@attalabs/vinaya 0.4.3 → 0.4.5

package/dist/checks/bin/check-test-plan.js

@@ -1448,12 +1448,16 @@ function isCodeFile(p) {
 var WAIVER_LABEL = label("waiver-docs");
 var WAIVER_LABEL_REVIEW = label("waiver-review");
 var PRINCIPAL_ALLOWLIST = ["daniboomerang"];
+function isPrincipal(login, principalAllowlist) {
+  if (login === null)
+    return false;
+  const normalized = login.toLowerCase();
+  return principalAllowlist.some((p) => p.toLowerCase() === normalized);
+}
 function isWaiverLabelActorVerified(opts) {
   if (!opts.labels.includes(opts.label))
     return false;
-  if (opts.labelActor === null)
-    return false;
-  return opts.principalAllowlist.includes(opts.labelActor);
+  return isPrincipal(opts.labelActor, opts.principalAllowlist);
 }
 
 // ../../../packages/aeg-core/src/doc-owners.ts
@@ -1641,6 +1645,27 @@ function overrideActive(opts) {
 // ../../../packages/aeg-core/src/premise-check.ts
 var ASSERTION_KINDS = new Set(["contains", "absent", "sha256"]);
 
+// ../../../packages/aeg-core/src/test-plan-section.ts
+var HEADING_FORM_RE = /^#{1,4}[ \t]*(?:\d+[a-z]?\.[ \t]*)?\*{0,2}Test Plan\*{0,2}[ \t]*$/im;
+var INLINE_FORM_RE = /^[ \t]*\*{0,2}Test Plan:?\*{0,2}/im;
+var NEXT_SECTION_RE = /\n(?:#{1,3}[ \t]|\*\*[A-Z][^*\n]*:\*\*)/;
+function locateTestPlanSection(body) {
+  const region = anchoredRegion(body, "TEST-PLAN");
+  if (region !== null)
+    return { found: true, section: region };
+  const headingMatch = HEADING_FORM_RE.exec(body);
+  const match = headingMatch ?? INLINE_FORM_RE.exec(body);
+  if (!match || match.index === undefined)
+    return { found: false };
+  const sectionBody = body.slice(match.index);
+  const firstLineEnd = sectionBody.indexOf(`
+`);
+  const searchFrom = firstLineEnd === -1 ? sectionBody.length : firstLineEnd + 1;
+  const nextMatch = sectionBody.slice(searchFrom).match(NEXT_SECTION_RE);
+  const sectionEnd = nextMatch ? searchFrom + (nextMatch.index ?? 0) : sectionBody.length;
+  return { found: true, section: sectionBody.slice(0, sectionEnd) };
+}
+
 // ../../../packages/aeg-core/src/brief-validation.ts
 function headerRegion(prBody) {
   const m = prBody.match(/^##\s/m);
@@ -1679,10 +1704,15 @@ function checkTierField(prBody, readTier) {
   };
 }
 var TEST_PLAN_UNIT_TESTS_ONLY_RE = /(?:\*\*)?Test Plan(?:\*\*)?\s*:\s*(?:\*\*)?\s*unit-tests-only/i;
+function testPlanRegion(prBody) {
+  const located = locateTestPlanSection(prBody);
+  return located.found ? located.section : prBody;
+}
 function checkTestPlan(prBody) {
-  if (TEST_PLAN_UNIT_TESTS_ONLY_RE.test(prBody))
+  const region = testPlanRegion(prBody);
+  if (TEST_PLAN_UNIT_TESTS_ONLY_RE.test(region))
     return { status: "pass", errors: [] };
-  if (/\*\*\[(?:agent|principal)\]\*\*/.test(prBody))
+  if (/\*\*\[(?:agent|principal)\]\*\*/.test(region))
     return { status: "pass", errors: [] };
   return {
     status: "fail",
@@ -1692,9 +1722,10 @@ function checkTestPlan(prBody) {
   };
 }
 function checkTestPlanExclusivity(prBody) {
-  if (!TEST_PLAN_UNIT_TESTS_ONLY_RE.test(prBody))
+  const region = testPlanRegion(prBody);
+  if (!TEST_PLAN_UNIT_TESTS_ONLY_RE.test(region))
     return { status: "pass", errors: [] };
-  if (/^-\s*\[[ xX]\]\s*\*{2}\[(?:agent|principal)\]\*{2}/im.test(prBody)) {
+  if (/^-\s*\[[ xX]\]\s*\*{2}\[(?:agent|principal)\]\*{2}/im.test(region)) {
     return {
       status: "fail",
       errors: [
@@ -1705,8 +1736,9 @@ function checkTestPlanExclusivity(prBody) {
   return { status: "pass", errors: [] };
 }
 function checkPrincipalPlaceholder(prBody) {
+  const region = testPlanRegion(prBody);
   const lineRe = /^-\s*\[[ xX]\]\s*\*{2}\[principal\]\*{2}(.*)$/gim;
-  for (const m of prBody.matchAll(lineRe)) {
+  for (const m of region.matchAll(lineRe)) {
     const content = m[1] ?? "";
     if (/^\s*None\b/i.test(content)) {
       return {
@@ -1785,6 +1817,15 @@ function checkClosesN(prBody) {
     errors: ["brief-validation Closes #N: no `Closes #<N>` (or Fixes/Resolves) reference found in the PR body."]
   };
 }
+var BRIEF_SHAPE_MARKERS = [checkSurfaceMap, checkDocUpdateList, checkStopConditions, checkAutonomyClause];
+var TASK_BRANCH_PATTERN = /^task\/[^/]+\/[^/]+$/;
+function isTaskBranch(branch) {
+  return TASK_BRANCH_PATTERN.test(branch);
+}
+function isBriefShaped(prBody) {
+  const stripped = stripCode(prBody);
+  return BRIEF_SHAPE_MARKERS.filter((check) => check(stripped).status === "pass").length >= 2;
+}
 function checkBriefSections(prBody, readTier, options = {}) {
   const { requireClosesN = true } = options;
   const results = [
@@ -2154,11 +2195,12 @@ function isReviewGateExemptBranch(branch) {
   return branch.startsWith("plan/");
 }
 function checkReviewGate(input) {
+  const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const waived = isWaiverLabelActorVerified({
     label: WAIVER_LABEL_REVIEW,
     labels: input.labels,
     labelActor: input.waiverLabelActor,
-    principalAllowlist: PRINCIPAL_ALLOWLIST
+    principalAllowlist
   });
   if (waived) {
     return {
@@ -2167,8 +2209,8 @@ function checkReviewGate(input) {
       waived: true
     };
   }
-  const verified = input.comments.filter((c) => c.author !== null && PRINCIPAL_ALLOWLIST.includes(c.author));
-  const ignoredCount = input.comments.filter((c) => (c.author === null || !PRINCIPAL_ALLOWLIST.includes(c.author)) && c.body.includes("VERDICT")).length;
+  const verified = input.comments.filter((c) => isPrincipal(c.author, principalAllowlist));
+  const ignoredCount = input.comments.filter((c) => !isPrincipal(c.author, principalAllowlist) && c.body.includes("VERDICT")).length;
   const verifiedBodies = verified.map((c) => c.body);
   const codeReview = extractCodeReviewVerdict(verifiedBodies);
   const security = extractSecurityReviewVerdict(verifiedBodies);
@@ -2721,28 +2763,8 @@ function decideIssueAssignment(input) {
     reason: `First push of \`${branch}\` — assigning Issue #${issue} to @${login} (the authenticated pusher).`
   };
 }
-// ../../../packages/aeg-core/src/test-plan-section.ts
-var HEADING_FORM_RE = /^#{1,4}[ \t]*(?:\d+[a-z]?\.[ \t]*)?\*{0,2}Test Plan\*{0,2}[ \t]*$/im;
-var INLINE_FORM_RE = /^[ \t]*\*{0,2}Test Plan:?\*{0,2}/im;
-var NEXT_SECTION_RE = /\n(?:#{1,3}[ \t]|\*\*[A-Z][^*\n]*:\*\*)/;
-function locateTestPlanSection(body) {
-  const region = anchoredRegion(body, "TEST-PLAN");
-  if (region !== null)
-    return { found: true, section: region };
-  const headingMatch = HEADING_FORM_RE.exec(body);
-  const match = headingMatch ?? INLINE_FORM_RE.exec(body);
-  if (!match || match.index === undefined)
-    return { found: false };
-  const sectionBody = body.slice(match.index);
-  const firstLineEnd = sectionBody.indexOf(`
-`);
-  const searchFrom = firstLineEnd === -1 ? sectionBody.length : firstLineEnd + 1;
-  const nextMatch = sectionBody.slice(searchFrom).match(NEXT_SECTION_RE);
-  const sectionEnd = nextMatch ? searchFrom + (nextMatch.index ?? 0) : sectionBody.length;
-  return { found: true, section: sectionBody.slice(0, sectionEnd) };
-}
 // ../../../packages/aeg-core/src/test-plan-gate.ts
-var TASK_BRANCH_PATTERN = /^task\/[^/]+\/[^/]+$/;
+var TASK_BRANCH_PATTERN2 = /^task\/[^/]+\/[^/]+$/;
 function evaluateTestPlanGate(body, branch) {
   if (!body) {
     return {
@@ -2755,7 +2777,7 @@ function evaluateTestPlanGate(body, branch) {
   }
   const located = locateTestPlanSection(body);
   if (!located.found) {
-    if (TASK_BRANCH_PATTERN.test(branch)) {
+    if (TASK_BRANCH_PATTERN2.test(branch)) {
       return {
         verdict: "fail",
         messages: [

package/dist/index.js

@@ -532,6 +532,27 @@ function parsePremiseBlock(prBody) {
   return assertions;
 }
 
+// ../../../packages/aeg-core/src/test-plan-section.ts
+var HEADING_FORM_RE = /^#{1,4}[ \t]*(?:\d+[a-z]?\.[ \t]*)?\*{0,2}Test Plan\*{0,2}[ \t]*$/im;
+var INLINE_FORM_RE = /^[ \t]*\*{0,2}Test Plan:?\*{0,2}/im;
+var NEXT_SECTION_RE = /\n(?:#{1,3}[ \t]|\*\*[A-Z][^*\n]*:\*\*)/;
+function locateTestPlanSection(body) {
+  const region = anchoredRegion(body, "TEST-PLAN");
+  if (region !== null)
+    return { found: true, section: region };
+  const headingMatch = HEADING_FORM_RE.exec(body);
+  const match = headingMatch ?? INLINE_FORM_RE.exec(body);
+  if (!match || match.index === undefined)
+    return { found: false };
+  const sectionBody = body.slice(match.index);
+  const firstLineEnd = sectionBody.indexOf(`
+`);
+  const searchFrom = firstLineEnd === -1 ? sectionBody.length : firstLineEnd + 1;
+  const nextMatch = sectionBody.slice(searchFrom).match(NEXT_SECTION_RE);
+  const sectionEnd = nextMatch ? searchFrom + (nextMatch.index ?? 0) : sectionBody.length;
+  return { found: true, section: sectionBody.slice(0, sectionEnd) };
+}
+
 // ../../../packages/aeg-core/src/brief-validation.ts
 function headerRegion(prBody) {
   const m = prBody.match(/^##\s/m);
@@ -570,10 +591,15 @@ function checkTierField(prBody, readTier) {
   };
 }
 var TEST_PLAN_UNIT_TESTS_ONLY_RE = /(?:\*\*)?Test Plan(?:\*\*)?\s*:\s*(?:\*\*)?\s*unit-tests-only/i;
+function testPlanRegion(prBody) {
+  const located = locateTestPlanSection(prBody);
+  return located.found ? located.section : prBody;
+}
 function checkTestPlan(prBody) {
-  if (TEST_PLAN_UNIT_TESTS_ONLY_RE.test(prBody))
+  const region = testPlanRegion(prBody);
+  if (TEST_PLAN_UNIT_TESTS_ONLY_RE.test(region))
     return { status: "pass", errors: [] };
-  if (/\*\*\[(?:agent|principal)\]\*\*/.test(prBody))
+  if (/\*\*\[(?:agent|principal)\]\*\*/.test(region))
     return { status: "pass", errors: [] };
   return {
     status: "fail",
@@ -583,9 +609,10 @@ function checkTestPlan(prBody) {
   };
 }
 function checkTestPlanExclusivity(prBody) {
-  if (!TEST_PLAN_UNIT_TESTS_ONLY_RE.test(prBody))
+  const region = testPlanRegion(prBody);
+  if (!TEST_PLAN_UNIT_TESTS_ONLY_RE.test(region))
     return { status: "pass", errors: [] };
-  if (/^-\s*\[[ xX]\]\s*\*{2}\[(?:agent|principal)\]\*{2}/im.test(prBody)) {
+  if (/^-\s*\[[ xX]\]\s*\*{2}\[(?:agent|principal)\]\*{2}/im.test(region)) {
     return {
       status: "fail",
       errors: [
@@ -596,8 +623,9 @@ function checkTestPlanExclusivity(prBody) {
   return { status: "pass", errors: [] };
 }
 function checkPrincipalPlaceholder(prBody) {
+  const region = testPlanRegion(prBody);
   const lineRe = /^-\s*\[[ xX]\]\s*\*{2}\[principal\]\*{2}(.*)$/gim;
-  for (const m of prBody.matchAll(lineRe)) {
+  for (const m of region.matchAll(lineRe)) {
     const content = m[1] ?? "";
     if (/^\s*None\b/i.test(content)) {
       return {
@@ -1219,6 +1247,9 @@ function printJson(data) {
 function realDeps2() {
   return { detectRepo: detectGitRepo };
 }
+function defaultSleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
 var COMMAND_TIMEOUT_MS = 20000;
 var DEAD_BRANCH_LABEL = label("dead-branch-push");
 var DEAD_BRANCH_MARKER = `<!-- ${DEAD_BRANCH_LABEL} -->`;
@@ -1364,6 +1395,18 @@ function fetchAssociatedMergedPrs(sha, repoFlag) {
   const prs = JSON.parse(out);
   return prs.filter((pr) => pr.merged_at !== null).map((pr) => pr.number);
 }
+var DIRECT_PUSH_POLL_ATTEMPTS = 6;
+var DIRECT_PUSH_POLL_DELAY_MS = 20000;
+async function pollAssociatedMergedPrs(sha, repoFlag, fetch, attempts, delayMs, sleep) {
+  for (let attempt = 1;attempt <= attempts; attempt++) {
+    const prs = fetch(sha, repoFlag);
+    if (prs.length > 0)
+      return prs;
+    if (attempt < attempts)
+      await sleep(delayMs);
+  }
+  return [];
+}
 function incidentAlreadyOpen(sha, repoFlag) {
   const out = sh2([
     "gh",
@@ -1412,11 +1455,11 @@ function openDirectPushIncident(sha, repoFlag) {
     DIRECT_PUSH_LABEL
   ]);
 }
-function runDirectMainPushCheck(sha, repoFlag) {
-  const associatedMergedPrNumbers = fetchAssociatedMergedPrs(sha, repoFlag);
+async function runDirectMainPushCheck(sha, repoFlag, deps) {
+  const associatedMergedPrNumbers = await pollAssociatedMergedPrs(sha, repoFlag, deps.fetchAssociatedMergedPrs ?? fetchAssociatedMergedPrs, deps.pollAttempts ?? DIRECT_PUSH_POLL_ATTEMPTS, deps.pollDelayMs ?? DIRECT_PUSH_POLL_DELAY_MS, deps.sleep ?? defaultSleep);
   const result = checkDirectMainPush({ sha, associatedMergedPrNumbers });
   if (result.verdict === "direct-push") {
-    openDirectPushIncident(sha, repoFlag);
+    (deps.openDirectPushIncident ?? openDirectPushIncident)(sha, repoFlag);
     return { verdict: "direct-push" };
   }
   return { verdict: "legitimate", mergedPrNumber: result.mergedPrNumber };
@@ -1452,7 +1495,7 @@ async function runAudit(args, deps) {
   const repoFlag = `${repo.owner}/${repo.repo}`;
   const sha = parseSha(args) ?? sh2(["git", "rev-parse", "HEAD"]);
   const deadBranch = only === "direct-push" ? { scanned: 0, findings: [] } : runDeadBranchAudit(repoFlag);
-  const directPush = only === "dead-branches" ? null : runDirectMainPushCheck(sha, repoFlag);
+  const directPush = only === "dead-branches" ? null : await runDirectMainPushCheck(sha, repoFlag, deps);
   const failed = directPush?.verdict === "direct-push";
   if (jsonOutput) {
     printJson({
@@ -1531,7 +1574,10 @@ function coreCheckRegistry() {
       run: bin("check-brief-shape"),
       scope: "diff",
       timeoutMs: 15000,
-      env: { PR_BODY: { optional: true } }
+      env: {
+        PR_BODY: { optional: true },
+        BRANCH: { optional: true }
+      }
     },
     {
       name: "doc-coverage",
@@ -1543,7 +1589,10 @@ function coreCheckRegistry() {
         PR_BODY: { optional: true },
         PR_BODY_FILE: { optional: true },
         PR_LABELS: { optional: true },
-        WAIVER_LABEL_ACTOR: { optional: true }
+        WAIVER_LABEL_ACTOR: { optional: true },
+        GITHUB_REPOSITORY: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
       }
     },
     {
@@ -1575,6 +1624,7 @@ function coreCheckRegistry() {
       run: bin("check-closes-n"),
       scope: "diff",
       timeoutMs: 15000,
+      requiresOpenPr: true,
       env: {
         BRANCH: { optional: true },
         PR_BODY: { optional: true },
@@ -1600,6 +1650,7 @@ function coreCheckRegistry() {
       run: bin("check-test-plan"),
       scope: "diff",
       timeoutMs: 15000,
+      requiresOpenPr: true,
       env: {
         PR_BODY: { optional: true },
         BRANCH: { optional: true }
@@ -1631,6 +1682,7 @@ function coreCheckRegistry() {
       env: {
         BRANCH: { optional: true },
         PR_NUMBER: { optional: true },
+        GITHUB_REPOSITORY: { optional: true },
         GITHUB_TOKEN: { optional: true },
         GH_TOKEN: { optional: true }
       }
@@ -1681,7 +1733,10 @@ function coreCheckRegistry() {
         PR_BODY: { optional: true },
         PR_BODY_FILE: { optional: true },
         PR_LABELS: { optional: true },
-        WAIVER_LABEL_ACTOR: { optional: true }
+        WAIVER_LABEL_ACTOR: { optional: true },
+        GITHUB_REPOSITORY: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
       }
     },
     {
@@ -1760,6 +1815,8 @@ function isCheckError(value) {
   return v.schema === CHECK_SCHEMA_VERSION && typeof v.check === "string" && (v.severity === "error" || v.severity === "warning") && typeof v.message === "string" && typeof v.agent_recovery_prompt === "string";
 }
 function shouldSkip(spec, opts) {
+  if (opts.localOnly && spec.requiresOpenPr)
+    return true;
   if (spec.scope !== "diff")
     return false;
   if (!opts.diffOnly)
@@ -2020,7 +2077,8 @@ var CheckEntrySchema = z.object({
   include: z.array(z.string()).optional(),
   args: z.array(z.string()).optional(),
   timeoutMs: z.number().optional(),
-  env: z.record(z.string(), EnvEntrySchema).optional()
+  env: z.record(z.string(), EnvEntrySchema).optional(),
+  requiresOpenPr: z.boolean().optional()
 }).superRefine((entry2, ctx) => {
   if (!entry2.env)
     return;
@@ -2127,7 +2185,8 @@ var VinayaConfigSchema = z.object({
   }).optional(),
   checks: z.record(z.string(), CheckEntrySchema).optional(),
   briefSchema: BriefSchemaSchema.optional(),
-  managed: ManagedManifestSchema.optional()
+  managed: ManagedManifestSchema.optional(),
+  principals: z.array(z.string()).min(1).optional()
 });
 var GLOBAL_VINAYA_HOME = join4(homedir(), ".vinaya");
 var GLOBAL_CONFIG_PATH = join4(GLOBAL_VINAYA_HOME, "config.json");
@@ -2155,11 +2214,22 @@ function configPath() {
 function globalChecksIgnoredWarning(path) {
   return `${path}: "checks" registration in the global config is ignored — checks may only be registered from a repo-local vinaya.config.json.`;
 }
-function stripGlobalChecks(config, path) {
-  if (path !== GLOBAL_CONFIG_PATH || !config.checks || Object.keys(config.checks).length === 0)
+function globalPrincipalsIgnoredWarning(path) {
+  return `${path}: "principals" in the global config is ignored — principals may only be declared from a repo-local vinaya.config.json.`;
+}
+function stripGlobalOnlyKeys(config, path) {
+  if (path !== GLOBAL_CONFIG_PATH)
     return config;
-  console.error(`⚠ ${globalChecksIgnoredWarning(path)}`);
-  return { ...config, checks: undefined };
+  let result = config;
+  if (result.checks && Object.keys(result.checks).length > 0) {
+    console.error(`⚠ ${globalChecksIgnoredWarning(path)}`);
+    result = { ...result, checks: undefined };
+  }
+  if (result.principals && result.principals.length > 0) {
+    console.error(`⚠ ${globalPrincipalsIgnoredWarning(path)}`);
+    result = { ...result, principals: undefined };
+  }
+  return result;
 }
 function loadConfigChecked() {
   const path = configPath();
@@ -2176,7 +2246,7 @@ function loadConfigChecked() {
     const detail = parsed.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
     return { ok: false, path, error: detail };
   }
-  return { ok: true, config: stripGlobalChecks(parsed.data, path) };
+  return { ok: true, config: stripGlobalOnlyKeys(parsed.data, path) };
 }
 
 // src/commands/check.ts
@@ -2301,6 +2371,7 @@ function printClassificationWarnings(configChecks) {
 async function checkCommand(args) {
   const jsonOutput = args.includes("--json");
   const diffOnly = args.includes("--diff-only");
+  const localOnly = args.includes("--local");
   const requestedParallel = parseParallel(args);
   const allRequested = args.includes("--all");
   const planRequested = args.includes("--plan");
@@ -2318,7 +2389,7 @@ async function checkCommand(args) {
     process.exit(result.failures.length > 0 ? 1 : 0);
   }
   if (!allRequested && !requestedName) {
-    console.error("Usage: vinaya check <name> | --all | --plan [--json] [--diff-only] [--parallel[=n]]");
+    console.error("Usage: vinaya check <name> | --all | --plan [--json] [--diff-only] [--local] [--parallel[=n]]");
     process.exit(2);
   }
   const { specs: customSpecs, errorOutcome, checks: configChecks } = customSpecsFromConfig();
@@ -2333,7 +2404,8 @@ async function checkCommand(args) {
     parallel: requestedParallel ?? defaultParallelism(),
     diffOnly,
     changedFiles: changed,
-    defaultTimeoutMs: 30000
+    defaultTimeoutMs: 30000,
+    localOnly
   }) : [];
   const allOutcomes = errorOutcome ? [...outcomes, errorOutcome] : outcomes;
   for (const o of allOutcomes) {
@@ -2566,8 +2638,9 @@ async function demoBreakCommand(args) {
 }
 
 // src/commands/doctor.ts
+import { execFileSync as execFileSync6 } from "node:child_process";
 import { existsSync as existsSync8, readFileSync as readFileSync6, statSync } from "node:fs";
-import { join as join8 } from "node:path";
+import { isAbsolute as isAbsolute2, join as join8 } from "node:path";
 
 // src/lib/artifacts.ts
 import { readFileSync as readFileSync3 } from "node:fs";
@@ -2608,7 +2681,7 @@ name: Vinaya Checks
 
 on:
   pull_request:
-    types: [opened, synchronize, reopened]
+    types: [opened, synchronize, reopened, edited]
 
 jobs:
   vinaya-checks:
@@ -2629,6 +2702,11 @@ jobs:
         env:
           GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: \${{ github.event.pull_request.number }}
+          # PR_BODY is what makes test-plan/closes-n EVALUATE: neither check
+          # fetches the body itself (both read \`process.env.PR_BODY\` only) —
+          # without it they read "no body — nothing to check" and pass
+          # vacuously regardless of the PR's real content, on every run.
+          PR_BODY: \${{ github.event.pull_request.body }}
           BRANCH: \${{ github.head_ref }}
         run: npx --yes @attalabs/vinaya check --all --diff-only
 `;
@@ -2676,7 +2754,7 @@ jobs:
           # the gate is green regardless of review state.
           PR_NUMBER: \${{ github.event.pull_request.number }}
           BRANCH: \${{ github.head_ref }}
-        run: npx --yes @attalabs/vinaya check --all
+        run: npx --yes @attalabs/vinaya check review-gate
 `;
 }
 function reviewVerdictWorkflow() {
@@ -2861,11 +2939,11 @@ function ownVersion() {
 function preCommitBody() {
   return `# Vinaya commit-time gate. Runs the deterministic checks over your staged
 # diff before the commit lands.
-npx --yes @attalabs/vinaya@${ownVersion()} check --all --diff-only || exit 1`;
+npx --yes @attalabs/vinaya@${ownVersion()} check --all --diff-only --local || exit 1`;
 }
 function prePushBody() {
   return `# Vinaya pre-push gate. Runs branch/dispatch checks before the push leaves.
-npx --yes @attalabs/vinaya@${ownVersion()} check --all || exit 1`;
+npx --yes @attalabs/vinaya@${ownVersion()} check --all --local || exit 1`;
 }
 function doctrinePointer() {
   const doctrineRoot = join6(packageRoot(import.meta.url), "aeg-root");
@@ -3446,6 +3524,19 @@ function labelForPath(path) {
     return "doctrine-pointer";
   return "workflows";
 }
+function resolveManagedBlockPath(repoRoot, opPath) {
+  if (!opPath.startsWith(".git/"))
+    return join8(repoRoot, opPath);
+  try {
+    const commonDir = execFileSync6("git", ["-C", repoRoot, "rev-parse", "--git-common-dir"], {
+      encoding: "utf8"
+    }).trim();
+    const gitDir = isAbsolute2(commonDir) ? commonDir : join8(repoRoot, commonDir);
+    return join8(gitDir, opPath.slice(".git/".length));
+  } catch {
+    return join8(repoRoot, opPath);
+  }
+}
 function diagnoseInstall(repoRoot, ctx, manifest) {
   const findings = [];
   let hasDrift = false;
@@ -3479,7 +3570,7 @@ function diagnoseInstall(repoRoot, ctx, manifest) {
       }
     } else if (op.kind === "managed-block") {
       const check = "hooks";
-      const abs2 = join8(repoRoot, op.path);
+      const abs2 = resolveManagedBlockPath(repoRoot, op.path);
       const owned = ownedBlocks.has(blockKey(op.path, op.marker));
       if (!existsSync8(abs2)) {
         findings.push(owned ? error(check, `${op.path} is missing — likely a fresh clone (raw git hooks aren't tracked by git). Run \`vinaya upgrade\` to restore it.`) : info(check, `${op.path} is not installed.`));
@@ -4030,7 +4121,7 @@ async function initProductCommand(args) {
 }
 
 // src/commands/issue.ts
-import { execFileSync as execFileSync6 } from "node:child_process";
+import { execFileSync as execFileSync7 } from "node:child_process";
 
 // src/lib/forge-write.ts
 import { mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "node:fs";
@@ -4243,7 +4334,7 @@ function locateBodyOrRefuse(ghArgs, retryCommand) {
 function fetchForgeLabels(issueRef) {
   let out;
   try {
-    out = execFileSync6("gh", ["issue", "view", issueRef, "--json", "labels"], {
+    out = execFileSync7("gh", ["issue", "view", issueRef, "--json", "labels"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -4271,7 +4362,7 @@ function reportPass(json, command) {
 function runGhWrite(ghCmd, ghArgs, bodyResult, json) {
   const { finalArgs, cleanup: cleanup2 } = resolveShippableArgs(ghArgs, bodyResult);
   try {
-    const out = execFileSync6("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
+    const out = execFileSync7("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
     const url = out.trim();
     if (json)
       printJson({ validated: true, written: true, url });
@@ -4375,12 +4466,12 @@ ${registration}
 }
 
 // src/commands/pr.ts
-import { execFileSync as execFileSync7 } from "node:child_process";
+import { execFileSync as execFileSync8 } from "node:child_process";
 var RETRY_CREATE2 = "vinaya pr create --validate-only …";
 var RETRY_EDIT2 = "vinaya pr edit <n> --validate-only …";
 function git2(args) {
   try {
-    return execFileSync7("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync8("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return "";
   }
@@ -4414,7 +4505,7 @@ function reportPass2(json, command) {
 function runGhWrite2(ghCmd, ghArgs, bodyResult, json) {
   const { finalArgs, cleanup: cleanup2 } = resolveShippableArgs(ghArgs, bodyResult);
   try {
-    const out = execFileSync7("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
+    const out = execFileSync8("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
     const url = out.trim();
     if (json)
       printJson({ validated: true, written: true, url });
@@ -4428,7 +4519,7 @@ function runGhWrite2(ghCmd, ghArgs, bodyResult, json) {
 function fetchPrForgeContext(prRef) {
   let viewOut;
   try {
-    viewOut = execFileSync7("gh", ["pr", "view", prRef, "--json", "headRefName,files"], {
+    viewOut = execFileSync8("gh", ["pr", "view", prRef, "--json", "headRefName,files"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -4524,7 +4615,7 @@ function prEditCommand(args) {
 }
 
 // src/commands/quickstart.ts
-import { execFileSync as execFileSync8 } from "node:child_process";
+import { execFileSync as execFileSync9 } from "node:child_process";
 import { existsSync as existsSync14, readFileSync as readFileSync13 } from "node:fs";
 import { join as join15 } from "node:path";
 
@@ -4718,7 +4809,7 @@ function realDeps6() {
   };
 }
 function execGit(repoRoot, args) {
-  return execFileSync8("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+  return execFileSync9("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 function errorDetail(err) {
   const stderr = err.stderr;
@@ -5174,12 +5265,12 @@ async function upgradeCommand(args) {
 }
 
 // src/commands/waiver.ts
-import { execFileSync as execFileSync9 } from "node:child_process";
+import { execFileSync as execFileSync10 } from "node:child_process";
 function labelFor(kind) {
   return kind === "docs" ? WAIVER_LABEL : WAIVER_LABEL_REVIEW;
 }
 function gh(args) {
-  return execFileSync9("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: process.env }).trim();
+  return execFileSync10("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: process.env }).trim();
 }
 function detectPrNumber() {
   try {
@@ -5279,8 +5370,8 @@ Reason: ${reason}`];
   }
   process.stdout.write(`Applying \`${label2}\` to PR #${prNumber} under your authenticated \`gh\` identity — vinaya never fabricates an actor.
 `);
-  execFileSync9("gh", editArgs, { stdio: "inherit", env: process.env });
-  execFileSync9("gh", commentArgs, { stdio: "inherit", env: process.env });
+  execFileSync10("gh", editArgs, { stdio: "inherit", env: process.env });
+  execFileSync10("gh", commentArgs, { stdio: "inherit", env: process.env });
   process.stdout.write(`
 ✓ Label applied and reason posted as a PR comment.
 `);
@@ -5337,6 +5428,10 @@ var COMMANDS = [
       { flag: "--all", description: "Run every registered check instead of one named check" },
       { flag: "--json", description: "Enveloped JSON output (schema: 1)" },
       { flag: "--diff-only", description: "Scope diff-declared checks to changed files" },
+      {
+        flag: "--local",
+        description: "Skip every requiresOpenPr check (closes-n, test-plan) — set by the generated hooks, never by CI"
+      },
       { flag: "--parallel[=n]", description: "Concurrency cap (default: cpu-derived)" },
       {
         flag: "--plan",
@@ -5345,7 +5440,8 @@ var COMMANDS = [
     ],
     details: [
       "Each spawned check's child process sees only a fixed baseline (`PATH`, `LANG`, `HOME`, `HTTPS_PROXY`, `HTTP_PROXY`, `NO_PROXY`, `TMPDIR`) plus whatever its `CheckSpec['env']` declaration explicitly forwards — never the full parent environment. A required (`true`) or unsatisfied `anyOf` declaration missing from the caller's environment synthesizes a `CheckError` before the check ever spawns. Declare `env` (a core check's own registration, or `vinaya.config.json`'s `checks.<name>.env` for a custom one) for any check that reads `process.env`/`Bun.env`/`Deno.env` directly — `vinaya doctor` carries the permanent diagnostic for one that doesn't.",
-      "`--plan` composes with `--json`. It requires zero env vars and never prints an env value — only how each one resolves (passthrough, optional, literal, or anyOf). A `FAIL_CLOSED` entry (a bare key with no namespace matching no core check) always renders inline rather than being dropped, and exits non-zero. `--plan` previews what the next minor's execution will enforce — `vinaya check` itself still runs the flat, unvalidated registry this release."
+      "`--plan` composes with `--json`. It requires zero env vars and never prints an env value — only how each one resolves (passthrough, optional, literal, or anyOf). A `FAIL_CLOSED` entry (a bare key with no namespace matching no core check) always renders inline rather than being dropped, and exits non-zero. `--plan` previews what the next minor's execution will enforce — `vinaya check` itself still runs the flat, unvalidated registry this release.",
+      "`--local` exists because a `requiresOpenPr` check (the core `closes-n`/`test-plan`, or a custom check declaring the same field) can only evaluate for real once a pull request exists — the generated `pre-commit`/`pre-push` hooks pass it so the first commit on a fresh task branch is never asked to satisfy a PR-body field before a PR can possibly exist. CI's `vinaya-checks.yml` omits it, so these checks always run for real once a PR is open."
     ],
     status: "shipped"
   },
@@ -5459,7 +5555,7 @@ var COMMANDS = [
       { flag: "--json", description: "Enveloped JSON output" }
     ],
     details: [
-      "Dead-branch-push is never-red — a notification channel that flags (label + PR comment) any `task/*` branch whose tip commit lands after its own PR already resolved. Direct-main-push is a real pass/fail — it opens an incident Issue and exits 1 if a commit on `main` has no associated merged PR.",
+      "Dead-branch-push is never-red — a notification channel that flags (label + PR comment) any `task/*` branch whose tip commit lands after its own PR already resolved. Direct-main-push is a real pass/fail — it polls the merge-association API for up to ~100s before deciding, then opens an incident Issue and exits 1 if a commit on `main` genuinely has no associated merged PR.",
       "The same logic the generated `vinaya-archivist.yml` workflow's `daily-drift` and `direct-main-push-detection` jobs run on schedule / on every push to `main` — callable directly for a one-off run or local verification."
     ],
     status: "shipped"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@attalabs/vinaya",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "description": "Vinaya — Agentic Engineering Harness. Deterministic checks every AI coding agent must satisfy before merge.",
   "type": "module",
   "license": "Apache-2.0",