@attalabs/vinaya 0.4.3 → 0.4.4

package/dist/checks/bin/check-doc-coverage.js

@@ -2,7 +2,7 @@
 // @bun
 
 // src/checks/bin/check-doc-coverage.ts
-import { execFileSync as execFileSync2 } from "child_process";
+import { execFileSync as execFileSync3 } from "child_process";
 import { existsSync, readFileSync } from "fs";
 // ../../../packages/aeg-core/src/anchored-region.ts
 function maskCode(body) {
@@ -1453,12 +1453,16 @@ function isCodeFile(p) {
 var WAIVER_LABEL = label("waiver-docs");
 var WAIVER_LABEL_REVIEW = label("waiver-review");
 var PRINCIPAL_ALLOWLIST = ["daniboomerang"];
+function isPrincipal(login, principalAllowlist) {
+  if (login === null)
+    return false;
+  const normalized = login.toLowerCase();
+  return principalAllowlist.some((p) => p.toLowerCase() === normalized);
+}
 function isWaiverLabelActorVerified(opts) {
   if (!opts.labels.includes(opts.label))
     return false;
-  if (opts.labelActor === null)
-    return false;
-  return opts.principalAllowlist.includes(opts.labelActor);
+  return isPrincipal(opts.labelActor, opts.principalAllowlist);
 }
 
 // ../../../packages/aeg-core/src/doc-owners.ts
@@ -1646,6 +1650,27 @@ function overrideActive(opts) {
 // ../../../packages/aeg-core/src/premise-check.ts
 var ASSERTION_KINDS = new Set(["contains", "absent", "sha256"]);
 
+// ../../../packages/aeg-core/src/test-plan-section.ts
+var HEADING_FORM_RE = /^#{1,4}[ \t]*(?:\d+[a-z]?\.[ \t]*)?\*{0,2}Test Plan\*{0,2}[ \t]*$/im;
+var INLINE_FORM_RE = /^[ \t]*\*{0,2}Test Plan:?\*{0,2}/im;
+var NEXT_SECTION_RE = /\n(?:#{1,3}[ \t]|\*\*[A-Z][^*\n]*:\*\*)/;
+function locateTestPlanSection(body) {
+  const region = anchoredRegion(body, "TEST-PLAN");
+  if (region !== null)
+    return { found: true, section: region };
+  const headingMatch = HEADING_FORM_RE.exec(body);
+  const match = headingMatch ?? INLINE_FORM_RE.exec(body);
+  if (!match || match.index === undefined)
+    return { found: false };
+  const sectionBody = body.slice(match.index);
+  const firstLineEnd = sectionBody.indexOf(`
+`);
+  const searchFrom = firstLineEnd === -1 ? sectionBody.length : firstLineEnd + 1;
+  const nextMatch = sectionBody.slice(searchFrom).match(NEXT_SECTION_RE);
+  const sectionEnd = nextMatch ? searchFrom + (nextMatch.index ?? 0) : sectionBody.length;
+  return { found: true, section: sectionBody.slice(0, sectionEnd) };
+}
+
 // ../../../packages/aeg-core/src/brief-validation.ts
 function headerRegion(prBody) {
   const m = prBody.match(/^##\s/m);
@@ -1684,10 +1709,15 @@ function checkTierField(prBody, readTier) {
   };
 }
 var TEST_PLAN_UNIT_TESTS_ONLY_RE = /(?:\*\*)?Test Plan(?:\*\*)?\s*:\s*(?:\*\*)?\s*unit-tests-only/i;
+function testPlanRegion(prBody) {
+  const located = locateTestPlanSection(prBody);
+  return located.found ? located.section : prBody;
+}
 function checkTestPlan(prBody) {
-  if (TEST_PLAN_UNIT_TESTS_ONLY_RE.test(prBody))
+  const region = testPlanRegion(prBody);
+  if (TEST_PLAN_UNIT_TESTS_ONLY_RE.test(region))
     return { status: "pass", errors: [] };
-  if (/\*\*\[(?:agent|principal)\]\*\*/.test(prBody))
+  if (/\*\*\[(?:agent|principal)\]\*\*/.test(region))
     return { status: "pass", errors: [] };
   return {
     status: "fail",
@@ -1697,9 +1727,10 @@ function checkTestPlan(prBody) {
   };
 }
 function checkTestPlanExclusivity(prBody) {
-  if (!TEST_PLAN_UNIT_TESTS_ONLY_RE.test(prBody))
+  const region = testPlanRegion(prBody);
+  if (!TEST_PLAN_UNIT_TESTS_ONLY_RE.test(region))
     return { status: "pass", errors: [] };
-  if (/^-\s*\[[ xX]\]\s*\*{2}\[(?:agent|principal)\]\*{2}/im.test(prBody)) {
+  if (/^-\s*\[[ xX]\]\s*\*{2}\[(?:agent|principal)\]\*{2}/im.test(region)) {
     return {
       status: "fail",
       errors: [
@@ -1710,8 +1741,9 @@ function checkTestPlanExclusivity(prBody) {
   return { status: "pass", errors: [] };
 }
 function checkPrincipalPlaceholder(prBody) {
+  const region = testPlanRegion(prBody);
   const lineRe = /^-\s*\[[ xX]\]\s*\*{2}\[principal\]\*{2}(.*)$/gim;
-  for (const m of prBody.matchAll(lineRe)) {
+  for (const m of region.matchAll(lineRe)) {
     const content = m[1] ?? "";
     if (/^\s*None\b/i.test(content)) {
       return {
@@ -2159,11 +2191,12 @@ function isReviewGateExemptBranch(branch) {
   return branch.startsWith("plan/");
 }
 function checkReviewGate(input) {
+  const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const waived = isWaiverLabelActorVerified({
     label: WAIVER_LABEL_REVIEW,
     labels: input.labels,
     labelActor: input.waiverLabelActor,
-    principalAllowlist: PRINCIPAL_ALLOWLIST
+    principalAllowlist
   });
   if (waived) {
     return {
@@ -2172,8 +2205,8 @@ function checkReviewGate(input) {
       waived: true
     };
   }
-  const verified = input.comments.filter((c) => c.author !== null && PRINCIPAL_ALLOWLIST.includes(c.author));
-  const ignoredCount = input.comments.filter((c) => (c.author === null || !PRINCIPAL_ALLOWLIST.includes(c.author)) && c.body.includes("VERDICT")).length;
+  const verified = input.comments.filter((c) => isPrincipal(c.author, principalAllowlist));
+  const ignoredCount = input.comments.filter((c) => !isPrincipal(c.author, principalAllowlist) && c.body.includes("VERDICT")).length;
   const verifiedBodies = verified.map((c) => c.body);
   const codeReview = extractCodeReviewVerdict(verifiedBodies);
   const security = extractSecurityReviewVerdict(verifiedBodies);
@@ -2726,26 +2759,6 @@ function decideIssueAssignment(input) {
     reason: `First push of \`${branch}\` — assigning Issue #${issue} to @${login} (the authenticated pusher).`
   };
 }
-// ../../../packages/aeg-core/src/test-plan-section.ts
-var HEADING_FORM_RE = /^#{1,4}[ \t]*(?:\d+[a-z]?\.[ \t]*)?\*{0,2}Test Plan\*{0,2}[ \t]*$/im;
-var INLINE_FORM_RE = /^[ \t]*\*{0,2}Test Plan:?\*{0,2}/im;
-var NEXT_SECTION_RE = /\n(?:#{1,3}[ \t]|\*\*[A-Z][^*\n]*:\*\*)/;
-function locateTestPlanSection(body) {
-  const region = anchoredRegion(body, "TEST-PLAN");
-  if (region !== null)
-    return { found: true, section: region };
-  const headingMatch = HEADING_FORM_RE.exec(body);
-  const match = headingMatch ?? INLINE_FORM_RE.exec(body);
-  if (!match || match.index === undefined)
-    return { found: false };
-  const sectionBody = body.slice(match.index);
-  const firstLineEnd = sectionBody.indexOf(`
-`);
-  const searchFrom = firstLineEnd === -1 ? sectionBody.length : firstLineEnd + 1;
-  const nextMatch = sectionBody.slice(searchFrom).match(NEXT_SECTION_RE);
-  const sectionEnd = nextMatch ? searchFrom + (nextMatch.index ?? 0) : sectionBody.length;
-  return { found: true, section: sectionBody.slice(0, sectionEnd) };
-}
 // ../../../packages/aeg-core/src/test-plan-gate.ts
 var TASK_BRANCH_PATTERN = /^task\/[^/]+\/[^/]+$/;
 function evaluateTestPlanGate(body, branch) {
@@ -2817,11 +2830,183 @@ function emitCheckError(error) {
 `);
 }
 
+// src/lib/config.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { z } from "zod";
+var EnvEntrySchema = z.union([
+  z.literal(true),
+  z.object({ optional: z.literal(true) }),
+  z.object({ anyOf: z.array(z.string()).min(2) }),
+  z.string()
+]);
+var CheckEntrySchema = z.object({
+  run: z.string(),
+  scope: z.enum(["diff", "full"]),
+  include: z.array(z.string()).optional(),
+  args: z.array(z.string()).optional(),
+  timeoutMs: z.number().optional(),
+  env: z.record(z.string(), EnvEntrySchema).optional(),
+  requiresOpenPr: z.boolean().optional()
+}).superRefine((entry2, ctx) => {
+  if (!entry2.env)
+    return;
+  for (const [key, value] of Object.entries(entry2.env)) {
+    if (typeof value !== "object" || value === null || !("anyOf" in value))
+      continue;
+    const members = value.anyOf;
+    if (new Set(members).size !== members.length) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: `env.${key}.anyOf has duplicate members`,
+        path: ["env", key, "anyOf"]
+      });
+    }
+    if (!members.includes(key)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: `env.${key}.anyOf must include "${key}" itself as a member`,
+        path: ["env", key, "anyOf"]
+      });
+    }
+  }
+});
+var BRIEF_BUILTINS = [
+  "tier",
+  "testPlan",
+  "testPlanExclusivity",
+  "principalPlaceholder",
+  "surfaceMap",
+  "docUpdateList",
+  "worktreeStep0",
+  "stopConditions",
+  "autonomyClause",
+  "project",
+  "for",
+  "closesN",
+  "premiseCoverage",
+  "issueRationale"
+];
+var BriefSectionSchema = z.union([
+  z.object({ builtin: z.enum(BRIEF_BUILTINS) }),
+  z.object({ heading: z.string().min(1), name: z.string().optional() }),
+  z.object({ field: z.string().min(1), name: z.string().optional() }),
+  z.object({ phrase: z.string().min(1), name: z.string().optional() })
+]);
+var BriefSchemaSchema = z.object({
+  pr: z.object({ sections: z.array(BriefSectionSchema) }).optional(),
+  issue: z.object({ sections: z.array(BriefSectionSchema) }).optional()
+});
+function isSafeRepoRelPath(p) {
+  if (p.length === 0)
+    return false;
+  if (p.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(p))
+    return false;
+  return p.split(/[\\/]/).every((seg) => seg !== ".." && seg !== "");
+}
+var SafeRepoRelPath = z.string().refine(isSafeRepoRelPath, {
+  message: "must be a repo-root-relative path with no `..` segment or absolute root"
+});
+var ManagedBlockRecordSchema = z.object({
+  path: SafeRepoRelPath,
+  marker: z.string(),
+  comment: z.enum(["hash", "html"])
+});
+var ManagedManifestSchema = z.object({
+  version: z.number().int().positive(),
+  files: z.array(SafeRepoRelPath),
+  blocks: z.array(ManagedBlockRecordSchema),
+  labels: z.array(z.string())
+});
+var VinayaConfigSchema = z.object({
+  rings: z.object({
+    ring1_forgeWriteInterception: z.boolean(),
+    ring2_asyncAudits: z.boolean()
+  }).optional(),
+  checks: z.record(z.string(), CheckEntrySchema).optional(),
+  briefSchema: BriefSchemaSchema.optional(),
+  managed: ManagedManifestSchema.optional(),
+  principals: z.array(z.string()).min(1).optional()
+});
+var GLOBAL_VINAYA_HOME = join(homedir(), ".vinaya");
+var GLOBAL_CONFIG_PATH = join(GLOBAL_VINAYA_HOME, "config.json");
+var LOCAL_CONFIG_FILENAME = "vinaya.config.json";
+function resolvePrincipalAllowlist(config) {
+  return config?.principals ?? PRINCIPAL_ALLOWLIST;
+}
+function trustAnchorRepo() {
+  const wellFormed = (slug) => /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
+  const fromRunner = process.env.GITHUB_REPOSITORY?.trim();
+  if (fromRunner) {
+    const validated = wellFormed(fromRunner);
+    if (validated)
+      return validated;
+  }
+  try {
+    const url = execFileSync2("git", ["remote", "get-url", "origin"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+    const m = url.match(/github\.com[:/]([^/]+)\/(.+?)(?:\.git)?\/?$/);
+    return m?.[1] && m[2] ? wellFormed(`${m[1]}/${m[2]}`) : null;
+  } catch {
+    return null;
+  }
+}
+function ghFetchTrustAnchorConfig() {
+  const repo = trustAnchorRepo();
+  if (!repo)
+    throw new Error("could not resolve repo identity for the trust-anchor read");
+  return execFileSync2("gh", ["api", `repos/${repo}/contents/${LOCAL_CONFIG_FILENAME}`, "--jq", ".content"], {
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+}
+function firstLine(err) {
+  return err?.message?.split(`
+`)[0] ?? "unknown error";
+}
+function isMissingFileError(err) {
+  const stderr = err?.stderr;
+  const haystack = [
+    err?.message ?? "",
+    typeof stderr === "string" ? stderr : stderr?.toString() ?? ""
+  ].join(`
+`);
+  return /\b404\b|not found/i.test(haystack);
+}
+function loadTrustAnchorConfig(fetcher = ghFetchTrustAnchorConfig) {
+  const warn = (why) => process.stdout.write(`⚠ could not read \`principals\` from the default branch (${why}) — falling back to vinaya's built-in principal allowlist.
+`);
+  let base64;
+  try {
+    base64 = fetcher().trim();
+  } catch (err) {
+    if (!isMissingFileError(err))
+      warn(firstLine(err));
+    return null;
+  }
+  if (!base64)
+    return null;
+  try {
+    const raw = Buffer.from(base64, "base64").toString("utf-8");
+    const parsed = VinayaConfigSchema.safeParse(JSON.parse(raw));
+    if (parsed.success)
+      return parsed.data;
+    warn("it did not satisfy the config schema");
+    return null;
+  } catch {
+    warn("it was not readable as JSON");
+    return null;
+  }
+}
+
 // src/checks/bin/check-doc-coverage.ts
 var CHECK_NAME = "doc-coverage";
 function git(args) {
   try {
-    return execFileSync2("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync3("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch {
     return "";
   }
@@ -2844,11 +3029,13 @@ function resolvePrBody() {
 }
 function waiverActiveFromEnv() {
   const labels = (process.env.PR_LABELS || "").split(",").map((s) => s.trim()).filter(Boolean);
+  if (!labels.includes(WAIVER_LABEL))
+    return false;
   return isWaiverLabelActorVerified({
     label: WAIVER_LABEL,
     labels,
     labelActor: process.env.WAIVER_LABEL_ACTOR || null,
-    principalAllowlist: PRINCIPAL_ALLOWLIST
+    principalAllowlist: resolvePrincipalAllowlist(loadTrustAnchorConfig())
   });
 }
 function main() {

package/dist/checks/bin/check-first-push-dispatch.js

@@ -1451,12 +1451,16 @@ function isCodeFile(p) {
 var WAIVER_LABEL = label("waiver-docs");
 var WAIVER_LABEL_REVIEW = label("waiver-review");
 var PRINCIPAL_ALLOWLIST = ["daniboomerang"];
+function isPrincipal(login, principalAllowlist) {
+  if (login === null)
+    return false;
+  const normalized = login.toLowerCase();
+  return principalAllowlist.some((p) => p.toLowerCase() === normalized);
+}
 function isWaiverLabelActorVerified(opts) {
   if (!opts.labels.includes(opts.label))
     return false;
-  if (opts.labelActor === null)
-    return false;
-  return opts.principalAllowlist.includes(opts.labelActor);
+  return isPrincipal(opts.labelActor, opts.principalAllowlist);
 }
 
 // ../../../packages/aeg-core/src/doc-owners.ts
@@ -1644,6 +1648,27 @@ function overrideActive(opts) {
 // ../../../packages/aeg-core/src/premise-check.ts
 var ASSERTION_KINDS = new Set(["contains", "absent", "sha256"]);
 
+// ../../../packages/aeg-core/src/test-plan-section.ts
+var HEADING_FORM_RE = /^#{1,4}[ \t]*(?:\d+[a-z]?\.[ \t]*)?\*{0,2}Test Plan\*{0,2}[ \t]*$/im;
+var INLINE_FORM_RE = /^[ \t]*\*{0,2}Test Plan:?\*{0,2}/im;
+var NEXT_SECTION_RE = /\n(?:#{1,3}[ \t]|\*\*[A-Z][^*\n]*:\*\*)/;
+function locateTestPlanSection(body) {
+  const region = anchoredRegion(body, "TEST-PLAN");
+  if (region !== null)
+    return { found: true, section: region };
+  const headingMatch = HEADING_FORM_RE.exec(body);
+  const match = headingMatch ?? INLINE_FORM_RE.exec(body);
+  if (!match || match.index === undefined)
+    return { found: false };
+  const sectionBody = body.slice(match.index);
+  const firstLineEnd = sectionBody.indexOf(`
+`);
+  const searchFrom = firstLineEnd === -1 ? sectionBody.length : firstLineEnd + 1;
+  const nextMatch = sectionBody.slice(searchFrom).match(NEXT_SECTION_RE);
+  const sectionEnd = nextMatch ? searchFrom + (nextMatch.index ?? 0) : sectionBody.length;
+  return { found: true, section: sectionBody.slice(0, sectionEnd) };
+}
+
 // ../../../packages/aeg-core/src/brief-validation.ts
 function headerRegion(prBody) {
   const m = prBody.match(/^##\s/m);
@@ -1682,10 +1707,15 @@ function checkTierField(prBody, readTier) {
   };
 }
 var TEST_PLAN_UNIT_TESTS_ONLY_RE = /(?:\*\*)?Test Plan(?:\*\*)?\s*:\s*(?:\*\*)?\s*unit-tests-only/i;
+function testPlanRegion(prBody) {
+  const located = locateTestPlanSection(prBody);
+  return located.found ? located.section : prBody;
+}
 function checkTestPlan(prBody) {
-  if (TEST_PLAN_UNIT_TESTS_ONLY_RE.test(prBody))
+  const region = testPlanRegion(prBody);
+  if (TEST_PLAN_UNIT_TESTS_ONLY_RE.test(region))
     return { status: "pass", errors: [] };
-  if (/\*\*\[(?:agent|principal)\]\*\*/.test(prBody))
+  if (/\*\*\[(?:agent|principal)\]\*\*/.test(region))
     return { status: "pass", errors: [] };
   return {
     status: "fail",
@@ -1695,9 +1725,10 @@ function checkTestPlan(prBody) {
   };
 }
 function checkTestPlanExclusivity(prBody) {
-  if (!TEST_PLAN_UNIT_TESTS_ONLY_RE.test(prBody))
+  const region = testPlanRegion(prBody);
+  if (!TEST_PLAN_UNIT_TESTS_ONLY_RE.test(region))
     return { status: "pass", errors: [] };
-  if (/^-\s*\[[ xX]\]\s*\*{2}\[(?:agent|principal)\]\*{2}/im.test(prBody)) {
+  if (/^-\s*\[[ xX]\]\s*\*{2}\[(?:agent|principal)\]\*{2}/im.test(region)) {
     return {
       status: "fail",
       errors: [
@@ -1708,8 +1739,9 @@ function checkTestPlanExclusivity(prBody) {
   return { status: "pass", errors: [] };
 }
 function checkPrincipalPlaceholder(prBody) {
+  const region = testPlanRegion(prBody);
   const lineRe = /^-\s*\[[ xX]\]\s*\*{2}\[principal\]\*{2}(.*)$/gim;
-  for (const m of prBody.matchAll(lineRe)) {
+  for (const m of region.matchAll(lineRe)) {
     const content = m[1] ?? "";
     if (/^\s*None\b/i.test(content)) {
       return {
@@ -2157,11 +2189,12 @@ function isReviewGateExemptBranch(branch) {
   return branch.startsWith("plan/");
 }
 function checkReviewGate(input) {
+  const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const waived = isWaiverLabelActorVerified({
     label: WAIVER_LABEL_REVIEW,
     labels: input.labels,
     labelActor: input.waiverLabelActor,
-    principalAllowlist: PRINCIPAL_ALLOWLIST
+    principalAllowlist
   });
   if (waived) {
     return {
@@ -2170,8 +2203,8 @@ function checkReviewGate(input) {
       waived: true
     };
   }
-  const verified = input.comments.filter((c) => c.author !== null && PRINCIPAL_ALLOWLIST.includes(c.author));
-  const ignoredCount = input.comments.filter((c) => (c.author === null || !PRINCIPAL_ALLOWLIST.includes(c.author)) && c.body.includes("VERDICT")).length;
+  const verified = input.comments.filter((c) => isPrincipal(c.author, principalAllowlist));
+  const ignoredCount = input.comments.filter((c) => !isPrincipal(c.author, principalAllowlist) && c.body.includes("VERDICT")).length;
   const verifiedBodies = verified.map((c) => c.body);
   const codeReview = extractCodeReviewVerdict(verifiedBodies);
   const security = extractSecurityReviewVerdict(verifiedBodies);
@@ -2724,26 +2757,6 @@ function decideIssueAssignment(input) {
     reason: `First push of \`${branch}\` — assigning Issue #${issue} to @${login} (the authenticated pusher).`
   };
 }
-// ../../../packages/aeg-core/src/test-plan-section.ts
-var HEADING_FORM_RE = /^#{1,4}[ \t]*(?:\d+[a-z]?\.[ \t]*)?\*{0,2}Test Plan\*{0,2}[ \t]*$/im;
-var INLINE_FORM_RE = /^[ \t]*\*{0,2}Test Plan:?\*{0,2}/im;
-var NEXT_SECTION_RE = /\n(?:#{1,3}[ \t]|\*\*[A-Z][^*\n]*:\*\*)/;
-function locateTestPlanSection(body) {
-  const region = anchoredRegion(body, "TEST-PLAN");
-  if (region !== null)
-    return { found: true, section: region };
-  const headingMatch = HEADING_FORM_RE.exec(body);
-  const match = headingMatch ?? INLINE_FORM_RE.exec(body);
-  if (!match || match.index === undefined)
-    return { found: false };
-  const sectionBody = body.slice(match.index);
-  const firstLineEnd = sectionBody.indexOf(`
-`);
-  const searchFrom = firstLineEnd === -1 ? sectionBody.length : firstLineEnd + 1;
-  const nextMatch = sectionBody.slice(searchFrom).match(NEXT_SECTION_RE);
-  const sectionEnd = nextMatch ? searchFrom + (nextMatch.index ?? 0) : sectionBody.length;
-  return { found: true, section: sectionBody.slice(0, sectionEnd) };
-}
 // ../../../packages/aeg-core/src/test-plan-gate.ts
 var TASK_BRANCH_PATTERN = /^task\/[^/]+\/[^/]+$/;
 function evaluateTestPlanGate(body, branch) {

package/dist/checks/bin/check-issue-assignment.js

@@ -1451,12 +1451,16 @@ function isCodeFile(p) {
 var WAIVER_LABEL = label("waiver-docs");
 var WAIVER_LABEL_REVIEW = label("waiver-review");
 var PRINCIPAL_ALLOWLIST = ["daniboomerang"];
+function isPrincipal(login, principalAllowlist) {
+  if (login === null)
+    return false;
+  const normalized = login.toLowerCase();
+  return principalAllowlist.some((p) => p.toLowerCase() === normalized);
+}
 function isWaiverLabelActorVerified(opts) {
   if (!opts.labels.includes(opts.label))
     return false;
-  if (opts.labelActor === null)
-    return false;
-  return opts.principalAllowlist.includes(opts.labelActor);
+  return isPrincipal(opts.labelActor, opts.principalAllowlist);
 }
 
 // ../../../packages/aeg-core/src/doc-owners.ts
@@ -1644,6 +1648,27 @@ function overrideActive(opts) {
 // ../../../packages/aeg-core/src/premise-check.ts
 var ASSERTION_KINDS = new Set(["contains", "absent", "sha256"]);
 
+// ../../../packages/aeg-core/src/test-plan-section.ts
+var HEADING_FORM_RE = /^#{1,4}[ \t]*(?:\d+[a-z]?\.[ \t]*)?\*{0,2}Test Plan\*{0,2}[ \t]*$/im;
+var INLINE_FORM_RE = /^[ \t]*\*{0,2}Test Plan:?\*{0,2}/im;
+var NEXT_SECTION_RE = /\n(?:#{1,3}[ \t]|\*\*[A-Z][^*\n]*:\*\*)/;
+function locateTestPlanSection(body) {
+  const region = anchoredRegion(body, "TEST-PLAN");
+  if (region !== null)
+    return { found: true, section: region };
+  const headingMatch = HEADING_FORM_RE.exec(body);
+  const match = headingMatch ?? INLINE_FORM_RE.exec(body);
+  if (!match || match.index === undefined)
+    return { found: false };
+  const sectionBody = body.slice(match.index);
+  const firstLineEnd = sectionBody.indexOf(`
+`);
+  const searchFrom = firstLineEnd === -1 ? sectionBody.length : firstLineEnd + 1;
+  const nextMatch = sectionBody.slice(searchFrom).match(NEXT_SECTION_RE);
+  const sectionEnd = nextMatch ? searchFrom + (nextMatch.index ?? 0) : sectionBody.length;
+  return { found: true, section: sectionBody.slice(0, sectionEnd) };
+}
+
 // ../../../packages/aeg-core/src/brief-validation.ts
 function headerRegion(prBody) {
   const m = prBody.match(/^##\s/m);
@@ -1682,10 +1707,15 @@ function checkTierField(prBody, readTier) {
   };
 }
 var TEST_PLAN_UNIT_TESTS_ONLY_RE = /(?:\*\*)?Test Plan(?:\*\*)?\s*:\s*(?:\*\*)?\s*unit-tests-only/i;
+function testPlanRegion(prBody) {
+  const located = locateTestPlanSection(prBody);
+  return located.found ? located.section : prBody;
+}
 function checkTestPlan(prBody) {
-  if (TEST_PLAN_UNIT_TESTS_ONLY_RE.test(prBody))
+  const region = testPlanRegion(prBody);
+  if (TEST_PLAN_UNIT_TESTS_ONLY_RE.test(region))
     return { status: "pass", errors: [] };
-  if (/\*\*\[(?:agent|principal)\]\*\*/.test(prBody))
+  if (/\*\*\[(?:agent|principal)\]\*\*/.test(region))
     return { status: "pass", errors: [] };
   return {
     status: "fail",
@@ -1695,9 +1725,10 @@ function checkTestPlan(prBody) {
   };
 }
 function checkTestPlanExclusivity(prBody) {
-  if (!TEST_PLAN_UNIT_TESTS_ONLY_RE.test(prBody))
+  const region = testPlanRegion(prBody);
+  if (!TEST_PLAN_UNIT_TESTS_ONLY_RE.test(region))
     return { status: "pass", errors: [] };
-  if (/^-\s*\[[ xX]\]\s*\*{2}\[(?:agent|principal)\]\*{2}/im.test(prBody)) {
+  if (/^-\s*\[[ xX]\]\s*\*{2}\[(?:agent|principal)\]\*{2}/im.test(region)) {
     return {
       status: "fail",
       errors: [
@@ -1708,8 +1739,9 @@ function checkTestPlanExclusivity(prBody) {
   return { status: "pass", errors: [] };
 }
 function checkPrincipalPlaceholder(prBody) {
+  const region = testPlanRegion(prBody);
   const lineRe = /^-\s*\[[ xX]\]\s*\*{2}\[principal\]\*{2}(.*)$/gim;
-  for (const m of prBody.matchAll(lineRe)) {
+  for (const m of region.matchAll(lineRe)) {
     const content = m[1] ?? "";
     if (/^\s*None\b/i.test(content)) {
       return {
@@ -2157,11 +2189,12 @@ function isReviewGateExemptBranch(branch) {
   return branch.startsWith("plan/");
 }
 function checkReviewGate(input) {
+  const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const waived = isWaiverLabelActorVerified({
     label: WAIVER_LABEL_REVIEW,
     labels: input.labels,
     labelActor: input.waiverLabelActor,
-    principalAllowlist: PRINCIPAL_ALLOWLIST
+    principalAllowlist
   });
   if (waived) {
     return {
@@ -2170,8 +2203,8 @@ function checkReviewGate(input) {
       waived: true
     };
   }
-  const verified = input.comments.filter((c) => c.author !== null && PRINCIPAL_ALLOWLIST.includes(c.author));
-  const ignoredCount = input.comments.filter((c) => (c.author === null || !PRINCIPAL_ALLOWLIST.includes(c.author)) && c.body.includes("VERDICT")).length;
+  const verified = input.comments.filter((c) => isPrincipal(c.author, principalAllowlist));
+  const ignoredCount = input.comments.filter((c) => !isPrincipal(c.author, principalAllowlist) && c.body.includes("VERDICT")).length;
   const verifiedBodies = verified.map((c) => c.body);
   const codeReview = extractCodeReviewVerdict(verifiedBodies);
   const security = extractSecurityReviewVerdict(verifiedBodies);
@@ -2724,26 +2757,6 @@ function decideIssueAssignment(input) {
     reason: `First push of \`${branch}\` — assigning Issue #${issue} to @${login} (the authenticated pusher).`
   };
 }
-// ../../../packages/aeg-core/src/test-plan-section.ts
-var HEADING_FORM_RE = /^#{1,4}[ \t]*(?:\d+[a-z]?\.[ \t]*)?\*{0,2}Test Plan\*{0,2}[ \t]*$/im;
-var INLINE_FORM_RE = /^[ \t]*\*{0,2}Test Plan:?\*{0,2}/im;
-var NEXT_SECTION_RE = /\n(?:#{1,3}[ \t]|\*\*[A-Z][^*\n]*:\*\*)/;
-function locateTestPlanSection(body) {
-  const region = anchoredRegion(body, "TEST-PLAN");
-  if (region !== null)
-    return { found: true, section: region };
-  const headingMatch = HEADING_FORM_RE.exec(body);
-  const match = headingMatch ?? INLINE_FORM_RE.exec(body);
-  if (!match || match.index === undefined)
-    return { found: false };
-  const sectionBody = body.slice(match.index);
-  const firstLineEnd = sectionBody.indexOf(`
-`);
-  const searchFrom = firstLineEnd === -1 ? sectionBody.length : firstLineEnd + 1;
-  const nextMatch = sectionBody.slice(searchFrom).match(NEXT_SECTION_RE);
-  const sectionEnd = nextMatch ? searchFrom + (nextMatch.index ?? 0) : sectionBody.length;
-  return { found: true, section: sectionBody.slice(0, sectionEnd) };
-}
 // ../../../packages/aeg-core/src/test-plan-gate.ts
 var TASK_BRANCH_PATTERN = /^task\/[^/]+\/[^/]+$/;
 function evaluateTestPlanGate(body, branch) {