@attalabs/vinaya 0.9.0 → 0.12.0

package/dist/index.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync18 } from "node:fs";
-import { dirname as dirname8, join as join20 } from "node:path";
+import { readFileSync as readFileSync19 } from "node:fs";
+import { dirname as dirname8, join as join21 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/commands/archive.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
-// ../../packages/aeg-core/src/anchored-region.ts
+// ../../packages/aeg-forge-state/src/strip-code.ts
 function maskCode(body) {
   const fill = (line) => " ".repeat(line.length);
   return maskIndentedCode(maskFencedCode(body, fill), fill).replace(/(`+)[^\n]*?\1/g, (m) => " ".repeat(m.length));
@@ -24,29 +24,34 @@ function stripCode(body, options = {}) {
 var FENCE_OPEN = /^ {0,3}(`{3,}|~{3,})([^\r\n]*)\r?$/;
 var FENCE_CLOSE = /^ {0,3}(`+|~+)[ \t]*\r?$/;
 function maskFencedCode(body, fill) {
+  const { lines } = scanFencedCode(body);
+  return lines.map(({ line, inCode }) => inCode ? fill(line) : line).join(`
+`);
+}
+function scanFencedCode(body) {
   let fenceChar = null;
   let fenceLen = 0;
-  return body.split(`
+  const lines = body.split(`
 `).map((line) => {
     if (fenceChar === null) {
       const open = line.match(FENCE_OPEN);
       if (!open)
-        return line;
+        return { line, inCode: false };
       const marker = open[1];
       if (marker[0] === "`" && open[2].includes("`"))
-        return line;
+        return { line, inCode: false };
       fenceChar = marker[0];
       fenceLen = marker.length;
-      return fill(line);
+      return { line, inCode: true };
     }
     const close = line.match(FENCE_CLOSE);
     if (close && close[1][0] === fenceChar && close[1].length >= fenceLen) {
       fenceChar = null;
       fenceLen = 0;
     }
-    return fill(line);
-  }).join(`
-`);
+    return { line, inCode: true };
+  });
+  return { lines, unterminated: fenceChar !== null };
 }
 var LIST_MARKER = /^ {0,3}(?:[-*+]|\d{1,9}[.)])(?:\s|$)/;
 function indentWidth(line) {
@@ -89,88 +94,7 @@ function maskIndentedCode(body, fill) {
   return out.join(`
 `);
 }
-function anchoredRegion(body, field) {
-  const masked = maskCode(body);
-  const start = new RegExp(`<!--\\s*AEG:${field}:START\\s*-->`).exec(masked);
-  if (!start)
-    return null;
-  const afterStart = start.index + start[0].length;
-  const end = new RegExp(`<!--\\s*AEG:${field}:END\\s*-->`).exec(masked.slice(afterStart));
-  if (!end)
-    return null;
-  return body.slice(afterStart, afterStart + end.index);
-}
-// ../../packages/aeg-core/src/parse-registry.ts
-function parseRegistry(md) {
-  const rows = readMarkdownTable(md, /^##\s+Registry\b/i);
-  const projects = [];
-  for (const row of rows) {
-    if (row.length < 4)
-      continue;
-    const name = stripBackticks(row[0] ?? "").trim();
-    const path = stripBackticks(row[1] ?? "").trim();
-    const specsPath = stripBackticks(row[2] ?? "").trim();
-    const stateCell = (row[3] ?? "").trim();
-    if (!name || !path || !specsPath)
-      continue;
-    projects.push({
-      name,
-      path,
-      specsPath,
-      statePath: parseStateCell(stateCell)
-    });
-  }
-  return projects;
-}
-function parseStateCell(cell) {
-  if (!cell)
-    return null;
-  const stripped = stripBackticks(cell).trim();
-  if (/^[\w./@-]+\/?$/.test(stripped) && cell.includes("`")) {
-    return stripped;
-  }
-  return null;
-}
-function stripBackticks(s) {
-  return s.replace(/`/g, "");
-}
-function readMarkdownTable(md, headingMatcher) {
-  const lines = md.split(/\r?\n/);
-  let i = 0;
-  for (;i < lines.length; i++) {
-    if (headingMatcher.test(lines[i] ?? "")) {
-      i++;
-      break;
-    }
-  }
-  if (i >= lines.length)
-    return [];
-  for (;i < lines.length; i++) {
-    if ((lines[i] ?? "").trim().startsWith("|"))
-      break;
-  }
-  if (i + 1 >= lines.length)
-    return [];
-  i += 2;
-  const out = [];
-  for (;i < lines.length; i++) {
-    const trimmed = (lines[i] ?? "").trim();
-    if (!trimmed.startsWith("|"))
-      break;
-    out.push(splitTableRow(trimmed));
-  }
-  return out;
-}
-function splitTableRow(row) {
-  const PLACEHOLDER = "\x00PIPE\x00";
-  const escaped = row.replace(/\\\|/g, PLACEHOLDER);
-  const parts = escaped.split("|").map((s) => s.trim());
-  if (parts.length && parts[0] === "")
-    parts.shift();
-  if (parts.length && parts[parts.length - 1] === "")
-    parts.pop();
-  return parts.map((p) => p.split(PLACEHOLDER).join("|"));
-}
+
 // ../../packages/aeg-forge-state/src/parse-rationale-deps.ts
 var SECTION_HEADER = /\*\*Dependency rationale\*\*/i;
 // ../../packages/aeg-forge-state/src/gh.ts
@@ -378,6 +302,96 @@ function parseOwnerRepo(value) {
     return null;
   return { owner: match[1], repo: match[2] };
 }
+// ../../packages/aeg-core/src/anchored-region.ts
+function anchoredRegionBounds(body, field) {
+  const masked = maskCode(body);
+  const start = new RegExp(`<!--\\s*AEG:${field}:START\\s*-->`).exec(masked);
+  if (!start)
+    return null;
+  const innerStart = start.index + start[0].length;
+  const end = new RegExp(`<!--\\s*AEG:${field}:END\\s*-->`).exec(masked.slice(innerStart));
+  if (!end)
+    return null;
+  const innerEnd = innerStart + end.index;
+  return { outerStart: start.index, outerEnd: innerEnd + end[0].length, innerStart, innerEnd };
+}
+function anchoredRegion(body, field) {
+  const bounds = anchoredRegionBounds(body, field);
+  if (!bounds)
+    return null;
+  return body.slice(bounds.innerStart, bounds.innerEnd);
+}
+// ../../packages/aeg-core/src/parse-registry.ts
+function parseRegistry(md) {
+  const rows = readMarkdownTable(md, /^##\s+Registry\b/i);
+  const projects = [];
+  for (const row of rows) {
+    if (row.length < 4)
+      continue;
+    const name = stripBackticks(row[0] ?? "").trim();
+    const path = stripBackticks(row[1] ?? "").trim();
+    const specsPath = stripBackticks(row[2] ?? "").trim();
+    const stateCell = (row[3] ?? "").trim();
+    if (!name || !path || !specsPath)
+      continue;
+    projects.push({
+      name,
+      path,
+      specsPath,
+      statePath: parseStateCell(stateCell)
+    });
+  }
+  return projects;
+}
+function parseStateCell(cell) {
+  if (!cell)
+    return null;
+  const stripped = stripBackticks(cell).trim();
+  if (/^[\w./@-]+\/?$/.test(stripped) && cell.includes("`")) {
+    return stripped;
+  }
+  return null;
+}
+function stripBackticks(s) {
+  return s.replace(/`/g, "");
+}
+function readMarkdownTable(md, headingMatcher) {
+  const lines = md.split(/\r?\n/);
+  let i = 0;
+  for (;i < lines.length; i++) {
+    if (headingMatcher.test(lines[i] ?? "")) {
+      i++;
+      break;
+    }
+  }
+  if (i >= lines.length)
+    return [];
+  for (;i < lines.length; i++) {
+    if ((lines[i] ?? "").trim().startsWith("|"))
+      break;
+  }
+  if (i + 1 >= lines.length)
+    return [];
+  i += 2;
+  const out = [];
+  for (;i < lines.length; i++) {
+    const trimmed = (lines[i] ?? "").trim();
+    if (!trimmed.startsWith("|"))
+      break;
+    out.push(splitTableRow(trimmed));
+  }
+  return out;
+}
+function splitTableRow(row) {
+  const PLACEHOLDER = "\x00PIPE\x00";
+  const escaped = row.replace(/\\\|/g, PLACEHOLDER);
+  const parts = escaped.split("|").map((s) => s.trim());
+  if (parts.length && parts[0] === "")
+    parts.shift();
+  if (parts.length && parts[parts.length - 1] === "")
+    parts.pop();
+  return parts.map((p) => p.split(PLACEHOLDER).join("|"));
+}
 // ../../packages/aeg-core/src/state-machine-model.ts
 var FORGE_FACT_INPUTS = [
   {
@@ -970,6 +984,10 @@ function starterConfig() {
     }
   };
 }
+function ownVersion() {
+  const pkg = JSON.parse(readFileSync(join2(packageRoot(import.meta.url), "package.json"), "utf-8"));
+  return pkg.version;
+}
 var SETUP_BUN_SHA = "0c5077e51419868618aeaa5fe8019c62421857d6";
 function vinayaSetupSteps(selfHost) {
   if (!selfHost)
@@ -1001,7 +1019,7 @@ function vinayaSetupSteps(selfHost) {
 `;
 }
 function vinayaRun(selfHost, args) {
-  return selfHost ? `node ${selfHost.bin} ${args}` : `npx --yes @attalabs/vinaya ${args}`;
+  return selfHost ? `node ${selfHost.bin} ${args}` : `npx --yes @attalabs/vinaya@${ownVersion()} ${args}`;
 }
 function adopterSetupStep(ciSetup) {
   if (!ciSetup)
@@ -1427,10 +1445,6 @@ ${vinayaSetupSteps(selfHost)}      - name: Run vinaya audit --only=direct-push
 }
 var HOOK_PREAMBLE = `#!/usr/bin/env sh
 `;
-function ownVersion() {
-  const pkg = JSON.parse(readFileSync(join2(packageRoot(import.meta.url), "package.json"), "utf-8"));
-  return pkg.version;
-}
 function hookRun(selfHost, args) {
   if (!selfHost)
     return `npx --yes @attalabs/vinaya@${ownVersion()} ${args} || exit 1`;
@@ -3132,6 +3146,20 @@ function coreCheckRegistry() {
         GITHUB_TOKEN: { optional: true },
         GH_TOKEN: { optional: true }
       }
+    },
+    {
+      name: "evidence-fresh",
+      run: bin("check-evidence-fresh"),
+      scope: "diff",
+      timeoutMs: 15000,
+      requiresOpenPr: true,
+      env: {
+        PR_NUMBER: { optional: true },
+        PR_BODY: { optional: true },
+        BASE_SHA: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
     }
   ];
 }
@@ -3177,11 +3205,16 @@ function resolveChecks(core, configChecks) {
   }
   return { resolved, failures };
 }
-function overriddenNextMinorWarning(name) {
-  return `check "${name}" shares its name with a core check — it will replace the core check starting next minor (currently it runs alongside it under the flat registry).`;
+var MAX_KEY_DISPLAY_LENGTH = 80;
+function sanitizeKeyForDisplay(key) {
+  const stripped = key.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ");
+  return stripped.length > MAX_KEY_DISPLAY_LENGTH ? `${stripped.slice(0, MAX_KEY_DISPLAY_LENGTH)}…` : stripped;
 }
-function bareKeyNextMinorWarning(key) {
-  return `check "${key}" has no namespace and matches no core check — it will be rejected starting next minor. Rename it to "<yourname>/x".`;
+function overriddenReplacesCoreDiagnostic(name) {
+  return `check "${sanitizeKeyForDisplay(name)}" shares its name with a core check — it REPLACES that core check. The core check does not run.`;
+}
+function bareKeyRejectedDiagnostic(key) {
+  return `check "${sanitizeKeyForDisplay(key)}" has no namespace and matches no core check — it is REJECTED, and \`vinaya check\` refuses the whole run rather than executing a partial ruleset. Rename it to "<yourname>/<id>", both segments matching [a-z0-9][a-z0-9-]* — prefixing alone is not enough when the bare name itself breaks that grammar ("my_check", "QALint" need a real rename, not just a prefix).`;
 }
 
 // src/checks/runner.ts
@@ -3466,26 +3499,6 @@ function parseParallel(args) {
   }
   return;
 }
-function configErrorOutcome(path, error) {
-  const finding = {
-    schema: 1,
-    check: "config",
-    severity: "error",
-    message: `${path}: invalid \`checks\` registration — ${error}`,
-    agent_recovery_prompt: `Fix the invalid key/value named above in ${path}, then re-run \`vinaya check\`.`
-  };
-  return { name: "config", status: "error", exitCode: null, errors: [finding], durationMs: 0 };
-}
-function customSpecsFromConfig() {
-  const result = loadConfigChecked();
-  if (!result.ok)
-    return { specs: [], errorOutcome: configErrorOutcome(result.path, result.error), checks: undefined };
-  const checks = result.config?.checks;
-  if (!checks)
-    return { specs: [], errorOutcome: null, checks: undefined };
-  const specs = Object.entries(checks).map(([name, entry2]) => ({ name, ...entry2 }));
-  return { specs, errorOutcome: null, checks };
-}
 function classifyEnvValue(value) {
   if (value === true)
     return "passthrough";
@@ -3539,27 +3552,46 @@ function renderPlanTable(result) {
   return table.map((row) => row.map((cell, col) => (cell ?? "").padEnd(widths[col] ?? 0)).join("  ")).join(`
 `);
 }
-function resolveForPlan(configResult) {
-  if (configResult.ok) {
-    return resolveChecks(coreCheckRegistry(), configResult.config?.checks);
+function duplicateIdFailures(resolved) {
+  const seen = new Set;
+  const reported = new Set;
+  const failures = [];
+  for (const entry2 of resolved) {
+    if (!seen.has(entry2.name)) {
+      seen.add(entry2.name);
+      continue;
+    }
+    if (reported.has(entry2.name))
+      continue;
+    reported.add(entry2.name);
+    failures.push({ key: entry2.name, reason: "duplicate check id — two resolved entries claim the same name" });
   }
-  const core = resolveChecks(coreCheckRegistry(), undefined);
-  return {
-    resolved: core.resolved,
+  return failures;
+}
+var FAIL_CLOSED_RECOVERY = "Fix or remove the rejected `checks` entries named above in vinaya.config.json, then re-run `vinaya check`. Until every entry resolves, NO check runs — vinaya refuses the whole run rather than executing a partial ruleset. `vinaya check --plan` prints the same resolution, and `vinaya doctor` carries the permanent diagnostic for each rejected entry.";
+function refusal(message) {
+  return { schema: 1, check: "config", severity: "error", message, agent_recovery_prompt: FAIL_CLOSED_RECOVERY };
+}
+function resolveForRun(configResult) {
+  const base = configResult.ok ? resolveChecks(coreCheckRegistry(), configResult.config?.checks) : {
+    resolved: resolveChecks(coreCheckRegistry(), undefined).resolved,
     failures: [{ key: configResult.path, reason: `invalid \`checks\` registration — ${configResult.error}` }]
   };
+  const duplicates = duplicateIdFailures(base.resolved);
+  const refusals = [
+    ...base.failures.map((failure) => configResult.ok ? refusal(bareKeyRejectedDiagnostic(failure.key)) : refusal(`${failure.key}: ${failure.reason} — refusing to run any check.`)),
+    ...duplicates.map((failure) => refusal(`${failure.key}: ${failure.reason} — refusing to run any check.`))
+  ];
+  return { result: { resolved: base.resolved, failures: [...base.failures, ...duplicates] }, refusals };
 }
-function printClassificationWarnings(configChecks) {
-  const classification = resolveChecks(coreCheckRegistry(), configChecks);
-  for (const entry2 of classification.resolved) {
-    if (entry2.state === "overridden")
-      process.stdout.write(`${overriddenNextMinorWarning(entry2.name)}
-`);
-  }
-  for (const failure of classification.failures) {
-    process.stdout.write(`${bareKeyNextMinorWarning(failure.key)}
-`);
-  }
+function substitutionNotices(resolved) {
+  return resolved.filter((entry2) => entry2.state === "overridden").map((entry2) => ({
+    schema: 1,
+    check: "config",
+    severity: "warning",
+    message: overriddenReplacesCoreDiagnostic(entry2.name),
+    agent_recovery_prompt: `If replacing the core check "${entry2.name}" was intended, nothing to do — this is a notice, not a failure. If it was not, remove or rename that \`checks\` entry in vinaya.config.json so the core check runs again.`
+  }));
 }
 async function checkCommand(args) {
   const jsonOutput = args.includes("--json");
@@ -3570,8 +3602,8 @@ async function checkCommand(args) {
   const planRequested = args.includes("--plan");
   const positional = args.filter((a) => !a.startsWith("--"));
   const requestedName = positional[0];
+  const { result, refusals } = resolveForRun(loadConfigChecked());
   if (planRequested) {
-    const result = resolveForPlan(loadConfigChecked());
     if (jsonOutput) {
       process.stdout.write(`${JSON.stringify(renderPlanJson(result), null, 2)}
 `);
@@ -3585,8 +3617,36 @@ async function checkCommand(args) {
     console.error("Usage: vinaya check <name> | --all | --plan [--json] [--diff-only] [--local] [--parallel[=n]]");
     process.exit(2);
   }
-  const { specs: customSpecs, errorOutcome, checks: configChecks } = customSpecsFromConfig();
-  const allSpecs = [...coreCheckRegistry(), ...customSpecs];
+  if (refusals.length > 0) {
+    const outcome = {
+      name: "config",
+      status: "error",
+      exitCode: null,
+      errors: refusals,
+      durationMs: 0
+    };
+    for (const e of refusals)
+      emitCheckError(e);
+    if (jsonOutput) {
+      printJson({ checks: [outcome] });
+    } else {
+      process.stdout.write(`✗ ${outcome.name}: refused — no checks ran
+`);
+      for (const e of refusals)
+        process.stdout.write(`    ${e.severity}: ${e.message}
+`);
+    }
+    process.exit(1);
+  }
+  const allSpecs = result.resolved.map((entry2) => entry2.spec);
+  const notices = substitutionNotices(result.resolved);
+  for (const notice of notices)
+    emitCheckError(notice);
+  if (!jsonOutput) {
+    for (const notice of notices)
+      process.stdout.write(`⚠ ${notice.message}
+`);
+  }
   const specsToRun = allRequested ? allSpecs.filter(runsUnderAll) : allSpecs.filter((s) => s.name === requestedName);
   if (!allRequested && specsToRun.length === 0) {
     console.error(`Unknown check: ${requestedName}`);
@@ -3600,15 +3660,14 @@ async function checkCommand(args) {
     defaultTimeoutMs: 30000,
     localOnly
   }) : [];
-  const allOutcomes = errorOutcome ? [...outcomes, errorOutcome] : outcomes;
-  for (const o of allOutcomes) {
+  for (const o of outcomes) {
     for (const e of o.errors)
       emitCheckError(e);
   }
   if (jsonOutput) {
-    printJson({ checks: allOutcomes });
+    printJson({ checks: outcomes });
   } else {
-    for (const o of allOutcomes) {
+    for (const o of outcomes) {
       const symbol = o.status === "pass" ? "✓" : o.status === "skipped" ? "·" : "✗";
       process.stdout.write(`${symbol} ${o.name}: ${o.status} (${Math.round(o.durationMs)}ms)
 `);
@@ -3616,9 +3675,8 @@ async function checkCommand(args) {
         process.stdout.write(`    ${e.severity}: ${e.message}
 `);
     }
-    printClassificationWarnings(configChecks);
   }
-  const failed = allOutcomes.some((o) => o.status === "fail" || o.status === "error" || o.status === "timeout");
+  const failed = outcomes.some((o) => o.status === "fail" || o.status === "error" || o.status === "timeout");
   process.exit(failed ? 1 : 0);
 }
 
@@ -4125,12 +4183,9 @@ function diagnoseCustomChecks(repoRoot, config) {
   return findings;
 }
 function diagnoseEnvDeclarations(repoRoot, config) {
-  const customSpecs = Object.entries(config?.checks ?? {}).map(([name, entry2]) => ({
-    name,
-    ...entry2,
-    run: join9(repoRoot, entry2.run)
-  }));
-  const missing = checksMissingEnvDeclaration([...coreCheckRegistry(), ...customSpecs]);
+  const resolved = resolveChecks(coreCheckRegistry(), config?.checks).resolved;
+  const specs = resolved.map((entry2) => entry2.source === "config" ? { ...entry2.spec, run: join9(repoRoot, entry2.spec.run) } : entry2.spec);
+  const missing = checksMissingEnvDeclaration(specs);
   const findings = missing.map((name) => info("env", envDeclarationWarning(name)));
   for (const message of lintEnvDeclarations(config?.checks)) {
     findings.push(warn("env", message));
@@ -4142,10 +4197,10 @@ function diagnoseCheckClassification(config) {
   const findings = [];
   for (const entry2 of classification.resolved) {
     if (entry2.state === "overridden")
-      findings.push(warn("checks", overriddenNextMinorWarning(entry2.name)));
+      findings.push(warn("checks", overriddenReplacesCoreDiagnostic(entry2.name)));
   }
   for (const failure of classification.failures) {
-    findings.push(warn("checks", bareKeyNextMinorWarning(failure.key)));
+    findings.push(error("checks", bareKeyRejectedDiagnostic(failure.key)));
   }
   return findings;
 }
@@ -5021,17 +5076,27 @@ import { chmodSync as chmodSync2, existsSync as existsSync13, mkdirSync as mkdir
 import { join as join15 } from "node:path";
 var TEMPLATE_PATH = join15(packageRoot(import.meta.url), "templates", "custom-check.template.ts");
 var CHECKS_DIR = join15("scripts", "vinaya-checks");
-var VALID_NAME = /^[a-z0-9][a-z0-9-]*$/;
+var USAGE = "Usage: vinaya new check <yourname>/<id>  (both segments: lowercase letters, digits, hyphens; e.g. myteam/vocab-check)";
 function newCheckCommand(args) {
   const name = args[0];
-  if (!name || !VALID_NAME.test(name)) {
-    console.error("Usage: vinaya new check <name>  (name: lowercase letters, digits, hyphens)");
+  if (!name) {
+    console.error(USAGE);
+    process.exit(2);
+  }
+  if (coreCheckRegistry().some((spec) => spec.name === name)) {
+    console.error(`Refusing: "${name}" is a core check id. Registering it under \`checks\` REPLACES that core check — the core one stops running — so a scaffolded stub is never the right shape for it. Pick a namespaced name, or write the override entry by hand if you really mean to replace the core check.`);
+    process.exit(2);
+  }
+  if (!isValidNamespacedKey(name)) {
+    console.error(`Refusing: "${name}" is not a valid check id. ${USAGE.slice("Usage: ".length)}
+\`vinaya check\` refuses the entire run over a key it cannot resolve, so a bare, un-namespaced name would brick every check invocation in this repo.`);
     process.exit(2);
   }
   const scriptsDir = join15(process.cwd(), CHECKS_DIR);
   if (!existsSync13(scriptsDir))
     mkdirSync4(scriptsDir, { recursive: true });
-  const targetPath = join15(scriptsDir, `${name}.ts`);
+  const fileStem = name.slice(name.indexOf("/") + 1);
+  const targetPath = join15(scriptsDir, `${fileStem}.ts`);
   if (existsSync13(targetPath)) {
     console.error(`Error: ${targetPath} already exists.`);
     process.exit(1);
@@ -5040,7 +5105,7 @@ function newCheckCommand(args) {
   const contents = template.split("{{CHECK_NAME}}").join(name);
   writeFileSync7(targetPath, contents, "utf-8");
   chmodSync2(targetPath, 493);
-  const relPath = join15(CHECKS_DIR, `${name}.ts`);
+  const relPath = join15(CHECKS_DIR, `${fileStem}.ts`);
   const registration = JSON.stringify({ checks: { [name]: { run: `./${relPath}`, scope: "diff" } } }, null, 2);
   process.stdout.write(`Created ${relPath}
 
@@ -5204,14 +5269,193 @@ function prEditCommand(args) {
   runGhWrite2(["pr", "edit", prRef], ghArgs, bodyResult, json);
 }
 
+// src/commands/pr-report.ts
+import { execFileSync as execFileSync9, spawnSync as spawnSync2 } from "node:child_process";
+import { existsSync as existsSync14, readFileSync as readFileSync14, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join16 } from "node:path";
+var EVIDENCE_START = "<!-- AEG:EVIDENCE:START -->";
+var EVIDENCE_END = "<!-- AEG:EVIDENCE:END -->";
+function git3(args) {
+  try {
+    return execFileSync9("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+  } catch {
+    return "";
+  }
+}
+
+class GitCommandError extends Error {
+  args;
+  cause;
+  constructor(args, cause) {
+    super(`\`git ${args.join(" ")}\` failed: ${cause}`);
+    this.args = args;
+    this.cause = cause;
+    this.name = "GitCommandError";
+  }
+}
+function gitStrict(args) {
+  try {
+    return execFileSync9("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+  } catch (err) {
+    const stderr = err.stderr;
+    throw new GitCommandError(args, String(stderr ?? err.message).trim() || "non-zero exit");
+  }
+}
+
+class UnresolvableMergeBaseError extends Error {
+  head;
+  triedRefs;
+  constructor(head, triedRefs) {
+    super(`could not resolve a merge-base for HEAD (${head}) against any of: ${triedRefs.join(", ")}. ` + `This repo's default branch may not be named "main", or "origin" may not be configured — set BASE_SHA to override.`);
+    this.head = head;
+    this.triedRefs = triedRefs;
+    this.name = "UnresolvableMergeBaseError";
+  }
+}
+function resolveMergeBase(head) {
+  const primary = process.env.BASE_SHA || "origin/main";
+  const tried = primary === "main" ? [primary] : [primary, "main"];
+  for (const ref of tried) {
+    const base = git3(["merge-base", ref, head]);
+    if (base)
+      return base;
+  }
+  throw new UnresolvableMergeBaseError(head, tried);
+}
+function computeGroupA() {
+  const head = gitStrict(["rev-parse", "HEAD"]);
+  const base = resolveMergeBase(head);
+  const numstat = gitStrict(["diff", `${base}...${head}`, "--numstat"]);
+  return { head, base, numstat };
+}
+function resolveSelfEntry() {
+  const root = packageRoot(import.meta.url);
+  const dist = join16(root, "dist", "index.js");
+  return existsSync14(dist) ? dist : join16(root, "src", "index.ts");
+}
+var FAILING_STATUSES = new Set(["fail", "error", "timeout"]);
+function anyGateFailed(outcomes) {
+  return outcomes.some((o) => FAILING_STATUSES.has(o.status));
+}
+function runRealGates() {
+  const entry2 = resolveSelfEntry();
+  const proc = spawnSync2(process.execPath, [entry2, "check", "--all", "--diff-only", "--json"], {
+    cwd: process.cwd(),
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    maxBuffer: 32 * 1024 * 1024
+  });
+  const stdout = proc.stdout ?? "";
+  try {
+    const parsed = JSON.parse(stdout);
+    const outcomes = parsed.data.checks;
+    return { outcomes, failed: anyGateFailed(outcomes) };
+  } catch {
+    return {
+      outcomes: [
+        {
+          name: "check",
+          status: "error",
+          errors: [
+            { severity: "error", message: "`vinaya check --all --diff-only --json` did not produce parseable output." }
+          ]
+        }
+      ],
+      failed: true
+    };
+  }
+}
+function renderGroupA(groupA) {
+  return [
+    "### Group A — recomputable",
+    "",
+    `\`git diff ${groupA.base}...${groupA.head} --numstat\``,
+    "",
+    "```",
+    groupA.numstat,
+    "```"
+  ].join(`
+`);
+}
+function renderGroupB(outcomes) {
+  const sorted = [...outcomes].sort((a, b) => a.name.localeCompare(b.name));
+  const lines = sorted.flatMap((o) => {
+    const rows = [`${o.name}: ${o.status}`];
+    for (const e of o.errors)
+      rows.push(`  ${e.severity}: ${e.message}`);
+    return rows;
+  });
+  return ["### Group B — attested", "", "`vinaya check --all --diff-only`", "", "```", lines.join(`
+`), "```"].join(`
+`);
+}
+function buildBlockInner(groupA, gateOutcomes) {
+  return [`Head: ${groupA.head}`, "", renderGroupA(groupA), "", renderGroupB(gateOutcomes)].join(`
+`);
+}
+function replaceEvidenceBlock(body, blockInner) {
+  const full = `${EVIDENCE_START}
+${blockInner}
+${EVIDENCE_END}`;
+  const bounds = anchoredRegionBounds(body, "EVIDENCE");
+  if (bounds) {
+    return `${body.slice(0, bounds.outerStart)}${full}${body.slice(bounds.outerEnd)}`;
+  }
+  const sep4 = body.length === 0 || body.endsWith(`
+`) ? "" : `
+`;
+  return `${body}${sep4}
+${full}
+`;
+}
+async function buildReport(opts = {}) {
+  const groupA = opts.groupA ?? computeGroupA();
+  const gateRunner = opts.gateRunner ?? runRealGates;
+  const gateResult = await gateRunner();
+  const blockInner = buildBlockInner(groupA, gateResult.outcomes);
+  const block = `${EVIDENCE_START}
+${blockInner}
+${EVIDENCE_END}`;
+  return { block, blockInner, gatesFailed: gateResult.failed, gateOutcomes: gateResult.outcomes };
+}
+async function prReportCommand(args) {
+  const writeIdx = args.indexOf("--write");
+  const writePath = writeIdx !== -1 ? args[writeIdx + 1] : undefined;
+  if (writeIdx !== -1 && !writePath) {
+    console.error("Usage: vinaya pr report [--write <body-file>]");
+    process.exit(2);
+  }
+  let result;
+  try {
+    result = await buildReport();
+  } catch (err) {
+    if (err instanceof UnresolvableMergeBaseError || err instanceof GitCommandError) {
+      console.error(`vinaya pr report: refused — ${err.message}`);
+      process.exit(1);
+    }
+    throw err;
+  }
+  if (writePath) {
+    const existing = existsSync14(writePath) ? readFileSync14(writePath, "utf8") : "";
+    const updated = replaceEvidenceBlock(existing, result.blockInner);
+    writeFileSync8(writePath, updated);
+    process.stdout.write(`Wrote AEG:EVIDENCE block to ${writePath}
+`);
+  } else {
+    process.stdout.write(`${result.block}
+`);
+  }
+  process.exit(result.gatesFailed ? 1 : 0);
+}
+
 // src/commands/quickstart.ts
-import { execFileSync as execFileSync9 } from "node:child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync15 } from "node:fs";
-import { join as join17 } from "node:path";
+import { execFileSync as execFileSync10 } from "node:child_process";
+import { existsSync as existsSync16, readFileSync as readFileSync16 } from "node:fs";
+import { join as join18 } from "node:path";
 
 // src/lib/doc-owners-write.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync5, readFileSync as readFileSync14, writeFileSync as writeFileSync8 } from "node:fs";
-import { dirname as dirname6, join as join16 } from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync5, readFileSync as readFileSync15, writeFileSync as writeFileSync9 } from "node:fs";
+import { dirname as dirname6, join as join17 } from "node:path";
 function bindingLine(glob, pointer) {
   return `${glob}  ${pointer}`;
 }
@@ -5227,23 +5471,23 @@ function appendDocOwnersBinding(content, glob, pointer) {
 `;
 }
 function planDocOwnersBinding(repoRoot, glob, pointer) {
-  const abs2 = join16(repoRoot, DOC_OWNERS_PATH);
+  const abs2 = join17(repoRoot, DOC_OWNERS_PATH);
   const line = bindingLine(glob, pointer);
-  if (!existsSync14(abs2)) {
+  if (!existsSync15(abs2)) {
     return { action: "create-host", line, path: DOC_OWNERS_PATH };
   }
-  const existing = readFileSync14(abs2, "utf-8");
+  const existing = readFileSync15(abs2, "utf-8");
   const already = parseDocOwners(existing).bindings.some((b) => b.glob === glob);
   return { action: already ? "skip-present" : "append-row", line, path: DOC_OWNERS_PATH };
 }
 function applyDocOwnersBinding(repoRoot, plan, glob, pointer) {
-  const abs2 = join16(repoRoot, DOC_OWNERS_PATH);
+  const abs2 = join17(repoRoot, DOC_OWNERS_PATH);
   if (plan.action === "create-host") {
     mkdirSync5(dirname6(abs2), { recursive: true });
-    writeFileSync8(abs2, freshDocOwners(glob, pointer), "utf-8");
+    writeFileSync9(abs2, freshDocOwners(glob, pointer), "utf-8");
   } else if (plan.action === "append-row") {
-    const existing = readFileSync14(abs2, "utf-8");
-    writeFileSync8(abs2, appendDocOwnersBinding(existing, glob, pointer), "utf-8");
+    const existing = readFileSync15(abs2, "utf-8");
+    writeFileSync9(abs2, appendDocOwnersBinding(existing, glob, pointer), "utf-8");
   }
 }
 function renderDocOwnersBindingDiffLine(plan) {
@@ -5303,7 +5547,7 @@ function pointerIsMissingLocalFile(repoRoot, pointer) {
   if (/^https?:\/\//i.test(pointer))
     return false;
   const path = pointer.split("#")[0] ?? pointer;
-  return !existsSync15(join17(repoRoot, path));
+  return !existsSync16(join18(repoRoot, path));
 }
 async function bindDocOwnerLoop(deps, repoRoot) {
   let any = false;
@@ -5370,7 +5614,7 @@ async function registerProjectLoop(deps) {
   }
 }
 function readPackageVersion() {
-  const pkg = JSON.parse(readFileSync15(join17(packageRoot(import.meta.url), "package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync16(join18(packageRoot(import.meta.url), "package.json"), "utf-8"));
   return pkg.version;
 }
 function realDeps6() {
@@ -5401,7 +5645,7 @@ function realDeps6() {
   };
 }
 function execGit(repoRoot, args) {
-  return execFileSync9("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+  return execFileSync10("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 function errorDetail(err) {
   const stderr = err.stderr;
@@ -5519,9 +5763,9 @@ async function quickstartCommand(args) {
 
 // src/commands/studio.ts
 import { execFile as execFile5, spawn as spawn2 } from "node:child_process";
-import { existsSync as existsSync16, readFileSync as readFileSync16, renameSync } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync17, renameSync } from "node:fs";
 import net from "node:net";
-import { dirname as dirname7, join as join18 } from "node:path";
+import { dirname as dirname7, join as join19 } from "node:path";
 import { promisify as promisify5 } from "node:util";
 
 // src/lib/studio-bundle.ts
@@ -5537,25 +5781,25 @@ var FALLBACK_PORT = 3108;
 function resolveStudioTarget(cwd, moduleUrl = import.meta.url) {
   let dir = cwd;
   for (;; ) {
-    const webDir = join18(dir, "apps", "vinaya-studio", "web");
-    const pkgPath = join18(webDir, "package.json");
-    if (existsSync16(pkgPath)) {
+    const webDir = join19(dir, "apps", "vinaya-studio", "web");
+    const pkgPath = join19(webDir, "package.json");
+    if (existsSync17(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync16(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync17(pkgPath, "utf-8"));
         if (pkg.name === "@atta/vinaya-studio-web") {
           return { kind: "workspace", webDir };
         }
       } catch {}
     }
-    if (existsSync16(join18(dir, ".git")))
+    if (existsSync17(join19(dir, ".git")))
       break;
     const parent = dirname7(dir);
     if (parent === dir)
       break;
     dir = parent;
   }
-  const standaloneWebDir = join18(packageRoot(moduleUrl), "studio-standalone", "apps", "vinaya-studio", "web");
-  if (existsSync16(join18(standaloneWebDir, "server.js"))) {
+  const standaloneWebDir = join19(packageRoot(moduleUrl), "studio-standalone", "apps", "vinaya-studio", "web");
+  if (existsSync17(join19(standaloneWebDir, "server.js"))) {
     return { kind: "package", packageDir: standaloneWebDir };
   }
   return { kind: "missing" };
@@ -5575,9 +5819,9 @@ function isPortFree(port) {
   });
 }
 function ensureStudioNodeModules(bundleRoot) {
-  const real = join18(bundleRoot, "node_modules");
-  const packed = join18(bundleRoot, STUDIO_NODE_MODULES_PACKED_DIRNAME);
-  if (!existsSync16(real) && existsSync16(packed)) {
+  const real = join19(bundleRoot, "node_modules");
+  const packed = join19(bundleRoot, STUDIO_NODE_MODULES_PACKED_DIRNAME);
+  if (!existsSync17(real) && existsSync17(packed)) {
     renameSync(packed, real);
   }
 }
@@ -5603,8 +5847,8 @@ async function runStudio(cwd, args, moduleUrl = import.meta.url) {
     case "workspace":
       return spawnDev(target.webDir, args);
     case "package": {
-      const bundleRoot = join18(target.packageDir, "..", "..", "..");
-      return spawnStandalone(cwd, join18(target.packageDir, "server.js"), bundleRoot);
+      const bundleRoot = join19(target.packageDir, "..", "..", "..");
+      return spawnStandalone(cwd, join19(target.packageDir, "server.js"), bundleRoot);
     }
     case "missing":
       console.error("Vinaya Studio isn't available in this install — no published @attalabs/vinaya build bundles the Studio app yet. Inside a checkout that contains Studio's source (apps/vinaya-studio/web), `vinaya studio` runs it directly.");
@@ -5613,8 +5857,8 @@ async function runStudio(cwd, args, moduleUrl = import.meta.url) {
 }
 
 // src/commands/upgrade.ts
-import { existsSync as existsSync17, readFileSync as readFileSync17, rmSync as rmSync4, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync18, readFileSync as readFileSync18, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
+import { join as join20 } from "node:path";
 function realDeps7() {
   return {
     detectRepo: detectGitRepo,
@@ -5632,12 +5876,12 @@ function flags2(args) {
   return { dryRun: args.includes("--dry-run"), yes: args.includes("--yes") };
 }
 function readManifest3(repoRoot) {
-  const p = join19(repoRoot, CONFIG_PATH);
-  if (!existsSync17(p))
+  const p = join20(repoRoot, CONFIG_PATH);
+  if (!existsSync18(p))
     return { kind: "missing" };
   let raw;
   try {
-    raw = JSON.parse(readFileSync17(p, "utf-8"));
+    raw = JSON.parse(readFileSync18(p, "utf-8"));
   } catch (err) {
     return { kind: "invalid", error: `invalid JSON: ${err.message}` };
   }
@@ -5653,17 +5897,17 @@ function readManifest3(repoRoot) {
   return { kind: "ok", manifest: parsed.data.managed };
 }
 function writeManifestVersion(repoRoot, manifest) {
-  const configAbs = join19(repoRoot, CONFIG_PATH);
-  const seed = JSON.parse(readFileSync17(configAbs, "utf-8"));
+  const configAbs = join20(repoRoot, CONFIG_PATH);
+  const seed = JSON.parse(readFileSync18(configAbs, "utf-8"));
   const updated = { ...manifest, version: MANAGED_MANIFEST_VERSION };
-  writeFileSync9(configAbs, `${JSON.stringify({ ...seed, managed: updated }, null, 2)}
+  writeFileSync10(configAbs, `${JSON.stringify({ ...seed, managed: updated }, null, 2)}
 `, "utf-8");
 }
 function stripFor(repoRoot, path, marker, comment) {
   const abs2 = resolveManagedBlockPath(repoRoot, path);
-  if (!existsSync17(abs2))
+  if (!existsSync18(abs2))
     return { path, marker, comment, present: false, removesHost: false };
-  const stripped = stripBlockFromContent(readFileSync17(abs2, "utf-8"), marker, comment);
+  const stripped = stripBlockFromContent(readFileSync18(abs2, "utf-8"), marker, comment);
   if (stripped === null)
     return { path, marker, comment, present: false, removesHost: false };
   return { path, marker, comment, present: true, removesHost: blockStripLeavesEmpty(stripped) };
@@ -5690,9 +5934,9 @@ function planHookRouting(repoRoot, manifest, recorded, hooksPathValue) {
   const blocked = [];
   for (const b of legacy) {
     const abs2 = resolveManagedBlockPath(repoRoot, b.path);
-    if (!existsSync17(abs2))
+    if (!existsSync18(abs2))
       continue;
-    const stripped = stripBlockFromContent(readFileSync17(abs2, "utf-8"), b.marker, b.comment);
+    const stripped = stripBlockFromContent(readFileSync18(abs2, "utf-8"), b.marker, b.comment);
     if (stripped === null)
       blocked.push(`${b.path} exists without vinaya's managed block`);
     else if (!blockStripLeavesEmpty(stripped))
@@ -5727,8 +5971,8 @@ function planUpgrade(ops, repoRoot, manifest, routing) {
   const ownedBlocks = new Set(manifest.blocks.map((b) => blockKey(b.path, b.marker)));
   for (const op of ops) {
     if (op.kind === "create-file") {
-      const abs2 = join19(repoRoot, op.path);
-      const exists = existsSync17(abs2);
+      const abs2 = join20(repoRoot, op.path);
+      const exists = existsSync18(abs2);
       const owned = ownedFiles.has(op.path);
       let action;
       if (op.path === CONFIG_PATH || op.path === DOC_OWNERS_PATH) {
@@ -5738,7 +5982,7 @@ function planUpgrade(ops, repoRoot, manifest, routing) {
       } else if (!exists) {
         action = "recreate";
         hasChanges = true;
-      } else if (readFileSync17(abs2, "utf-8") !== op.content) {
+      } else if (readFileSync18(abs2, "utf-8") !== op.content) {
         action = "regenerate";
         hasChanges = true;
       } else {
@@ -5751,11 +5995,11 @@ function planUpgrade(ops, repoRoot, manifest, routing) {
       let action;
       if (!owned) {
         action = "not-installed";
-      } else if (!existsSync17(abs2)) {
+      } else if (!existsSync18(abs2)) {
         action = "recreate-host";
         hasChanges = true;
       } else {
-        const content = readFileSync17(abs2, "utf-8");
+        const content = readFileSync18(abs2, "utf-8");
         const { begin, end } = markerLines(op.marker, op.comment);
         if (!(content.includes(begin) && content.includes(end))) {
           action = "recreate-append";
@@ -5855,10 +6099,10 @@ function renderUpgradeDiff(plan) {
 }
 function regenerateBlock(repoRoot, op) {
   const abs2 = resolveManagedBlockPath(repoRoot, op.path);
-  const content = readFileSync17(abs2, "utf-8");
+  const content = readFileSync18(abs2, "utf-8");
   const stripped = stripBlockFromContent(content, op.marker, op.comment);
   if (stripped !== null) {
-    writeFileSync9(abs2, stripped.endsWith(`
+    writeFileSync10(abs2, stripped.endsWith(`
 `) ? stripped : `${stripped}
 `, "utf-8");
   }
@@ -5868,7 +6112,7 @@ function applyUpgrade(plan, repoRoot) {
   for (const e of plan.entries) {
     if (e.kind === "create-file") {
       if (e.action === "regenerate" || e.action === "recreate") {
-        writeFileWithDirs(join19(repoRoot, e.op.path), e.op.content, e.op.mode);
+        writeFileWithDirs(join20(repoRoot, e.op.path), e.op.content, e.op.mode);
       }
     } else {
       if (e.action === "recreate-host")
@@ -5883,15 +6127,15 @@ function applyUpgrade(plan, repoRoot) {
     if (!s.present)
       continue;
     const abs2 = resolveManagedBlockPath(repoRoot, s.path);
-    if (!existsSync17(abs2))
+    if (!existsSync18(abs2))
       continue;
-    const stripped = stripBlockFromContent(readFileSync17(abs2, "utf-8"), s.marker, s.comment);
+    const stripped = stripBlockFromContent(readFileSync18(abs2, "utf-8"), s.marker, s.comment);
     if (stripped === null)
       continue;
     if (blockStripLeavesEmpty(stripped))
       rmSync4(abs2, { force: true });
     else
-      writeFileSync9(abs2, stripped.endsWith(`
+      writeFileSync10(abs2, stripped.endsWith(`
 `) ? stripped : `${stripped}
 `, "utf-8");
   }
@@ -5973,12 +6217,12 @@ async function upgradeCommand(args) {
 }
 
 // src/commands/waiver.ts
-import { execFileSync as execFileSync10 } from "node:child_process";
+import { execFileSync as execFileSync11 } from "node:child_process";
 function labelFor(kind) {
   return kind === "docs" ? WAIVER_LABEL : WAIVER_LABEL_REVIEW;
 }
 function gh(args) {
-  return execFileSync10("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: process.env }).trim();
+  return execFileSync11("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: process.env }).trim();
 }
 function detectPrNumber() {
   try {
@@ -6078,8 +6322,8 @@ Reason: ${reason}`];
   }
   process.stdout.write(`Applying \`${label2}\` to PR #${prNumber} under your authenticated \`gh\` identity — vinaya never fabricates an actor.
 `);
-  execFileSync10("gh", editArgs, { stdio: "inherit", env: process.env });
-  execFileSync10("gh", commentArgs, { stdio: "inherit", env: process.env });
+  execFileSync11("gh", editArgs, { stdio: "inherit", env: process.env });
+  execFileSync11("gh", commentArgs, { stdio: "inherit", env: process.env });
   process.stdout.write(`
 ✓ Label applied and reason posted as a PR comment.
 `);
@@ -6149,7 +6393,8 @@ var COMMANDS = [
     ],
     details: [
       "Each spawned check's child process sees only a fixed baseline (`PATH`, `LANG`, `HOME`, `HTTPS_PROXY`, `HTTP_PROXY`, `NO_PROXY`, `TMPDIR`) plus whatever its `CheckSpec['env']` declaration explicitly forwards — never the full parent environment. A required (`true`) or unsatisfied `anyOf` declaration missing from the caller's environment synthesizes a `CheckError` before the check ever spawns. Declare `env` (a core check's own registration, or `vinaya.config.json`'s `checks.<name>.env` for a custom one) for any check that reads `process.env`/`Bun.env`/`Deno.env` directly — `vinaya doctor` carries the permanent diagnostic for one that doesn't.",
-      "`--plan` composes with `--json`. It requires zero env vars and never prints an env value — only how each one resolves (passthrough, optional, literal, or anyOf). A `FAIL_CLOSED` entry (a bare key with no namespace matching no core check) always renders inline rather than being dropped, and exits non-zero. `--plan` previews what the next minor's execution will enforce — `vinaya check` itself still runs the flat, unvalidated registry this release.",
+      "The resolved registry IS what runs. A `checks` key that exactly matches a core check id REPLACES that core check (the core one does not run); any other key must be namespaced `<yourname>/<id>`. Anything the resolver cannot classify — a malformed entry, a bare un-namespaced key matching no core id, a duplicate id — makes `vinaya check` refuse the ENTIRE run: exit 1, nothing executes, never a partial ruleset and never a core-only fallback. `vinaya doctor` carries the permanent diagnostic for each rejected entry, so a refused config is still diagnosable.",
+      "`--plan` composes with `--json`. It requires zero env vars and never prints an env value — only how each one resolves (passthrough, optional, literal, or anyOf). A `FAIL_CLOSED` entry always renders inline rather than being dropped, and exits non-zero. `--plan` and execution read the same resolution, so what the plan prints is what runs.",
       "`--local` exists because a `requiresOpenPr` check (the core `closes-n`/`test-plan`, or a custom check declaring the same field) can only evaluate for real once a pull request exists — the generated `pre-commit`/`pre-push` hooks pass it so the first commit on a fresh task branch is never asked to satisfy a PR-body field before a PR can possibly exist. CI's `vinaya-checks.yml` omits it, so these checks always run for real once a PR is open."
     ],
     status: "shipped"
@@ -6157,6 +6402,9 @@ var COMMANDS = [
   {
     name: "new check",
     description: "Scaffold a custom check into ./scripts/vinaya-checks/",
+    details: [
+      "Takes the REGISTRATION KEY, not a bare name: `vinaya new check <yourname>/<id>` writes `./scripts/vinaya-checks/<id>.ts` and prints the namespaced `checks` entry to paste. It refuses a bare, un-namespaced name — `vinaya check` refuses its entire run over a key it cannot resolve, so scaffolding one would brick every check invocation in the repo — and refuses a core check id, since registering one REPLACES that core gate and a scaffolded stub is never what an adopter means by that."
+    ],
     status: "shipped"
   },
   {
@@ -6191,6 +6439,21 @@ var COMMANDS = [
     ],
     status: "shipped"
   },
+  {
+    name: "pr report",
+    description: "Emit the AEG:EVIDENCE block — a PR body's factual claims, from commands, never typed",
+    flags: [
+      {
+        flag: "--write",
+        description: "Path to the PR body file; replaces the content between the AEG:EVIDENCE anchors in place"
+      }
+    ],
+    details: [
+      "Two groups: Group A (recomputable) is the head sha and a width-invariant `git diff --numstat` against the merge-base with `BASE_SHA` (else `origin/main`, then `main`) — `check-evidence-fresh` recomputes and byte-compares this exactly. Group B (attested) is the result of `vinaya check --all --diff-only`, this CLI's own portable gate suite — `check-evidence-fresh` can only check it for staleness (the block's recorded head still matches the PR's real head), never re-run it.",
+      "With no `--write`, prints the block to stdout instead of writing a file. Exits non-zero whenever the gate run failed, whether or not `--write` was given — the block records a failing result rather than hiding one, and a non-zero exit stops a scripted `--write && open-pr` from carrying a failing suite onto the forge."
+    ],
+    status: "shipped"
+  },
   {
     name: "issue create",
     description: "Open an issue after full brief-schema validation",
@@ -6225,7 +6488,8 @@ var COMMANDS = [
     description: "Diagnose hook, workflow, and config health — report only, never mutates",
     flags: [{ flag: "--json", description: "Enveloped JSON output (schema: 1)" }],
     details: [
-      'Carries the same env-declaration diagnostic `vinaya check` warns with — permanently, at `info` severity, not just ahead of the spawn-default flip — plus a `warn`-severity lint over suspicious `env` literal forms (a stray `"true"`/`"false"` string, or a high-entropy literal that reads like a leaked secret committed to config).'
+      'Carries the same env-declaration diagnostic `vinaya check` warns with — permanently, at `info` severity, not just ahead of the spawn-default flip — plus a `warn`-severity lint over suspicious `env` literal forms (a stray `"true"`/`"false"` string, or a high-entropy literal that reads like a leaked secret committed to config).',
+      "Also carries the two permanent `checks`-classification diagnostics: a config key that REPLACES a core check (`warn`), and a bare un-namespaced key that is REJECTED (`error`, naming the rename requirement). These are the reason a config `vinaya check` now refuses outright is still diagnosable — the refusal runs nothing, so `doctor` is the surface that explains why."
     ],
     status: "shipped"
   },
@@ -6364,9 +6628,9 @@ function printHelp() {
 }
 
 // src/index.ts
-var PACKAGE_ROOT = join20(dirname8(fileURLToPath2(import.meta.url)), "..");
+var PACKAGE_ROOT = join21(dirname8(fileURLToPath2(import.meta.url)), "..");
 function readVersion2() {
-  const pkg = JSON.parse(readFileSync18(join20(PACKAGE_ROOT, "package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync19(join21(PACKAGE_ROOT, "package.json"), "utf-8"));
   return pkg.version;
 }
 var [, , command, ...args] = process.argv;
@@ -6449,8 +6713,10 @@ try {
         prCreateCommand(rest);
       } else if (subcommand === "edit") {
         prEditCommand(rest);
+      } else if (subcommand === "report") {
+        await prReportCommand(rest);
       } else {
-        console.error(`Unknown 'pr' subcommand: ${subcommand ?? "(none)"} (expected 'create' or 'edit')`);
+        console.error(`Unknown 'pr' subcommand: ${subcommand ?? "(none)"} (expected 'create', 'edit', or 'report')`);
         process.exit(2);
       }
       break;