ASSIGNMENT_PATTERN = /\b((?:secret|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)\s*[:=]\s*)[A-Za-z0-9+/_=-]{16,}\b/gi;
+function redactString(value, home) {
+  let out = value.replace(GITHUB_TOKEN_PATTERN, "<redacted>").replace(CLASSIC_GITHUB_PAT_PATTERN, "$1<redacted>").replace(BEARER_TOKEN_PATTERN, "<redacted>").replace(AWS_ACCESS_KEY_PATTERN, "<redacted>").replace(SLACK_TOKEN_PATTERN, "<redacted>").replace(STRIPE_KEY_PATTERN, "<redacted>").replace(ANTHROPIC_KEY_PATTERN, "<redacted>").replace(OPENAI_KEY_PATTERN, "<redacted>").replace(NPM_TOKEN_PATTERN, "<redacted>").replace(JWT_PATTERN, "<redacted>").replace(PEM_BLOCK_PATTERN, "<redacted>").replace(BASIC_AUTH_URL_PATTERN, "$1<redacted>@").replace(GENERIC_SECRET_ASSIGNMENT_PATTERN, "$1<redacted>");
+  if (home.length > 0 && out.startsWith(home)) {
+    const rest = out.slice(home.length);
+    if (rest === "" || rest.startsWith("/"))
+      out = `~${rest}`;
+  }
+  return out;
+}
+function redact(value, home) {
+  if (typeof value === "string")
+    return redactString(value, home);
+  if (Array.isArray(value))
+    return value.map((v) => redact(v, home));
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = redact(v, home);
+    }
+    return out;
+  }
+  return value;
+}
+// ../../packages/aeg-core/src/log/store.ts
+function metaOf(obj) {
+  if (obj === null || typeof obj !== "object")
+    return null;
+  const meta = obj.meta;
+  if (meta === null || typeof meta !== "object")
+    return null;
+  return meta;
+}
+function recordIdentity(obj) {
+  const meta = metaOf(obj);
+  if (meta === null)
+    return null;
+  const eventId = meta.event_id;
+  if (typeof eventId === "string" && eventId.length > 0)
+    return eventId;
+  const runId = meta.run_id;
+  const seq = meta.seq;
+  if (typeof runId === "string" && runId.length > 0 && typeof seq === "number" && Number.isInteger(seq)) {
+    return `${runId}:${seq}`;
+  }
+  return null;
+}
+
+// ../../packages/aeg-core/src/log/artifact.ts
+var TASK_LOG_ARTIFACT_MAX_BYTES = 8 * 1024 * 1024;
+// ../../packages/aeg-core/src/dev-review-loop/journal-reconstruction.ts
+var STOPPED_CONDITIONS = new Set(["confidence", "reappearance", "no_progress", "max_rounds"]);
+// ../../packages/aeg-core/src/control-store/records.ts
+import { z as z3 } from "zod";
+var isoTimestamp = z3.string().min(1);
+var taskId = z3.number().int().positive();
+var epochNumber = z3.number().int().nonnegative();
+var RunRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("run"),
+  task: taskId,
+  runId: z3.string().min(1),
+  pid: z3.number().int().positive(),
+  host: z3.string().min(1),
+  startedAt: isoTimestamp,
+  childStartedAt: z3.string().min(1).nullable().optional(),
+  childCommand: z3.string().min(1).nullable().optional()
+}).strict();
+var InputRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("input"),
+  task: taskId,
+  runId: z3.string().min(1),
+  source: z3.union([z3.literal("fresh"), z3.literal("resume")]),
+  pr: z3.number().int().positive().nullable(),
+  round: z3.number().int().nonnegative(),
+  recordedAt: isoTimestamp
+}).strict();
+var OwnershipRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("ownership"),
+  task: taskId,
+  epoch: epochNumber,
+  ownerId: z3.string().min(1),
+  pid: z3.number().int().positive(),
+  host: z3.string().min(1),
+  acquiredAt: isoTimestamp
+}).strict();
+var TransitionRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("transition"),
+  task: taskId,
+  epoch: epochNumber,
+  seq: z3.number().int().nonnegative(),
+  from: z3.string().min(1),
+  to: z3.string().min(1),
+  detail: z3.string().optional(),
+  at: isoTimestamp
+}).strict();
+var ManifestRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("manifest"),
+  task: taskId,
+  round: epochNumber,
+  repository: z3.string().min(1),
+  pr: z3.number().int().positive(),
+  branch: z3.string().min(1),
+  baseSha: z3.string().min(1).nullable(),
+  headSha: z3.string().min(1),
+  briefHash: z3.string().min(1).nullable(),
+  objectivesVersion: z3.string().min(1).nullable(),
+  rulingOrdinal: epochNumber,
+  policyDigest: z3.string().min(1),
+  recordedAt: isoTimestamp
+}).strict();
+var roundHeadIdentity = z3.object({ round: z3.number().int().positive(), head: z3.string().min(1) }).strict();
+var LoopBudgetsSchema = z3.object({
+  mechanicalRetries: z3.number().int().nonnegative(),
+  reviewRounds: z3.number().int().nonnegative(),
+  infrastructureRetries: z3.number().int().nonnegative()
+}).strict();
+var LoopStateRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("loop_state"),
+  task: taskId,
+  round: z3.number().int().positive(),
+  phase: z3.string().min(1),
+  pauseReason: z3.string().min(1).nullable(),
+  budgets: LoopBudgetsSchema,
+  heldResult: roundHeadIdentity.nullable(),
+  deliveredFindings: roundHeadIdentity.nullable(),
+  recordedAt: isoTimestamp
+}).strict();
+var EffectRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("effect"),
+  task: taskId,
+  key: z3.string().min(1),
+  operation: z3.string().min(1),
+  target: z3.string().min(1),
+  inputVersion: z3.number().int().nonnegative(),
+  payloadDigest: z3.string().min(1),
+  status: z3.union([z3.literal("started"), z3.literal("verified"), z3.literal("uncertain")]),
+  url: z3.string().optional(),
+  recordedAt: isoTimestamp
+}).strict();
+var EscalationRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("escalation"),
+  task: taskId,
+  escalationId: z3.string().min(1),
+  round: epochNumber,
+  head: z3.string().min(1),
+  branch: z3.string().min(1),
+  pr: z3.number().int().positive().nullable(),
+  runId: z3.string().min(1),
+  pid: z3.number().int().positive(),
+  host: z3.string().min(1),
+  agent: z3.string().min(1).optional(),
+  reason: z3.string().min(1),
+  detail: z3.string().optional(),
+  evidence: z3.string().optional(),
+  attemptedRecovery: z3.string().min(1),
+  requestedDecision: z3.string().min(1),
+  recipient: z3.string().min(1),
+  briefHash: z3.string().min(1).nullable(),
+  objectivesVersion: z3.string().min(1).nullable(),
+  rulingOrdinal: epochNumber,
+  policyDigest: z3.string().min(1),
+  recordedAt: isoTimestamp
+}).strict();
+var ResolutionRecordSchema = z3.object({
+  version: z3.literal(1),
+  kind: z3.literal("resolution"),
+  task: taskId,
+  escalationId: z3.string().min(1),
+  decision: z3.union([z3.literal("resume"), z3.literal("cancel")]),
+  authenticatedBy: z3.string().min(1),
+  authenticatedFrom: z3.string().min(1),
+  consumedAt: isoTimestamp
+}).strict();
 // src/checks/contract.ts
 var CHECK_SCHEMA_VERSION = 1;
 function emitCheckError(error) {
@@ -5074,27 +6056,29 @@ import { execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync as readFileSync2, realpathSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
-import { z as z2 } from "zod";
+import { z as z4 } from "zod";
 
 // src/lib/agent-vendors.ts
 var AGENT_VENDORS = ["skills", "claude", "gemini"];
 
 // src/lib/config.ts
-var EnvEntrySchema = z2.union([
-  z2.literal(true),
-  z2.object({ optional: z2.literal(true) }),
-  z2.object({ anyOf: z2.array(z2.string()).min(2) }),
-  z2.string()
+var EnvEntrySchema = z4.union([
+  z4.literal(true),
+  z4.object({ optional: z4.literal(true) }),
+  z4.object({ anyOf: z4.array(z4.string()).min(2) }),
+  z4.string()
 ]);
-var CheckEntrySchema = z2.object({
-  run: z2.string(),
-  scope: z2.enum(["diff", "full"]),
-  include: z2.array(z2.string()).optional(),
-  args: z2.array(z2.string()).optional(),
-  timeoutMs: z2.number().optional(),
-  env: z2.record(z2.string(), EnvEntrySchema).optional(),
-  requiresOpenPr: z2.boolean().optional(),
-  ownWorkflow: z2.boolean().optional()
+var CheckEntrySchema = z4.object({
+  run: z4.string(),
+  scope: z4.enum(["diff", "full"]),
+  include: z4.array(z4.string()).optional(),
+  args: z4.array(z4.string()).optional(),
+  timeoutMs: z4.number().optional(),
+  env: z4.record(z4.string(), EnvEntrySchema).optional(),
+  requiresOpenPr: z4.boolean().optional(),
+  ownWorkflow: z4.boolean().optional(),
+  principalOwed: z4.literal(true).optional(),
+  validates: z4.enum(["body", "issue"]).optional()
 }).superRefine((entry2, ctx) => {
   if (!entry2.env)
     return;
@@ -5104,25 +6088,26 @@ var CheckEntrySchema = z2.object({
     const members = value.anyOf;
     if (new Set(members).size !== members.length) {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z4.ZodIssueCode.custom,
         message: `env.${key}.anyOf has duplicate members`,
         path: ["env", key, "anyOf"]
       });
     }
     if (!members.includes(key)) {
       ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
+        code: z4.ZodIssueCode.custom,
         message: `env.${key}.anyOf must include "${key}" itself as a member`,
         path: ["env", key, "anyOf"]
       });
     }
   }
 });
-var RoleEntrySchema = z2.object({
-  contract: z2.string().refine((p) => p.includes("/"), {
+var RoleEntrySchema = z4.object({
+  contract: z4.string().refine((p) => p.includes("/"), {
     message: 'must be a path (contain at least one "/"), not a bare filename'
   })
 });
+var MAX_REPORT_COMMAND_TIMEOUT_MS = 3600000;
 var BRIEF_BUILTINS = [
   "tier",
   "testPlan",
@@ -5142,17 +6127,17 @@ var BRIEF_BUILTINS = [
   "briefSections",
   "milestoneShape"
 ];
-var BriefSectionSchema = z2.union([
-  z2.object({ builtin: z2.enum(BRIEF_BUILTINS) }),
-  z2.object({ heading: z2.string().min(1), name: z2.string().optional() }),
-  z2.object({ field: z2.string().min(1), name: z2.string().optional() }),
-  z2.object({ phrase: z2.string().min(1), name: z2.string().optional() })
+var BriefSectionSchema = z4.union([
+  z4.object({ builtin: z4.enum(BRIEF_BUILTINS) }),
+  z4.object({ heading: z4.string().min(1), name: z4.string().optional() }),
+  z4.object({ field: z4.string().min(1), name: z4.string().optional() }),
+  z4.object({ phrase: z4.string().min(1), name: z4.string().optional() })
 ]);
-var BriefSchemaSchema = z2.object({
-  pr: z2.object({ sections: z2.array(BriefSectionSchema) }).optional(),
-  issue: z2.object({ sections: z2.array(BriefSectionSchema) }).optional(),
-  milestone: z2.object({ sections: z2.array(BriefSectionSchema) }).optional(),
-  ack: z2.array(z2.enum(BRIEF_BUILTINS)).optional()
+var BriefSchemaSchema = z4.object({
+  pr: z4.object({ sections: z4.array(BriefSectionSchema) }).optional(),
+  issue: z4.object({ sections: z4.array(BriefSectionSchema) }).optional(),
+  milestone: z4.object({ sections: z4.array(BriefSectionSchema) }).optional(),
+  ack: z4.array(z4.enum(BRIEF_BUILTINS)).optional()
 });
 function isSafeRepoRelPath(p) {
   if (p.length === 0)
@@ -5161,7 +6146,7 @@ function isSafeRepoRelPath(p) {
     return false;
   return p.split(/[\\/]/).every((seg) => seg !== ".." && seg !== "");
 }
-var SafeRepoRelPath = z2.string().refine(isSafeRepoRelPath, {
+var SafeRepoRelPath = z4.string().refine(isSafeRepoRelPath, {
   message: "must be a repo-root-relative path with no `..` segment or absolute root"
 });
 var CANONICAL_HOOK_BLOCK_PREFIXES = [".git/", ".husky/", ".vinaya/hooks/", ".claude/hooks/"];
@@ -5171,22 +6156,22 @@ function isCanonicalHookBlockPath(p) {
 var ManagedHookBlockPath = SafeRepoRelPath.refine(isCanonicalHookBlockPath, {
   message: `must start with one of ${CANONICAL_HOOK_BLOCK_PREFIXES.join(", ")} (byte-exact, case-sensitive)`
 });
-var ManagedBlockRecordSchema = z2.object({
+var ManagedBlockRecordSchema = z4.object({
   path: ManagedHookBlockPath,
-  marker: z2.string(),
-  comment: z2.enum(["hash", "html"])
+  marker: z4.string(),
+  comment: z4.enum(["hash", "html"])
 });
-var ManagedManifestSchema = z2.object({
-  version: z2.number().int().positive(),
-  files: z2.array(SafeRepoRelPath),
-  blocks: z2.array(ManagedBlockRecordSchema),
-  labels: z2.array(z2.string()),
-  agents: z2.array(z2.enum(AGENT_VENDORS)).optional()
+var ManagedManifestSchema = z4.object({
+  version: z4.number().int().positive(),
+  files: z4.array(SafeRepoRelPath),
+  blocks: z4.array(ManagedBlockRecordSchema),
+  labels: z4.array(z4.string()),
+  agents: z4.array(z4.enum(AGENT_VENDORS)).optional()
 });
-var ProjectEntrySchema = z2.object({
-  name: z2.string().min(1),
-  description: z2.string().min(1).optional(),
-  path: z2.string().min(1).optional()
+var ProjectEntrySchema = z4.object({
+  name: z4.string().min(1),
+  description: z4.string().min(1).optional(),
+  path: z4.string().min(1).optional()
 });
 function parseTokensCollectDeclaration(value) {
   const m = value.trim().match(/^(\S+)\s+(\S+)$/);
@@ -5197,34 +6182,62 @@ function parseTokensCollectDeclaration(value) {
     return null;
   return { interpreter, script };
 }
-var VinayaConfigSchema = z2.object({
-  rings: z2.object({
-    ring1_forgeWriteInterception: z2.boolean(),
-    ring2_asyncAudits: z2.boolean()
+var VinayaConfigSchema = z4.object({
+  rings: z4.object({
+    ring1_forgeWriteInterception: z4.boolean(),
+    ring2_asyncAudits: z4.boolean()
   }).optional(),
-  checks: z2.record(z2.string(), CheckEntrySchema).optional(),
-  roles: z2.record(z2.string(), RoleEntrySchema).optional(),
+  checks: z4.record(z4.string(), CheckEntrySchema).optional(),
+  roles: z4.record(z4.string(), RoleEntrySchema).optional(),
   briefSchema: BriefSchemaSchema.optional(),
   managed: ManagedManifestSchema.optional(),
-  principals: z2.array(z2.string()).min(1).optional(),
-  releaseActor: z2.string().min(1).optional(),
-  ci: z2.object({ setup: z2.string().min(1) }).optional(),
-  tokens: z2.object({
-    collect: z2.string().min(1).refine((v) => parseTokensCollectDeclaration(v) !== null, {
+  principals: z4.array(z4.string()).min(1).optional(),
+  releaseActor: z4.string().min(1).optional(),
+  ci: z4.object({ setup: z4.string().min(1) }).optional(),
+  tokens: z4.object({
+    collect: z4.string().min(1).refine((v) => parseTokensCollectDeclaration(v) !== null, {
       message: 'tokens.collect must be exactly "<interpreter> <repo-relative-script-path>" — two whitespace-separated tokens, no flags, no shell syntax, no quoting'
     })
   }).optional(),
-  blastRadius: z2.object({ extraDomains: z2.array(z2.string()).optional() }).optional(),
-  proseGates: z2.object({
-    doctrineRoot: z2.string().min(1).optional(),
-    readerFacingPrefix: z2.string().min(1).optional(),
-    readerFacingSuffix: z2.string().min(1).optional(),
-    legacySlugDir: z2.string().min(1).optional()
+  blastRadius: z4.object({ extraDomains: z4.array(z4.string()).optional() }).optional(),
+  proseGates: z4.object({
+    doctrineRoot: z4.string().min(1).optional(),
+    readerFacingPrefix: z4.string().min(1).optional(),
+    readerFacingSuffix: z4.string().min(1).optional(),
+    legacySlugDir: z4.string().min(1).optional()
   }).optional(),
-  projects: z2.array(ProjectEntrySchema).optional(),
-  dispatch: z2.object({
-    timeoutMs: z2.number().int().positive().optional(),
-    agent: z2.enum(["claude", "codex", "gemini"]).optional()
+  projects: z4.array(ProjectEntrySchema).optional(),
+  dispatch: z4.object({
+    timeoutMs: z4.number().int().positive().optional(),
+    killGraceMs: z4.number().int().positive().optional(),
+    agent: z4.enum(["claude", "codex", "gemini"]).optional()
+  }).optional(),
+  reviewPolicy: z4.object({
+    codeReviewThreshold: z4.string().min(1).optional(),
+    securityThreshold: z4.string().min(1).optional(),
+    maxRounds: z4.number().optional()
+  }).optional(),
+  prePush: z4.object({
+    alwaysRun: z4.array(z4.string()).optional()
+  }).optional(),
+  report: z4.object({
+    commandTimeoutMs: z4.number().int().positive().optional()
+  }).superRefine((report, ctx) => {
+    const commandTimeoutMs = report.commandTimeoutMs;
+    if (commandTimeoutMs !== undefined && commandTimeoutMs > MAX_REPORT_COMMAND_TIMEOUT_MS) {
+      ctx.addIssue({
+        code: z4.ZodIssueCode.custom,
+        path: ["commandTimeoutMs"],
+        message: "must be at most 3600000 (1 hour)"
+      });
+    }
+  }).optional(),
+  logPublish: z4.object({
+    issue: z4.number().int().positive().optional(),
+    pr: z4.number().int().positive().optional(),
+    maxChunksPerFlush: z4.number().int().positive().optional()
+  }).refine((v) => !(v.issue !== undefined && v.pr !== undefined), {
+    message: "logPublish: set at most one of issue/pr, not both"
   }).optional()
 });
 var GLOBAL_VINAYA_HOME = join(homedir(), ".vinaya");
@@ -5299,6 +6312,28 @@ function resolvePrincipalAllowlist(config) {
 function resolveReleaseActor(config) {
   return config?.releaseActor ?? DEFAULT_RELEASE_ACTOR;
 }
+function resolveReviewPolicy(config) {
+  const raw = config?.reviewPolicy;
+  if (!raw)
+    return DEFAULT_REVIEW_POLICY;
+  const codeReviewThreshold = raw.codeReviewThreshold ?? DEFAULT_REVIEW_POLICY.codeReviewThreshold;
+  if (!isKnownSeverity(CODE_REVIEW_SEVERITY_ORDER, codeReviewThreshold)) {
+    throw new Error(`vinaya.config.json: reviewPolicy.codeReviewThreshold "${codeReviewThreshold}" is not one of ${CODE_REVIEW_SEVERITY_ORDER.join(" > ")} — fix the config, this never falls back to a default.`);
+  }
+  const securityThreshold = raw.securityThreshold ?? DEFAULT_REVIEW_POLICY.securityThreshold;
+  if (!isKnownSeverity(SECURITY_SEVERITY_ORDER, securityThreshold)) {
+    throw new Error(`vinaya.config.json: reviewPolicy.securityThreshold "${securityThreshold}" is not one of ${SECURITY_SEVERITY_ORDER.join(" > ")} — fix the config, this never falls back to a default.`);
+  }
+  const maxRounds = raw.maxRounds ?? DEFAULT_REVIEW_POLICY.maxRounds;
+  if (!Number.isInteger(maxRounds) || maxRounds < 1) {
+    throw new Error(`vinaya.config.json: reviewPolicy.maxRounds "${maxRounds}" is not a positive integer — fix the config, this never falls back to a default.`);
+  }
+  return {
+    codeReviewThreshold,
+    securityThreshold,
+    maxRounds
+  };
+}
 function trustAnchorRepo() {
   const wellFormed = (slug) => /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
   const fromRunner = process.env.GITHUB_REPOSITORY?.trim();
@@ -5426,6 +6461,44 @@ function fetchIssueBodyForObjectives(issueNumber) {
     stdio: ["ignore", "pipe", "pipe"]
   });
 }
+function fetchIssueCommentsForBrief(issueNumber) {
+  const out = execFileSync4("gh", ["issue", "view", String(issueNumber), "--json", "comments"], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  const parsed = JSON.parse(out);
+  return parsed.comments.map((c) => ({ body: c.body, author: c.author?.login ?? null }));
+}
+function resolveBriefHash(pr, principalAllowlist) {
+  const { issue } = extractIssue(pr.body);
+  if (issue === null)
+    return null;
+  let comments;
+  try {
+    comments = fetchIssueCommentsForBrief(issue);
+  } catch (err) {
+    if (isIssueNotFoundError(err)) {
+      emitCheckError({
+        schema: CHECK_SCHEMA_VERSION,
+        check: CHECK_NAME,
+        severity: "error",
+        message: `review-gate severity:infra — Issue #${issue} does not resolve via \`gh issue view\` — cannot verify the brief-hash binding for a PR whose linked Issue no longer exists.`,
+        agent_recovery_prompt: `Restore Issue #${issue}, fix \`Closes #N\` to name a real Issue, or have a principal apply the \`vinaya/waiver:review\` label, then re-run \`vinaya check review-gate\`.`
+      });
+      process.exit(1);
+    }
+    emitCheckError({
+      schema: CHECK_SCHEMA_VERSION,
+      check: CHECK_NAME,
+      severity: "error",
+      message: `review-gate severity:infra — could not fetch Issue #${issue}'s comments via \`gh issue view\` to resolve its frozen-brief hash: ${err.message}`,
+      agent_recovery_prompt: "Confirm `gh auth status` passes and the Issue number is correct, then re-run `vinaya check review-gate`."
+    });
+    process.exit(1);
+  }
+  const frozen = resolveNewestFrozenBrief(comments, principalAllowlist);
+  return frozen ? briefHash(frozen.content) : null;
+}
 function resolveObjectivesVersion(pr) {
   const { issue } = extractIssue(pr.body);
   const source = resolveObjectivesSource(pr.body, issue, OBJECTIVES_SINCE_ISSUE);
@@ -5481,6 +6554,15 @@ function resolveObjectivesVersion(pr) {
   }
   return objectivesVersion(own.objectives);
 }
+function uncheckedPrincipalReason(body, branch) {
+  const result = evaluateTestPlanGate(body, branch);
+  if (result.verdict !== "fail")
+    return null;
+  const uncheckedLines = result.messages.filter((m) => /^\s*[-*]\s+\[\s\]/.test(m)).map((m) => m.trim());
+  if (uncheckedLines.length === 0)
+    return null;
+  return `unticked [principal] Test Plan item(s) — ${uncheckedLines.join("; ")}`;
+}
 function shaFromLsRemote(branch) {
   try {
     const out = execFileSync4("git", ["ls-remote", "origin", `refs/heads/${branch}`], {
@@ -5504,6 +6586,9 @@ function shaFromGhApi(branch) {
     return null;
   }
 }
+function resolveBaseSha(pr) {
+  return shaFromLsRemote(pr.baseRefName) ?? shaFromGhApi(pr.baseRefName);
+}
 function resolveTrueHeadSha(pr) {
   const trueSha = shaFromLsRemote(pr.headRefName) ?? shaFromGhApi(pr.headRefName);
   if (trueSha && pr.headRefOid && trueSha !== pr.headRefOid) {
@@ -5604,7 +6689,32 @@ function main() {
     });
     process.exit(1);
   }
-  const principalAllowlist = resolvePrincipalAllowlist(loadTrustAnchorConfig());
+  const baseSha = resolveBaseSha(pr);
+  if (!baseSha) {
+    emitCheckError({
+      schema: CHECK_SCHEMA_VERSION,
+      check: CHECK_NAME,
+      severity: "error",
+      message: `review-gate severity:infra — could not resolve PR #${prNumber}'s base branch \`${pr.baseRefName}\`'s tip via \`git ls-remote\` or the forge's \`git/ref/heads\` API.`,
+      agent_recovery_prompt: "Confirm the base branch still exists on origin and `gh auth status` passes, then re-run `vinaya check review-gate`."
+    });
+    process.exit(1);
+  }
+  const trustAnchorConfig = loadTrustAnchorConfig();
+  const principalAllowlist = resolvePrincipalAllowlist(trustAnchorConfig);
+  let reviewPolicy;
+  try {
+    reviewPolicy = resolveReviewPolicy(trustAnchorConfig);
+  } catch (err) {
+    emitCheckError({
+      schema: CHECK_SCHEMA_VERSION,
+      check: CHECK_NAME,
+      severity: "error",
+      message: `review-gate severity:infra — ${err instanceof Error ? err.message : String(err)}`,
+      agent_recovery_prompt: "Fix `reviewPolicy` in the default branch's `vinaya.config.json` to a known severity on each role's own scale, then re-run `vinaya check review-gate`."
+    });
+    process.exit(1);
+  }
   const waived = isWaiverLabelActorVerified({
     label: WAIVER_LABEL_REVIEW,
     labels,
@@ -5619,9 +6729,13 @@ function main() {
     mechanicalChecks,
     headSha,
     patchIdOf: (sha) => patchIdAt(pr.baseRefName, sha),
+    baseSha,
     objectivesVersion: waived ? null : resolveObjectivesVersion(pr),
-    rulingOrdinal: newestPrincipalRulingOrdinal(pr.comments.map((c) => ({ body: c.body, author: c.author?.login ?? null })), principalAllowlist)
+    rulingOrdinal: newestPrincipalRulingOrdinal(pr.comments.map((c) => ({ body: c.body, author: c.author?.login ?? null })), principalAllowlist),
+    policy: reviewPolicy,
+    briefHash: waived ? null : resolveBriefHash(pr, principalAllowlist)
   });
+  let failed = false;
   if (result.verdict === "fail") {
     emitCheckError({
       schema: CHECK_SCHEMA_VERSION,
@@ -5630,8 +6744,24 @@ function main() {
       message: `review-gate (PR #${prNumber}): ${result.reason}`,
       agent_recovery_prompt: "Wait for a code-reviewer APPROVE and a security-review PASS on this PR (or ask a principal to apply the `vinaya/waiver:review` label), then re-run `vinaya check review-gate`."
     });
-    process.exit(1);
+    failed = true;
   }
-  process.exit(0);
+  const principalReason = uncheckedPrincipalReason(pr.body, pr.headRefName);
+  if (principalReason !== null) {
+    emitCheckError({
+      schema: CHECK_SCHEMA_VERSION,
+      check: CHECK_NAME,
+      severity: "error",
+      message: `review-gate (PR #${prNumber}): ${principalReason}`,
+      agent_recovery_prompt: "Nothing for the Developer to fix here — wait for the Principal to verify in a real signed-in browser and tick each `[principal]` Test Plan box, then re-run `vinaya check review-gate`."
+    });
+    failed = true;
+  }
+  process.exit(failed ? 1 : 0);
 }
-main();
+if (__require.main == __require.module) {
+  main();
+}
+export {
+  uncheckedPrincipalReason
+};