@attalabs/vinaya 0.8.0 → 0.8.2

package/dist/checks/bin/check-dispatch-readiness.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/checks/bin/check-dispatch-readiness.ts
-import { execFile as execFile4, execFileSync as execFileSync2 } from "node:child_process";
+import { execFile as execFile4, execFileSync as execFileSync3 } from "node:child_process";
 import { promisify as promisify4 } from "node:util";
 // ../../packages/aeg-core/src/anchored-region.ts
 function maskCode(body) {
@@ -1219,7 +1219,8 @@ function mapForgeFacts(raw) {
     reviewDecision: mapReviewDecision(raw.pullRequest?.reviewDecision),
     stateReason: mapStateReason(raw.issue.stateReason),
     closedAt: raw.issue.closedAt ?? null,
-    mergedAt: raw.pullRequest?.mergedAt ?? null
+    mergedAt: raw.pullRequest?.mergedAt ?? null,
+    closedByActor: raw.closedByActor ?? null
   };
 }
 function mapStateReason(reason) {
@@ -1312,6 +1313,7 @@ function buildBatchQuery(tranche, tasks) {
       timelineItems(last: 1, itemTypes: [CLOSED_EVENT]) {
         nodes {
           ... on ClosedEvent {
+            actor { login }
             closer {
               ... on PullRequest {
                 number
@@ -1349,7 +1351,8 @@ function extractRawFromResponse(repository, alias) {
   const issue = repository[`${alias}_issue`];
   const ref = repository[`${alias}_ref`];
   const prs = repository[`${alias}_prs`];
-  const rawCloser = issue?.timelineItems?.nodes?.[0]?.closer ?? null;
+  const timelineNode = issue?.timelineItems?.nodes?.[0];
+  const rawCloser = timelineNode?.closer ?? null;
   const closingPr = rawCloser && typeof rawCloser.number === "number" && typeof rawCloser.url === "string" ? rawCloser : null;
   const branchPr = prs && prs.nodes.length > 0 && prs.nodes[0] ? prs.nodes[0] : null;
   return {
@@ -1361,7 +1364,8 @@ function extractRawFromResponse(repository, alias) {
       labels: issue.labels.nodes.map((n) => n.name)
     } : null,
     refExists: Boolean(ref && ref.name.length > 0),
-    pullRequest: closingPr ?? branchPr
+    pullRequest: closingPr ?? branchPr,
+    closedByActor: timelineNode?.actor?.login ?? null
   };
 }
 function describeError(err) {
@@ -1499,6 +1503,11 @@ var FORGE_FACT_INPUTS = [
     fact: "mergedAt",
     readsFrom: "PullRequest.mergedAt",
     meaning: "Timestamp for the coherence oracle grandfather cutoff. No derivation rule reads it."
+  },
+  {
+    fact: "closedByActor",
+    readsFrom: "ClosedEvent.actor.login (most recent timeline CLOSED_EVENT)",
+    meaning: "GitHub login that hand-closed the Issue. No task-status derivation rule reads it — it is consumed by dispatch-gate.ts/coherence-checks.ts A1 to recognize a hand-closed dependency as resolved (task vinaya-engine-v1 21, #99), not by this status model."
   }
 ];
 var DERIVED_STATUSES = [
@@ -1978,7 +1987,7 @@ function isGrandfathered(isoDate) {
   return isoDate.slice(0, 10) < COHERENCE_ENFORCED_FROM;
 }
 var R1_GRANDFATHERED_ISSUES = new Set([279, 280, 281, 282]);
-function checkA1(entries) {
+function checkA1(entries, principalAllowlist = PRINCIPAL_ALLOWLIST) {
   const failures = [];
   for (const e of entries) {
     if (!e.facts)
@@ -1986,6 +1995,9 @@ function checkA1(entries) {
     if (e.facts.stateReason === "not_planned")
       continue;
     if (e.facts.issueState === "closed" && e.facts.prState !== "merged") {
+      const handClosed = e.facts.stateReason === "completed" && isPrincipal(e.facts.closedByActor, principalAllowlist);
+      if (handClosed)
+        continue;
       failures.push({
         issue: e.task.issue,
         tranche: e.trancheSlug,
@@ -2675,9 +2687,13 @@ function parseGlossaryTerms(glossaryContent) {
   return terms;
 }
 // ../../packages/aeg-core/src/dispatch-gate.ts
+function isHandClosedByRecognizedPrincipal(dep, principalAllowlist) {
+  return dep.issueState === "closed" && dep.stateReason === "completed" && isPrincipal(dep.closedByActor ?? null, principalAllowlist);
+}
 function checkDispatchReadiness(input) {
   const { trancheSlug, task } = input;
   const taskLabel = `task ${task.id} (tranche ${trancheSlug})`;
+  const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const blockers = [];
   if (task.issue === null) {
     blockers.push(`dispatch-gate issue-existence: ${taskLabel} has no Issue (#TBD or blank) in the topology — not dispatchable until the Planner cuts the Issue.`);
@@ -2688,7 +2704,7 @@ function checkDispatchReadiness(input) {
     blockers.push(`dispatch-gate rationale: Issue #${input.issue.number} for ${taskLabel} fails the rationale gate (checkIssueRationale) — the Planner must complete the eight-field rationale before this task is dispatchable.`);
   }
   for (const dep of input.dependsOn) {
-    if (!dep.merged) {
+    if (!dep.merged && !isHandClosedByRecognizedPrincipal(dep, principalAllowlist)) {
       const issueStr = dep.issue !== null ? ` (#${dep.issue})` : "";
       blockers.push(`dispatch-gate depends-on: ${taskLabel} depends on ${dep.id}${issueStr}, whose PR is not merged yet — not dispatchable, it serializes behind it.`);
     }
@@ -2944,12 +2960,186 @@ function emitCheckError(error) {
 `);
 }
 
+// src/lib/config.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { z as z2 } from "zod";
+var EnvEntrySchema = z2.union([
+  z2.literal(true),
+  z2.object({ optional: z2.literal(true) }),
+  z2.object({ anyOf: z2.array(z2.string()).min(2) }),
+  z2.string()
+]);
+var CheckEntrySchema = z2.object({
+  run: z2.string(),
+  scope: z2.enum(["diff", "full"]),
+  include: z2.array(z2.string()).optional(),
+  args: z2.array(z2.string()).optional(),
+  timeoutMs: z2.number().optional(),
+  env: z2.record(z2.string(), EnvEntrySchema).optional(),
+  requiresOpenPr: z2.boolean().optional(),
+  ownWorkflow: z2.boolean().optional()
+}).superRefine((entry2, ctx) => {
+  if (!entry2.env)
+    return;
+  for (const [key, value] of Object.entries(entry2.env)) {
+    if (typeof value !== "object" || value === null || !("anyOf" in value))
+      continue;
+    const members = value.anyOf;
+    if (new Set(members).size !== members.length) {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        message: `env.${key}.anyOf has duplicate members`,
+        path: ["env", key, "anyOf"]
+      });
+    }
+    if (!members.includes(key)) {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        message: `env.${key}.anyOf must include "${key}" itself as a member`,
+        path: ["env", key, "anyOf"]
+      });
+    }
+  }
+});
+var BRIEF_BUILTINS = [
+  "tier",
+  "testPlan",
+  "testPlanExclusivity",
+  "principalPlaceholder",
+  "surfaceMap",
+  "docUpdateList",
+  "worktreeStep0",
+  "stopConditions",
+  "autonomyClause",
+  "project",
+  "for",
+  "closesN",
+  "premiseCoverage",
+  "issueRationale"
+];
+var BriefSectionSchema = z2.union([
+  z2.object({ builtin: z2.enum(BRIEF_BUILTINS) }),
+  z2.object({ heading: z2.string().min(1), name: z2.string().optional() }),
+  z2.object({ field: z2.string().min(1), name: z2.string().optional() }),
+  z2.object({ phrase: z2.string().min(1), name: z2.string().optional() })
+]);
+var BriefSchemaSchema = z2.object({
+  pr: z2.object({ sections: z2.array(BriefSectionSchema) }).optional(),
+  issue: z2.object({ sections: z2.array(BriefSectionSchema) }).optional()
+});
+function isSafeRepoRelPath(p) {
+  if (p.length === 0)
+    return false;
+  if (p.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(p))
+    return false;
+  return p.split(/[\\/]/).every((seg) => seg !== ".." && seg !== "");
+}
+var SafeRepoRelPath = z2.string().refine(isSafeRepoRelPath, {
+  message: "must be a repo-root-relative path with no `..` segment or absolute root"
+});
+var ManagedBlockRecordSchema = z2.object({
+  path: SafeRepoRelPath,
+  marker: z2.string(),
+  comment: z2.enum(["hash", "html"])
+});
+var ManagedManifestSchema = z2.object({
+  version: z2.number().int().positive(),
+  files: z2.array(SafeRepoRelPath),
+  blocks: z2.array(ManagedBlockRecordSchema),
+  labels: z2.array(z2.string())
+});
+var VinayaConfigSchema = z2.object({
+  rings: z2.object({
+    ring1_forgeWriteInterception: z2.boolean(),
+    ring2_asyncAudits: z2.boolean()
+  }).optional(),
+  checks: z2.record(z2.string(), CheckEntrySchema).optional(),
+  briefSchema: BriefSchemaSchema.optional(),
+  managed: ManagedManifestSchema.optional(),
+  principals: z2.array(z2.string()).min(1).optional(),
+  ci: z2.object({ setup: z2.string().min(1) }).optional()
+});
+var GLOBAL_VINAYA_HOME = join(homedir(), ".vinaya");
+var GLOBAL_CONFIG_PATH = join(GLOBAL_VINAYA_HOME, "config.json");
+var LOCAL_CONFIG_FILENAME = "vinaya.config.json";
+function resolvePrincipalAllowlist(config) {
+  return config?.principals ?? PRINCIPAL_ALLOWLIST;
+}
+function trustAnchorRepo() {
+  const wellFormed = (slug) => /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
+  const fromRunner = process.env.GITHUB_REPOSITORY?.trim();
+  if (fromRunner) {
+    const validated = wellFormed(fromRunner);
+    if (validated)
+      return validated;
+  }
+  try {
+    const url = execFileSync2("git", ["remote", "get-url", "origin"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+    const m = url.match(/github\.com[:/]([^/]+)\/(.+?)(?:\.git)?\/?$/);
+    return m?.[1] && m[2] ? wellFormed(`${m[1]}/${m[2]}`) : null;
+  } catch {
+    return null;
+  }
+}
+function ghFetchTrustAnchorConfig() {
+  const repo = trustAnchorRepo();
+  if (!repo)
+    throw new Error("could not resolve repo identity for the trust-anchor read");
+  return execFileSync2("gh", ["api", `repos/${repo}/contents/${LOCAL_CONFIG_FILENAME}`, "--jq", ".content"], {
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+}
+function firstLine(err) {
+  return err?.message?.split(`
+`)[0] ?? "unknown error";
+}
+function isMissingFileError(err) {
+  const stderr = err?.stderr;
+  const haystack = [
+    err?.message ?? "",
+    typeof stderr === "string" ? stderr : stderr?.toString() ?? ""
+  ].join(`
+`);
+  return /\b404\b|not found/i.test(haystack);
+}
+function loadTrustAnchorConfig(fetcher = ghFetchTrustAnchorConfig) {
+  const warn = (why) => process.stdout.write(`⚠ could not read \`principals\` from the default branch (${why}) — falling back to vinaya's built-in principal allowlist.
+`);
+  let base64;
+  try {
+    base64 = fetcher().trim();
+  } catch (err) {
+    if (!isMissingFileError(err))
+      warn(firstLine(err));
+    return null;
+  }
+  if (!base64)
+    return null;
+  try {
+    const raw = Buffer.from(base64, "base64").toString("utf-8");
+    const parsed = VinayaConfigSchema.safeParse(JSON.parse(raw));
+    if (parsed.success)
+      return parsed.data;
+    warn("it did not satisfy the config schema");
+    return null;
+  } catch {
+    warn("it was not readable as JSON");
+    return null;
+  }
+}
+
 // src/checks/bin/check-dispatch-readiness.ts
 var CHECK_NAME = "dispatch-readiness";
 var execFileAsync4 = promisify4(execFile4);
 function git(args) {
   try {
-    return execFileSync2("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync3("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch {
     return "";
   }
@@ -3000,10 +3190,24 @@ function resolveEdge(id, taskById, factsByTaskId) {
   const target = taskById.get(id);
   if (target) {
     const facts = target.issue !== null ? factsByTaskId.get(target.id) : undefined;
-    return { issue: target.issue, merged: facts?.prState === "merged", open: facts?.prState === "open" };
+    return {
+      issue: target.issue,
+      merged: facts?.prState === "merged",
+      open: facts?.prState === "open",
+      issueState: facts?.issueState ?? null,
+      stateReason: facts?.stateReason ?? null,
+      closedByActor: facts?.closedByActor ?? null
+    };
   }
   const direct = id.match(/^#(\d+)$/);
-  return { issue: direct ? Number(direct[1]) : null, merged: false, open: false };
+  return {
+    issue: direct ? Number(direct[1]) : null,
+    merged: false,
+    open: false,
+    issueState: null,
+    stateReason: null,
+    closedByActor: null
+  };
 }
 async function main() {
   const branch = currentBranch();
@@ -3046,7 +3250,14 @@ async function main() {
   const factsByTaskId = snapshot.facts;
   const dependsOn = task.dependsOn.map((dep) => {
     const r = resolveEdge(dep, taskById, factsByTaskId);
-    return { id: dep, issue: r.issue, merged: r.merged };
+    return {
+      id: dep,
+      issue: r.issue,
+      merged: r.merged,
+      issueState: r.issueState,
+      stateReason: r.stateReason,
+      closedByActor: r.closedByActor
+    };
   });
   const conflictsWith = task.conflictsWith.map((c) => {
     const r = resolveEdge(c, taskById, factsByTaskId);
@@ -3061,7 +3272,8 @@ async function main() {
     dependsOn,
     conflictsWith,
     priorTask: null,
-    priorTrancheArchival
+    priorTrancheArchival,
+    principalAllowlist: resolvePrincipalAllowlist(loadTrustAnchorConfig())
   };
   const result = checkDispatchReadiness(input);
   if (!result.ready) {

package/dist/checks/bin/check-doc-coverage-push.js

@@ -1219,7 +1219,8 @@ function mapForgeFacts(raw) {
     reviewDecision: mapReviewDecision(raw.pullRequest?.reviewDecision),
     stateReason: mapStateReason(raw.issue.stateReason),
     closedAt: raw.issue.closedAt ?? null,
-    mergedAt: raw.pullRequest?.mergedAt ?? null
+    mergedAt: raw.pullRequest?.mergedAt ?? null,
+    closedByActor: raw.closedByActor ?? null
   };
 }
 function mapStateReason(reason) {
@@ -1312,6 +1313,7 @@ function buildBatchQuery(tranche, tasks) {
       timelineItems(last: 1, itemTypes: [CLOSED_EVENT]) {
         nodes {
           ... on ClosedEvent {
+            actor { login }
             closer {
               ... on PullRequest {
                 number
@@ -1349,7 +1351,8 @@ function extractRawFromResponse(repository, alias) {
   const issue = repository[`${alias}_issue`];
   const ref = repository[`${alias}_ref`];
   const prs = repository[`${alias}_prs`];
-  const rawCloser = issue?.timelineItems?.nodes?.[0]?.closer ?? null;
+  const timelineNode = issue?.timelineItems?.nodes?.[0];
+  const rawCloser = timelineNode?.closer ?? null;
   const closingPr = rawCloser && typeof rawCloser.number === "number" && typeof rawCloser.url === "string" ? rawCloser : null;
   const branchPr = prs && prs.nodes.length > 0 && prs.nodes[0] ? prs.nodes[0] : null;
   return {
@@ -1361,7 +1364,8 @@ function extractRawFromResponse(repository, alias) {
       labels: issue.labels.nodes.map((n) => n.name)
     } : null,
     refExists: Boolean(ref && ref.name.length > 0),
-    pullRequest: closingPr ?? branchPr
+    pullRequest: closingPr ?? branchPr,
+    closedByActor: timelineNode?.actor?.login ?? null
   };
 }
 function describeError(err) {
@@ -1499,6 +1503,11 @@ var FORGE_FACT_INPUTS = [
     fact: "mergedAt",
     readsFrom: "PullRequest.mergedAt",
     meaning: "Timestamp for the coherence oracle grandfather cutoff. No derivation rule reads it."
+  },
+  {
+    fact: "closedByActor",
+    readsFrom: "ClosedEvent.actor.login (most recent timeline CLOSED_EVENT)",
+    meaning: "GitHub login that hand-closed the Issue. No task-status derivation rule reads it — it is consumed by dispatch-gate.ts/coherence-checks.ts A1 to recognize a hand-closed dependency as resolved (task vinaya-engine-v1 21, #99), not by this status model."
   }
 ];
 var DERIVED_STATUSES = [
@@ -1978,7 +1987,7 @@ function isGrandfathered(isoDate) {
   return isoDate.slice(0, 10) < COHERENCE_ENFORCED_FROM;
 }
 var R1_GRANDFATHERED_ISSUES = new Set([279, 280, 281, 282]);
-function checkA1(entries) {
+function checkA1(entries, principalAllowlist = PRINCIPAL_ALLOWLIST) {
   const failures = [];
   for (const e of entries) {
     if (!e.facts)
@@ -1986,6 +1995,9 @@ function checkA1(entries) {
     if (e.facts.stateReason === "not_planned")
       continue;
     if (e.facts.issueState === "closed" && e.facts.prState !== "merged") {
+      const handClosed = e.facts.stateReason === "completed" && isPrincipal(e.facts.closedByActor, principalAllowlist);
+      if (handClosed)
+        continue;
       failures.push({
         issue: e.task.issue,
         tranche: e.trancheSlug,
@@ -2675,9 +2687,13 @@ function parseGlossaryTerms(glossaryContent) {
   return terms;
 }
 // ../../packages/aeg-core/src/dispatch-gate.ts
+function isHandClosedByRecognizedPrincipal(dep, principalAllowlist) {
+  return dep.issueState === "closed" && dep.stateReason === "completed" && isPrincipal(dep.closedByActor ?? null, principalAllowlist);
+}
 function checkDispatchReadiness(input) {
   const { trancheSlug, task } = input;
   const taskLabel = `task ${task.id} (tranche ${trancheSlug})`;
+  const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const blockers = [];
   if (task.issue === null) {
     blockers.push(`dispatch-gate issue-existence: ${taskLabel} has no Issue (#TBD or blank) in the topology — not dispatchable until the Planner cuts the Issue.`);
@@ -2688,7 +2704,7 @@ function checkDispatchReadiness(input) {
     blockers.push(`dispatch-gate rationale: Issue #${input.issue.number} for ${taskLabel} fails the rationale gate (checkIssueRationale) — the Planner must complete the eight-field rationale before this task is dispatchable.`);
   }
   for (const dep of input.dependsOn) {
-    if (!dep.merged) {
+    if (!dep.merged && !isHandClosedByRecognizedPrincipal(dep, principalAllowlist)) {
       const issueStr = dep.issue !== null ? ` (#${dep.issue})` : "";
       blockers.push(`dispatch-gate depends-on: ${taskLabel} depends on ${dep.id}${issueStr}, whose PR is not merged yet — not dispatchable, it serializes behind it.`);
     }

package/dist/checks/bin/check-doc-coverage.js

@@ -1220,7 +1220,8 @@ function mapForgeFacts(raw) {
     reviewDecision: mapReviewDecision(raw.pullRequest?.reviewDecision),
     stateReason: mapStateReason(raw.issue.stateReason),
     closedAt: raw.issue.closedAt ?? null,
-    mergedAt: raw.pullRequest?.mergedAt ?? null
+    mergedAt: raw.pullRequest?.mergedAt ?? null,
+    closedByActor: raw.closedByActor ?? null
   };
 }
 function mapStateReason(reason) {
@@ -1313,6 +1314,7 @@ function buildBatchQuery(tranche, tasks) {
       timelineItems(last: 1, itemTypes: [CLOSED_EVENT]) {
         nodes {
           ... on ClosedEvent {
+            actor { login }
             closer {
               ... on PullRequest {
                 number
@@ -1350,7 +1352,8 @@ function extractRawFromResponse(repository, alias) {
   const issue = repository[`${alias}_issue`];
   const ref = repository[`${alias}_ref`];
   const prs = repository[`${alias}_prs`];
-  const rawCloser = issue?.timelineItems?.nodes?.[0]?.closer ?? null;
+  const timelineNode = issue?.timelineItems?.nodes?.[0];
+  const rawCloser = timelineNode?.closer ?? null;
   const closingPr = rawCloser && typeof rawCloser.number === "number" && typeof rawCloser.url === "string" ? rawCloser : null;
   const branchPr = prs && prs.nodes.length > 0 && prs.nodes[0] ? prs.nodes[0] : null;
   return {
@@ -1362,7 +1365,8 @@ function extractRawFromResponse(repository, alias) {
       labels: issue.labels.nodes.map((n) => n.name)
     } : null,
     refExists: Boolean(ref && ref.name.length > 0),
-    pullRequest: closingPr ?? branchPr
+    pullRequest: closingPr ?? branchPr,
+    closedByActor: timelineNode?.actor?.login ?? null
   };
 }
 function describeError(err) {
@@ -1500,6 +1504,11 @@ var FORGE_FACT_INPUTS = [
     fact: "mergedAt",
     readsFrom: "PullRequest.mergedAt",
     meaning: "Timestamp for the coherence oracle grandfather cutoff. No derivation rule reads it."
+  },
+  {
+    fact: "closedByActor",
+    readsFrom: "ClosedEvent.actor.login (most recent timeline CLOSED_EVENT)",
+    meaning: "GitHub login that hand-closed the Issue. No task-status derivation rule reads it — it is consumed by dispatch-gate.ts/coherence-checks.ts A1 to recognize a hand-closed dependency as resolved (task vinaya-engine-v1 21, #99), not by this status model."
   }
 ];
 var DERIVED_STATUSES = [
@@ -1979,7 +1988,7 @@ function isGrandfathered(isoDate) {
   return isoDate.slice(0, 10) < COHERENCE_ENFORCED_FROM;
 }
 var R1_GRANDFATHERED_ISSUES = new Set([279, 280, 281, 282]);
-function checkA1(entries) {
+function checkA1(entries, principalAllowlist = PRINCIPAL_ALLOWLIST) {
   const failures = [];
   for (const e of entries) {
     if (!e.facts)
@@ -1987,6 +1996,9 @@ function checkA1(entries) {
     if (e.facts.stateReason === "not_planned")
       continue;
     if (e.facts.issueState === "closed" && e.facts.prState !== "merged") {
+      const handClosed = e.facts.stateReason === "completed" && isPrincipal(e.facts.closedByActor, principalAllowlist);
+      if (handClosed)
+        continue;
       failures.push({
         issue: e.task.issue,
         tranche: e.trancheSlug,
@@ -2676,9 +2688,13 @@ function parseGlossaryTerms(glossaryContent) {
   return terms;
 }
 // ../../packages/aeg-core/src/dispatch-gate.ts
+function isHandClosedByRecognizedPrincipal(dep, principalAllowlist) {
+  return dep.issueState === "closed" && dep.stateReason === "completed" && isPrincipal(dep.closedByActor ?? null, principalAllowlist);
+}
 function checkDispatchReadiness(input) {
   const { trancheSlug, task } = input;
   const taskLabel = `task ${task.id} (tranche ${trancheSlug})`;
+  const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const blockers = [];
   if (task.issue === null) {
     blockers.push(`dispatch-gate issue-existence: ${taskLabel} has no Issue (#TBD or blank) in the topology — not dispatchable until the Planner cuts the Issue.`);
@@ -2689,7 +2705,7 @@ function checkDispatchReadiness(input) {
     blockers.push(`dispatch-gate rationale: Issue #${input.issue.number} for ${taskLabel} fails the rationale gate (checkIssueRationale) — the Planner must complete the eight-field rationale before this task is dispatchable.`);
   }
   for (const dep of input.dependsOn) {
-    if (!dep.merged) {
+    if (!dep.merged && !isHandClosedByRecognizedPrincipal(dep, principalAllowlist)) {
       const issueStr = dep.issue !== null ? ` (#${dep.issue})` : "";
       blockers.push(`dispatch-gate depends-on: ${taskLabel} depends on ${dep.id}${issueStr}, whose PR is not merged yet — not dispatchable, it serializes behind it.`);
     }
@@ -3130,14 +3146,43 @@ function resolvePrBody() {
   }
   return "";
 }
-function waiverActiveFromEnv() {
-  const labels = (process.env.PR_LABELS || "").split(",").map((s) => s.trim()).filter(Boolean);
-  if (!labels.includes(WAIVER_LABEL))
+function fetchPrLabels(prNumber) {
+  try {
+    const out = execFileSync3("gh", ["pr", "view", String(prNumber), "--json", "labels"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    return JSON.parse(out).labels.map((l) => l.name);
+  } catch {
+    return null;
+  }
+}
+function fetchWaiverLabelActor(prNumber, label2) {
+  try {
+    const out = execFileSync3("gh", ["api", `repos/{owner}/{repo}/issues/${prNumber}/timeline`, "--paginate"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const events = JSON.parse(out);
+    const matches = events.filter((e) => e.event === "labeled" && e.label?.name === label2);
+    return matches[matches.length - 1]?.actor?.login ?? null;
+  } catch {
+    return null;
+  }
+}
+function waiverActive() {
+  const prNumberStr = process.env.PR_NUMBER;
+  if (!prNumberStr)
+    return false;
+  const prNumber = Number(prNumberStr);
+  const labels = fetchPrLabels(prNumber);
+  if (!labels?.includes(WAIVER_LABEL))
     return false;
+  const labelActor = fetchWaiverLabelActor(prNumber, WAIVER_LABEL);
   return isWaiverLabelActorVerified({
     label: WAIVER_LABEL,
     labels,
-    labelActor: process.env.WAIVER_LABEL_ACTOR || null,
+    labelActor,
     principalAllowlist: resolvePrincipalAllowlist(loadTrustAnchorConfig())
   });
 }
@@ -3150,7 +3195,7 @@ function main() {
     process.exit(0);
   }
   const content = existsSync(DOC_OWNERS_PATH) ? readFileSync(DOC_OWNERS_PATH, "utf8") : null;
-  const result = evaluateC5(changed, content, resolvePrBody(), existsSync, waiverActiveFromEnv());
+  const result = evaluateC5(changed, content, resolvePrBody(), existsSync, waiverActive());
   if (result.errors.length > 0) {
     for (const message of result.errors) {
       emitCheckError({