@attalabs/vinaya 0.8.0 → 0.8.2

package/dist/checks/bin/check-coherence.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 // src/checks/bin/check-coherence.ts
-import { execFile as execFile4, execFileSync as execFileSync2 } from "node:child_process";
+import { execFile as execFile4, execFileSync as execFileSync3 } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { join as join2 } from "node:path";
 import { promisify as promisify4 } from "node:util";
 // ../../packages/aeg-core/src/anchored-region.ts
 function maskCode(body) {
@@ -1221,7 +1221,8 @@ function mapForgeFacts(raw) {
     reviewDecision: mapReviewDecision(raw.pullRequest?.reviewDecision),
     stateReason: mapStateReason(raw.issue.stateReason),
     closedAt: raw.issue.closedAt ?? null,
-    mergedAt: raw.pullRequest?.mergedAt ?? null
+    mergedAt: raw.pullRequest?.mergedAt ?? null,
+    closedByActor: raw.closedByActor ?? null
   };
 }
 function mapStateReason(reason) {
@@ -1314,6 +1315,7 @@ function buildBatchQuery(tranche, tasks) {
       timelineItems(last: 1, itemTypes: [CLOSED_EVENT]) {
         nodes {
           ... on ClosedEvent {
+            actor { login }
             closer {
               ... on PullRequest {
                 number
@@ -1351,7 +1353,8 @@ function extractRawFromResponse(repository, alias) {
   const issue = repository[`${alias}_issue`];
   const ref = repository[`${alias}_ref`];
   const prs = repository[`${alias}_prs`];
-  const rawCloser = issue?.timelineItems?.nodes?.[0]?.closer ?? null;
+  const timelineNode = issue?.timelineItems?.nodes?.[0];
+  const rawCloser = timelineNode?.closer ?? null;
   const closingPr = rawCloser && typeof rawCloser.number === "number" && typeof rawCloser.url === "string" ? rawCloser : null;
   const branchPr = prs && prs.nodes.length > 0 && prs.nodes[0] ? prs.nodes[0] : null;
   return {
@@ -1363,7 +1366,8 @@ function extractRawFromResponse(repository, alias) {
       labels: issue.labels.nodes.map((n) => n.name)
     } : null,
     refExists: Boolean(ref && ref.name.length > 0),
-    pullRequest: closingPr ?? branchPr
+    pullRequest: closingPr ?? branchPr,
+    closedByActor: timelineNode?.actor?.login ?? null
   };
 }
 function describeError(err) {
@@ -1501,6 +1505,11 @@ var FORGE_FACT_INPUTS = [
     fact: "mergedAt",
     readsFrom: "PullRequest.mergedAt",
     meaning: "Timestamp for the coherence oracle grandfather cutoff. No derivation rule reads it."
+  },
+  {
+    fact: "closedByActor",
+    readsFrom: "ClosedEvent.actor.login (most recent timeline CLOSED_EVENT)",
+    meaning: "GitHub login that hand-closed the Issue. No task-status derivation rule reads it — it is consumed by dispatch-gate.ts/coherence-checks.ts A1 to recognize a hand-closed dependency as resolved (task vinaya-engine-v1 21, #99), not by this status model."
   }
 ];
 var DERIVED_STATUSES = [
@@ -1980,7 +1989,7 @@ function isGrandfathered(isoDate) {
   return isoDate.slice(0, 10) < COHERENCE_ENFORCED_FROM;
 }
 var R1_GRANDFATHERED_ISSUES = new Set([279, 280, 281, 282]);
-function checkA1(entries) {
+function checkA1(entries, principalAllowlist = PRINCIPAL_ALLOWLIST) {
   const failures = [];
   for (const e of entries) {
     if (!e.facts)
@@ -1988,6 +1997,9 @@ function checkA1(entries) {
     if (e.facts.stateReason === "not_planned")
       continue;
     if (e.facts.issueState === "closed" && e.facts.prState !== "merged") {
+      const handClosed = e.facts.stateReason === "completed" && isPrincipal(e.facts.closedByActor, principalAllowlist);
+      if (handClosed)
+        continue;
       failures.push({
         issue: e.task.issue,
         tranche: e.trancheSlug,
@@ -2677,9 +2689,13 @@ function parseGlossaryTerms(glossaryContent) {
   return terms;
 }
 // ../../packages/aeg-core/src/dispatch-gate.ts
+function isHandClosedByRecognizedPrincipal(dep, principalAllowlist) {
+  return dep.issueState === "closed" && dep.stateReason === "completed" && isPrincipal(dep.closedByActor ?? null, principalAllowlist);
+}
 function checkDispatchReadiness(input) {
   const { trancheSlug, task } = input;
   const taskLabel = `task ${task.id} (tranche ${trancheSlug})`;
+  const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const blockers = [];
   if (task.issue === null) {
     blockers.push(`dispatch-gate issue-existence: ${taskLabel} has no Issue (#TBD or blank) in the topology — not dispatchable until the Planner cuts the Issue.`);
@@ -2690,7 +2706,7 @@ function checkDispatchReadiness(input) {
     blockers.push(`dispatch-gate rationale: Issue #${input.issue.number} for ${taskLabel} fails the rationale gate (checkIssueRationale) — the Planner must complete the eight-field rationale before this task is dispatchable.`);
   }
   for (const dep of input.dependsOn) {
-    if (!dep.merged) {
+    if (!dep.merged && !isHandClosedByRecognizedPrincipal(dep, principalAllowlist)) {
       const issueStr = dep.issue !== null ? ` (#${dep.issue})` : "";
       blockers.push(`dispatch-gate depends-on: ${taskLabel} depends on ${dep.id}${issueStr}, whose PR is not merged yet — not dispatchable, it serializes behind it.`);
     }
@@ -2946,12 +2962,186 @@ function emitCheckError(error) {
 `);
 }
 
+// src/lib/config.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { z as z2 } from "zod";
+var EnvEntrySchema = z2.union([
+  z2.literal(true),
+  z2.object({ optional: z2.literal(true) }),
+  z2.object({ anyOf: z2.array(z2.string()).min(2) }),
+  z2.string()
+]);
+var CheckEntrySchema = z2.object({
+  run: z2.string(),
+  scope: z2.enum(["diff", "full"]),
+  include: z2.array(z2.string()).optional(),
+  args: z2.array(z2.string()).optional(),
+  timeoutMs: z2.number().optional(),
+  env: z2.record(z2.string(), EnvEntrySchema).optional(),
+  requiresOpenPr: z2.boolean().optional(),
+  ownWorkflow: z2.boolean().optional()
+}).superRefine((entry2, ctx) => {
+  if (!entry2.env)
+    return;
+  for (const [key, value] of Object.entries(entry2.env)) {
+    if (typeof value !== "object" || value === null || !("anyOf" in value))
+      continue;
+    const members = value.anyOf;
+    if (new Set(members).size !== members.length) {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        message: `env.${key}.anyOf has duplicate members`,
+        path: ["env", key, "anyOf"]
+      });
+    }
+    if (!members.includes(key)) {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        message: `env.${key}.anyOf must include "${key}" itself as a member`,
+        path: ["env", key, "anyOf"]
+      });
+    }
+  }
+});
+var BRIEF_BUILTINS = [
+  "tier",
+  "testPlan",
+  "testPlanExclusivity",
+  "principalPlaceholder",
+  "surfaceMap",
+  "docUpdateList",
+  "worktreeStep0",
+  "stopConditions",
+  "autonomyClause",
+  "project",
+  "for",
+  "closesN",
+  "premiseCoverage",
+  "issueRationale"
+];
+var BriefSectionSchema = z2.union([
+  z2.object({ builtin: z2.enum(BRIEF_BUILTINS) }),
+  z2.object({ heading: z2.string().min(1), name: z2.string().optional() }),
+  z2.object({ field: z2.string().min(1), name: z2.string().optional() }),
+  z2.object({ phrase: z2.string().min(1), name: z2.string().optional() })
+]);
+var BriefSchemaSchema = z2.object({
+  pr: z2.object({ sections: z2.array(BriefSectionSchema) }).optional(),
+  issue: z2.object({ sections: z2.array(BriefSectionSchema) }).optional()
+});
+function isSafeRepoRelPath(p) {
+  if (p.length === 0)
+    return false;
+  if (p.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(p))
+    return false;
+  return p.split(/[\\/]/).every((seg) => seg !== ".." && seg !== "");
+}
+var SafeRepoRelPath = z2.string().refine(isSafeRepoRelPath, {
+  message: "must be a repo-root-relative path with no `..` segment or absolute root"
+});
+var ManagedBlockRecordSchema = z2.object({
+  path: SafeRepoRelPath,
+  marker: z2.string(),
+  comment: z2.enum(["hash", "html"])
+});
+var ManagedManifestSchema = z2.object({
+  version: z2.number().int().positive(),
+  files: z2.array(SafeRepoRelPath),
+  blocks: z2.array(ManagedBlockRecordSchema),
+  labels: z2.array(z2.string())
+});
+var VinayaConfigSchema = z2.object({
+  rings: z2.object({
+    ring1_forgeWriteInterception: z2.boolean(),
+    ring2_asyncAudits: z2.boolean()
+  }).optional(),
+  checks: z2.record(z2.string(), CheckEntrySchema).optional(),
+  briefSchema: BriefSchemaSchema.optional(),
+  managed: ManagedManifestSchema.optional(),
+  principals: z2.array(z2.string()).min(1).optional(),
+  ci: z2.object({ setup: z2.string().min(1) }).optional()
+});
+var GLOBAL_VINAYA_HOME = join(homedir(), ".vinaya");
+var GLOBAL_CONFIG_PATH = join(GLOBAL_VINAYA_HOME, "config.json");
+var LOCAL_CONFIG_FILENAME = "vinaya.config.json";
+function resolvePrincipalAllowlist(config) {
+  return config?.principals ?? PRINCIPAL_ALLOWLIST;
+}
+function trustAnchorRepo() {
+  const wellFormed = (slug) => /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
+  const fromRunner = process.env.GITHUB_REPOSITORY?.trim();
+  if (fromRunner) {
+    const validated = wellFormed(fromRunner);
+    if (validated)
+      return validated;
+  }
+  try {
+    const url = execFileSync2("git", ["remote", "get-url", "origin"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+    const m = url.match(/github\.com[:/]([^/]+)\/(.+?)(?:\.git)?\/?$/);
+    return m?.[1] && m[2] ? wellFormed(`${m[1]}/${m[2]}`) : null;
+  } catch {
+    return null;
+  }
+}
+function ghFetchTrustAnchorConfig() {
+  const repo = trustAnchorRepo();
+  if (!repo)
+    throw new Error("could not resolve repo identity for the trust-anchor read");
+  return execFileSync2("gh", ["api", `repos/${repo}/contents/${LOCAL_CONFIG_FILENAME}`, "--jq", ".content"], {
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+}
+function firstLine(err) {
+  return err?.message?.split(`
+`)[0] ?? "unknown error";
+}
+function isMissingFileError(err) {
+  const stderr = err?.stderr;
+  const haystack = [
+    err?.message ?? "",
+    typeof stderr === "string" ? stderr : stderr?.toString() ?? ""
+  ].join(`
+`);
+  return /\b404\b|not found/i.test(haystack);
+}
+function loadTrustAnchorConfig(fetcher = ghFetchTrustAnchorConfig) {
+  const warn = (why) => process.stdout.write(`⚠ could not read \`principals\` from the default branch (${why}) — falling back to vinaya's built-in principal allowlist.
+`);
+  let base64;
+  try {
+    base64 = fetcher().trim();
+  } catch (err) {
+    if (!isMissingFileError(err))
+      warn(firstLine(err));
+    return null;
+  }
+  if (!base64)
+    return null;
+  try {
+    const raw = Buffer.from(base64, "base64").toString("utf-8");
+    const parsed = VinayaConfigSchema.safeParse(JSON.parse(raw));
+    if (parsed.success)
+      return parsed.data;
+    warn("it did not satisfy the config schema");
+    return null;
+  } catch {
+    warn("it was not readable as JSON");
+    return null;
+  }
+}
+
 // src/checks/bin/check-coherence.ts
 var CHECK_NAME = "coherence";
 var execFileAsync4 = promisify4(execFile4);
 function git(args) {
   try {
-    return execFileSync2("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync3("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch {
     return "";
   }
@@ -2960,7 +3150,7 @@ function readRegisteredProjectNames() {
   const root = git(["rev-parse", "--show-toplevel"]);
   if (!root)
     return [];
-  const path = join(root, ".vinaya/projects.md");
+  const path = join2(root, ".vinaya/projects.md");
   if (!existsSync(path))
     return [];
   return parseRegistry(readFileSync(path, "utf8")).map((p) => p.name);
@@ -3086,7 +3276,7 @@ async function main() {
     task: t,
     facts: snapshot.facts.get(t.id)
   }));
-  results.push(checkA1(enrichedEntries));
+  results.push(checkA1(enrichedEntries, resolvePrincipalAllowlist(loadTrustAnchorConfig())));
   results.push(checkA3(enrichedEntries));
   results.push(checkT1(enrichedEntries));
   results.push(checkD1(enrichedEntries, issueToEntry(enrichedEntries), taskToEntry(enrichedEntries, slug)));

package/dist/checks/bin/check-dead-branch-push.js

@@ -1218,7 +1218,8 @@ function mapForgeFacts(raw) {
     reviewDecision: mapReviewDecision(raw.pullRequest?.reviewDecision),
     stateReason: mapStateReason(raw.issue.stateReason),
     closedAt: raw.issue.closedAt ?? null,
-    mergedAt: raw.pullRequest?.mergedAt ?? null
+    mergedAt: raw.pullRequest?.mergedAt ?? null,
+    closedByActor: raw.closedByActor ?? null
   };
 }
 function mapStateReason(reason) {
@@ -1311,6 +1312,7 @@ function buildBatchQuery(tranche, tasks) {
       timelineItems(last: 1, itemTypes: [CLOSED_EVENT]) {
         nodes {
           ... on ClosedEvent {
+            actor { login }
             closer {
               ... on PullRequest {
                 number
@@ -1348,7 +1350,8 @@ function extractRawFromResponse(repository, alias) {
   const issue = repository[`${alias}_issue`];
   const ref = repository[`${alias}_ref`];
   const prs = repository[`${alias}_prs`];
-  const rawCloser = issue?.timelineItems?.nodes?.[0]?.closer ?? null;
+  const timelineNode = issue?.timelineItems?.nodes?.[0];
+  const rawCloser = timelineNode?.closer ?? null;
   const closingPr = rawCloser && typeof rawCloser.number === "number" && typeof rawCloser.url === "string" ? rawCloser : null;
   const branchPr = prs && prs.nodes.length > 0 && prs.nodes[0] ? prs.nodes[0] : null;
   return {
@@ -1360,7 +1363,8 @@ function extractRawFromResponse(repository, alias) {
       labels: issue.labels.nodes.map((n) => n.name)
     } : null,
     refExists: Boolean(ref && ref.name.length > 0),
-    pullRequest: closingPr ?? branchPr
+    pullRequest: closingPr ?? branchPr,
+    closedByActor: timelineNode?.actor?.login ?? null
   };
 }
 function describeError(err) {
@@ -1498,6 +1502,11 @@ var FORGE_FACT_INPUTS = [
     fact: "mergedAt",
     readsFrom: "PullRequest.mergedAt",
     meaning: "Timestamp for the coherence oracle grandfather cutoff. No derivation rule reads it."
+  },
+  {
+    fact: "closedByActor",
+    readsFrom: "ClosedEvent.actor.login (most recent timeline CLOSED_EVENT)",
+    meaning: "GitHub login that hand-closed the Issue. No task-status derivation rule reads it — it is consumed by dispatch-gate.ts/coherence-checks.ts A1 to recognize a hand-closed dependency as resolved (task vinaya-engine-v1 21, #99), not by this status model."
   }
 ];
 var DERIVED_STATUSES = [
@@ -1977,7 +1986,7 @@ function isGrandfathered(isoDate) {
   return isoDate.slice(0, 10) < COHERENCE_ENFORCED_FROM;
 }
 var R1_GRANDFATHERED_ISSUES = new Set([279, 280, 281, 282]);
-function checkA1(entries) {
+function checkA1(entries, principalAllowlist = PRINCIPAL_ALLOWLIST) {
   const failures = [];
   for (const e of entries) {
     if (!e.facts)
@@ -1985,6 +1994,9 @@ function checkA1(entries) {
     if (e.facts.stateReason === "not_planned")
       continue;
     if (e.facts.issueState === "closed" && e.facts.prState !== "merged") {
+      const handClosed = e.facts.stateReason === "completed" && isPrincipal(e.facts.closedByActor, principalAllowlist);
+      if (handClosed)
+        continue;
       failures.push({
         issue: e.task.issue,
         tranche: e.trancheSlug,
@@ -2674,9 +2686,13 @@ function parseGlossaryTerms(glossaryContent) {
   return terms;
 }
 // ../../packages/aeg-core/src/dispatch-gate.ts
+function isHandClosedByRecognizedPrincipal(dep, principalAllowlist) {
+  return dep.issueState === "closed" && dep.stateReason === "completed" && isPrincipal(dep.closedByActor ?? null, principalAllowlist);
+}
 function checkDispatchReadiness(input) {
   const { trancheSlug, task } = input;
   const taskLabel = `task ${task.id} (tranche ${trancheSlug})`;
+  const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const blockers = [];
   if (task.issue === null) {
     blockers.push(`dispatch-gate issue-existence: ${taskLabel} has no Issue (#TBD or blank) in the topology — not dispatchable until the Planner cuts the Issue.`);
@@ -2687,7 +2703,7 @@ function checkDispatchReadiness(input) {
     blockers.push(`dispatch-gate rationale: Issue #${input.issue.number} for ${taskLabel} fails the rationale gate (checkIssueRationale) — the Planner must complete the eight-field rationale before this task is dispatchable.`);
   }
   for (const dep of input.dependsOn) {
-    if (!dep.merged) {
+    if (!dep.merged && !isHandClosedByRecognizedPrincipal(dep, principalAllowlist)) {
       const issueStr = dep.issue !== null ? ` (#${dep.issue})` : "";
       blockers.push(`dispatch-gate depends-on: ${taskLabel} depends on ${dep.id}${issueStr}, whose PR is not merged yet — not dispatchable, it serializes behind it.`);
     }