@attalabs/vinaya 0.9.0 → 0.16.0

package/dist/index.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync18 } from "node:fs";
-import { dirname as dirname8, join as join20 } from "node:path";
+import { readFileSync as readFileSync20 } from "node:fs";
+import { dirname as dirname8, join as join22 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/commands/archive.ts
-import { execFileSync as execFileSync3 } from "node:child_process";
-// ../../packages/aeg-core/src/anchored-region.ts
+import { execFileSync as execFileSync4 } from "node:child_process";
+// ../../packages/aeg-forge-state/src/strip-code.ts
 function maskCode(body) {
   const fill = (line) => " ".repeat(line.length);
   return maskIndentedCode(maskFencedCode(body, fill), fill).replace(/(`+)[^\n]*?\1/g, (m) => " ".repeat(m.length));
@@ -24,29 +24,34 @@ function stripCode(body, options = {}) {
 var FENCE_OPEN = /^ {0,3}(`{3,}|~{3,})([^\r\n]*)\r?$/;
 var FENCE_CLOSE = /^ {0,3}(`+|~+)[ \t]*\r?$/;
 function maskFencedCode(body, fill) {
+  const { lines } = scanFencedCode(body);
+  return lines.map(({ line, inCode }) => inCode ? fill(line) : line).join(`
+`);
+}
+function scanFencedCode(body) {
   let fenceChar = null;
   let fenceLen = 0;
-  return body.split(`
+  const lines = body.split(`
 `).map((line) => {
     if (fenceChar === null) {
       const open = line.match(FENCE_OPEN);
       if (!open)
-        return line;
+        return { line, inCode: false };
       const marker = open[1];
       if (marker[0] === "`" && open[2].includes("`"))
-        return line;
+        return { line, inCode: false };
       fenceChar = marker[0];
       fenceLen = marker.length;
-      return fill(line);
+      return { line, inCode: true };
     }
     const close = line.match(FENCE_CLOSE);
     if (close && close[1][0] === fenceChar && close[1].length >= fenceLen) {
       fenceChar = null;
       fenceLen = 0;
     }
-    return fill(line);
-  }).join(`
-`);
+    return { line, inCode: true };
+  });
+  return { lines, unterminated: fenceChar !== null };
 }
 var LIST_MARKER = /^ {0,3}(?:[-*+]|\d{1,9}[.)])(?:\s|$)/;
 function indentWidth(line) {
@@ -89,88 +94,7 @@ function maskIndentedCode(body, fill) {
   return out.join(`
 `);
 }
-function anchoredRegion(body, field) {
-  const masked = maskCode(body);
-  const start = new RegExp(`<!--\\s*AEG:${field}:START\\s*-->`).exec(masked);
-  if (!start)
-    return null;
-  const afterStart = start.index + start[0].length;
-  const end = new RegExp(`<!--\\s*AEG:${field}:END\\s*-->`).exec(masked.slice(afterStart));
-  if (!end)
-    return null;
-  return body.slice(afterStart, afterStart + end.index);
-}
-// ../../packages/aeg-core/src/parse-registry.ts
-function parseRegistry(md) {
-  const rows = readMarkdownTable(md, /^##\s+Registry\b/i);
-  const projects = [];
-  for (const row of rows) {
-    if (row.length < 4)
-      continue;
-    const name = stripBackticks(row[0] ?? "").trim();
-    const path = stripBackticks(row[1] ?? "").trim();
-    const specsPath = stripBackticks(row[2] ?? "").trim();
-    const stateCell = (row[3] ?? "").trim();
-    if (!name || !path || !specsPath)
-      continue;
-    projects.push({
-      name,
-      path,
-      specsPath,
-      statePath: parseStateCell(stateCell)
-    });
-  }
-  return projects;
-}
-function parseStateCell(cell) {
-  if (!cell)
-    return null;
-  const stripped = stripBackticks(cell).trim();
-  if (/^[\w./@-]+\/?$/.test(stripped) && cell.includes("`")) {
-    return stripped;
-  }
-  return null;
-}
-function stripBackticks(s) {
-  return s.replace(/`/g, "");
-}
-function readMarkdownTable(md, headingMatcher) {
-  const lines = md.split(/\r?\n/);
-  let i = 0;
-  for (;i < lines.length; i++) {
-    if (headingMatcher.test(lines[i] ?? "")) {
-      i++;
-      break;
-    }
-  }
-  if (i >= lines.length)
-    return [];
-  for (;i < lines.length; i++) {
-    if ((lines[i] ?? "").trim().startsWith("|"))
-      break;
-  }
-  if (i + 1 >= lines.length)
-    return [];
-  i += 2;
-  const out = [];
-  for (;i < lines.length; i++) {
-    const trimmed = (lines[i] ?? "").trim();
-    if (!trimmed.startsWith("|"))
-      break;
-    out.push(splitTableRow(trimmed));
-  }
-  return out;
-}
-function splitTableRow(row) {
-  const PLACEHOLDER = "\x00PIPE\x00";
-  const escaped = row.replace(/\\\|/g, PLACEHOLDER);
-  const parts = escaped.split("|").map((s) => s.trim());
-  if (parts.length && parts[0] === "")
-    parts.shift();
-  if (parts.length && parts[parts.length - 1] === "")
-    parts.pop();
-  return parts.map((p) => p.split(PLACEHOLDER).join("|"));
-}
+
 // ../../packages/aeg-forge-state/src/parse-rationale-deps.ts
 var SECTION_HEADER = /\*\*Dependency rationale\*\*/i;
 // ../../packages/aeg-forge-state/src/gh.ts
@@ -378,6 +302,175 @@ function parseOwnerRepo(value) {
     return null;
   return { owner: match[1], repo: match[2] };
 }
+// ../../packages/aeg-core/src/anchored-region.ts
+function anchoredRegionBounds(body, field) {
+  const masked = maskCode(body);
+  const start = new RegExp(`<!--\\s*AEG:${field}:START\\s*-->`).exec(masked);
+  if (!start)
+    return null;
+  const innerStart = start.index + start[0].length;
+  const end = new RegExp(`<!--\\s*AEG:${field}:END\\s*-->`).exec(masked.slice(innerStart));
+  if (!end)
+    return null;
+  const innerEnd = innerStart + end.index;
+  return { outerStart: start.index, outerEnd: innerEnd + end[0].length, innerStart, innerEnd };
+}
+function anchoredRegion(body, field) {
+  const bounds = anchoredRegionBounds(body, field);
+  if (!bounds)
+    return null;
+  return body.slice(bounds.innerStart, bounds.innerEnd);
+}
+// ../../packages/aeg-core/src/parse-registry.ts
+function parseRegistry(md) {
+  const rows = readMarkdownTable(md, /^##\s+Registry\b/i);
+  const projects = [];
+  for (const row of rows) {
+    if (row.length < 4)
+      continue;
+    const name = stripBackticks(row[0] ?? "").trim();
+    const path = stripBackticks(row[1] ?? "").trim();
+    const specsPath = stripBackticks(row[2] ?? "").trim();
+    const stateCell = (row[3] ?? "").trim();
+    if (!name || !path || !specsPath)
+      continue;
+    projects.push({
+      name,
+      path,
+      specsPath,
+      statePath: parseStateCell(stateCell)
+    });
+  }
+  return projects;
+}
+function parseStateCell(cell) {
+  if (!cell)
+    return null;
+  const stripped = stripBackticks(cell).trim();
+  if (/^[\w./@-]+\/?$/.test(stripped) && cell.includes("`")) {
+    return stripped;
+  }
+  return null;
+}
+function stripBackticks(s) {
+  return s.replace(/`/g, "");
+}
+function readMarkdownTable(md, headingMatcher) {
+  const lines = md.split(/\r?\n/);
+  let i = 0;
+  for (;i < lines.length; i++) {
+    if (headingMatcher.test(lines[i] ?? "")) {
+      i++;
+      break;
+    }
+  }
+  if (i >= lines.length)
+    return [];
+  for (;i < lines.length; i++) {
+    if ((lines[i] ?? "").trim().startsWith("|"))
+      break;
+  }
+  if (i + 1 >= lines.length)
+    return [];
+  i += 2;
+  const out = [];
+  for (;i < lines.length; i++) {
+    const trimmed = (lines[i] ?? "").trim();
+    if (!trimmed.startsWith("|"))
+      break;
+    out.push(splitTableRow(trimmed));
+  }
+  return out;
+}
+function splitTableRow(row) {
+  const PLACEHOLDER = "\x00PIPE\x00";
+  const escaped = row.replace(/\\\|/g, PLACEHOLDER);
+  const parts = escaped.split("|").map((s) => s.trim());
+  if (parts.length && parts[0] === "")
+    parts.shift();
+  if (parts.length && parts[parts.length - 1] === "")
+    parts.pop();
+  return parts.map((p) => p.split(PLACEHOLDER).join("|"));
+}
+// ../../packages/aeg-core/src/blast-radius-domains.ts
+function resolveWorkspaceEntry(entry2, listDirs) {
+  if (entry2.endsWith("/*")) {
+    const baseDir = entry2.slice(0, -2);
+    return listDirs(baseDir).map((name) => `${baseDir}/${name}`);
+  }
+  if (entry2.includes("*"))
+    return [];
+  return [entry2];
+}
+function deriveWorkspacePackageDomains(workspaces, listDirs) {
+  const positive = workspaces.filter((entry2) => !entry2.startsWith("!"));
+  const negative = workspaces.filter((entry2) => entry2.startsWith("!")).map((entry2) => entry2.slice(1));
+  const excluded = new Set;
+  for (const entry2 of negative) {
+    for (const member of resolveWorkspaceEntry(entry2, listDirs))
+      excluded.add(member);
+  }
+  const domains = new Set;
+  for (const entry2 of positive) {
+    for (const member of resolveWorkspaceEntry(entry2, listDirs)) {
+      if (excluded.has(member))
+        continue;
+      const segments = member.split("/");
+      if (segments[0] !== "packages" || segments.length < 2)
+        continue;
+      domains.add(`packages/${segments[1]}`);
+    }
+  }
+  return [...domains].sort();
+}
+function parsePnpmWorkspaceYaml(content) {
+  const unquote = (s) => {
+    const t = s.trim();
+    if (t.length >= 2 && (t[0] === "'" && t.at(-1) === "'" || t[0] === '"' && t.at(-1) === '"')) {
+      return t.slice(1, -1);
+    }
+    return t;
+  };
+  const inlineMatch = content.match(/^packages:\s*\[(.*)\]\s*$/m);
+  if (inlineMatch) {
+    return (inlineMatch[1] ?? "").split(",").map(unquote).filter((s) => s.length > 0);
+  }
+  const entries = [];
+  let inBlock = false;
+  for (const rawLine of content.split(`
+`)) {
+    const line = rawLine.replace(/#.*$/, "");
+    if (/^packages:\s*$/.test(line)) {
+      inBlock = true;
+      continue;
+    }
+    if (!inBlock)
+      continue;
+    const itemMatch = line.match(/^\s+-\s*(.+?)\s*$/);
+    if (itemMatch?.[1]) {
+      entries.push(unquote(itemMatch[1]));
+      continue;
+    }
+    if (line.trim().length === 0)
+      continue;
+    break;
+  }
+  return entries;
+}
+var CROSS_CUTTING_CANDIDATES = [
+  "bun.lock",
+  "package-lock.json",
+  "pnpm-lock.yaml",
+  "yarn.lock",
+  "turbo.json",
+  "biome.json",
+  "tsconfig.json",
+  ".github/workflows",
+  ".husky"
+];
+function deriveBuiltinCrossCuttingDefaults(exists) {
+  return CROSS_CUTTING_CANDIDATES.filter((path) => exists(path));
+}
 // ../../packages/aeg-core/src/state-machine-model.ts
 var FORGE_FACT_INPUTS = [
   {
@@ -443,12 +536,30 @@ var DERIVED_STATUSES = [
   "incoherent"
 ];
 var DERIVABLE_STATUSES = DERIVED_STATUSES.filter((s) => s !== "backlog");
+// ../../packages/aeg-core/src/file-classify.ts
+function isCodeFile(p) {
+  if (p.endsWith(".md"))
+    return false;
+  return /\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs|sql|css)$/.test(p);
+}
 // ../../packages/aeg-core/src/waiver-label.ts
 var WAIVER_LABEL = label("waiver-docs");
 var WAIVER_LABEL_REVIEW = label("waiver-review");
+var PRINCIPAL_ALLOWLIST = ["daniboomerang"];
+function isPrincipal(login, principalAllowlist) {
+  if (login === null)
+    return false;
+  const normalized = login.toLowerCase();
+  return principalAllowlist.some((p) => p.toLowerCase() === normalized);
+}
 
 // ../../packages/aeg-core/src/doc-owners.ts
 var DOC_OWNERS_PATH = ".vinaya/doc-owners";
+function classifyDocOwnersManifest(content) {
+  if (content === null)
+    return "absent";
+  return content.trim() === "" ? "empty" : "present";
+}
 function parseDocOwners(content) {
   const bindings = [];
   const errors = [];
@@ -493,6 +604,13 @@ function globToRegex(pat) {
   re += "$";
   return new RegExp(re);
 }
+function isUrlPointer(p) {
+  return /^https?:\/\//.test(p);
+}
+function pointerToPath(p) {
+  const idx = p.indexOf("#");
+  return idx === -1 ? p : p.slice(0, idx);
+}
 var SEPARATOR = /(?:[ \t]*[—–][ \t]*|[ \t]+-[ \t]+)/.source;
 // ../../packages/aeg-core/src/pr-tier.ts
 function readTierFromPrBody(prBody) {
@@ -779,15 +897,25 @@ function isTaskIssueLabelSet(labels) {
 // ../../packages/aeg-core/src/coherence-checks.ts
 var R1_GRANDFATHERED_ISSUES = new Set([279, 280, 281, 282]);
 // ../../packages/aeg-core/src/verdict-extraction.ts
+var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
+function extractHeadSha(comment) {
+  const m = comment.match(HEAD_SHA_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
 function extractVerdict(comments, valuePattern, missingLabel) {
   const clearHits = comments.filter((c) => valuePattern.test(c));
   if (clearHits.length > 0) {
     const latest = clearHits[clearHits.length - 1];
     const m = latest.match(valuePattern);
-    return { value: m[1].toUpperCase().replace(/[_-]/g, " "), danglingNote: null };
+    return {
+      value: m[1].toUpperCase().replace(/[_-]/g, " "),
+      headSha: extractHeadSha(latest),
+      danglingNote: null
+    };
   }
   return {
     value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
+    headSha: null,
     danglingNote: `no ${missingLabel} verdict comment found on this PR`
   };
 }
@@ -970,6 +1098,10 @@ function starterConfig() {
     }
   };
 }
+function ownVersion() {
+  const pkg = JSON.parse(readFileSync(join2(packageRoot(import.meta.url), "package.json"), "utf-8"));
+  return pkg.version;
+}
 var SETUP_BUN_SHA = "0c5077e51419868618aeaa5fe8019c62421857d6";
 function vinayaSetupSteps(selfHost) {
   if (!selfHost)
@@ -1001,7 +1133,7 @@ function vinayaSetupSteps(selfHost) {
 `;
 }
 function vinayaRun(selfHost, args) {
-  return selfHost ? `node ${selfHost.bin} ${args}` : `npx --yes @attalabs/vinaya ${args}`;
+  return selfHost ? `node ${selfHost.bin} ${args}` : `npx --yes @attalabs/vinaya@${ownVersion()} ${args}`;
 }
 function adopterSetupStep(ciSetup) {
   if (!ciSetup)
@@ -1427,10 +1559,6 @@ ${vinayaSetupSteps(selfHost)}      - name: Run vinaya audit --only=direct-push
 }
 var HOOK_PREAMBLE = `#!/usr/bin/env sh
 `;
-function ownVersion() {
-  const pkg = JSON.parse(readFileSync(join2(packageRoot(import.meta.url), "package.json"), "utf-8"));
-  return pkg.version;
-}
 function hookRun(selfHost, args) {
   if (!selfHost)
     return `npx --yes @attalabs/vinaya@${ownVersion()} ${args} || exit 1`;
@@ -1522,6 +1650,14 @@ function starterDocOwners() {
 #   This file absent, OR no glob matches any changed code file → silent no-op.
 #   The gate has no opinion until you teach it one.
 #
+# \`vinaya doctor\` (never \`vinaya check\`) separately reports — it does not
+# fail the check — any binding whose code glob matches zero tracked files
+# anywhere in the repo, or whose in-repo pointer doesn't exist on disk. This
+# catches what the dormancy rule above structurally cannot: a glob matching
+# nothing trivially satisfies "no changed file matched" on every diff,
+# forever, so a binding naming deleted or renamed code reads as healthy
+# indefinitely unless something walks the whole repo, not just one diff.
+#
 # ── No-doc allow-list ───────────────────────────────────────────────────────
 # Surfaces that legitimately need no bound doc are listed below. Format:
 #   # no-doc: <glob> — <reason>
@@ -1654,11 +1790,12 @@ function buildInitProductOps(name) {
 }
 
 // src/lib/ops.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
+import { execFileSync as execFileSync3 } from "node:child_process";
 import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname3, isAbsolute, join as join4, resolve, sep } from "node:path";
 
 // src/lib/config.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname as dirname2, join as join3 } from "node:path";
@@ -1786,7 +1923,8 @@ var VinayaConfigSchema = z.object({
   briefSchema: BriefSchemaSchema.optional(),
   managed: ManagedManifestSchema.optional(),
   principals: z.array(z.string()).min(1).optional(),
-  ci: z.object({ setup: z.string().min(1) }).optional()
+  ci: z.object({ setup: z.string().min(1) }).optional(),
+  blastRadius: z.object({ extraDomains: z.array(z.string()).optional() }).optional()
 });
 var GLOBAL_VINAYA_HOME = join3(homedir(), ".vinaya");
 var GLOBAL_CONFIG_PATH = join3(GLOBAL_VINAYA_HOME, "config.json");
@@ -1833,6 +1971,75 @@ function stripGlobalOnlyKeys(config, path) {
   }
   return result;
 }
+function resolvePrincipalAllowlist(config) {
+  return config?.principals ?? PRINCIPAL_ALLOWLIST;
+}
+function trustAnchorRepo() {
+  const wellFormed = (slug) => /^[^/\s]+\/[^/\s]+$/.test(slug) ? slug : null;
+  const fromRunner = process.env.GITHUB_REPOSITORY?.trim();
+  if (fromRunner) {
+    const validated = wellFormed(fromRunner);
+    if (validated)
+      return validated;
+  }
+  try {
+    const url = execFileSync2("git", ["remote", "get-url", "origin"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+    const m = url.match(/github\.com[:/]([^/]+)\/(.+?)(?:\.git)?\/?$/);
+    return m?.[1] && m[2] ? wellFormed(`${m[1]}/${m[2]}`) : null;
+  } catch {
+    return null;
+  }
+}
+function ghFetchTrustAnchorConfig() {
+  const repo = trustAnchorRepo();
+  if (!repo)
+    throw new Error("could not resolve repo identity for the trust-anchor read");
+  return execFileSync2("gh", ["api", `repos/${repo}/contents/${LOCAL_CONFIG_FILENAME}`, "--jq", ".content"], {
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+}
+function firstLine(err) {
+  return err?.message?.split(`
+`)[0] ?? "unknown error";
+}
+function isMissingFileError(err) {
+  const stderr = err?.stderr;
+  const haystack = [
+    err?.message ?? "",
+    typeof stderr === "string" ? stderr : stderr?.toString() ?? ""
+  ].join(`
+`);
+  return /\b404\b|not found/i.test(haystack);
+}
+function loadTrustAnchorConfig(fetcher = ghFetchTrustAnchorConfig) {
+  const warn = (why) => process.stdout.write(`⚠ could not read \`principals\` from the default branch (${why}) — falling back to vinaya's built-in principal allowlist.
+`);
+  let base64;
+  try {
+    base64 = fetcher().trim();
+  } catch (err) {
+    if (!isMissingFileError(err))
+      warn(firstLine(err));
+    return null;
+  }
+  if (!base64)
+    return null;
+  try {
+    const raw = Buffer.from(base64, "base64").toString("utf-8");
+    const parsed = VinayaConfigSchema.safeParse(JSON.parse(raw));
+    if (parsed.success)
+      return parsed.data;
+    warn("it did not satisfy the config schema");
+    return null;
+  } catch {
+    warn("it was not readable as JSON");
+    return null;
+  }
+}
 function readRepoCiSetup(repoRoot) {
   const p = join3(repoRoot, "vinaya.config.json");
   if (!existsSync2(p))
@@ -1883,7 +2090,7 @@ function resolveManagedBlockPath(repoRoot, opPath) {
   if (!opPath.startsWith(".git/"))
     return join4(repoRoot, opPath);
   try {
-    const commonDir = execFileSync2("git", ["-C", repoRoot, "rev-parse", "--git-common-dir"], {
+    const commonDir = execFileSync3("git", ["-C", repoRoot, "rev-parse", "--git-common-dir"], {
       encoding: "utf8"
     }).trim();
     const gitDir = isAbsolute(commonDir) ? commonDir : join4(repoRoot, commonDir);
@@ -2449,7 +2656,7 @@ function realDeps() {
   return { detectRepo: detectGitRepo };
 }
 function sh(args, input) {
-  return execFileSync3(args[0], args.slice(1), { encoding: "utf8", input }).trim();
+  return execFileSync4(args[0], args.slice(1), { encoding: "utf8", input }).trim();
 }
 function shJson(args) {
   return JSON.parse(sh(args));
@@ -2625,7 +2832,7 @@ async function archiveTrancheCommand(args) {
 }
 
 // src/commands/audit.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
+import { execFileSync as execFileSync5 } from "node:child_process";
 
 // src/lib/envelope.ts
 var ENVELOPE_SCHEMA_VERSION = 1;
@@ -2653,7 +2860,7 @@ var DIRECT_PUSH_MARKER = `<!-- ${DIRECT_PUSH_LABEL} -->`;
 var DIRECT_PUSH_LABEL_DESCRIPTION = "A commit landed on main with no associated merged PR (ring-2 detection)";
 function shSoft(args, input) {
   try {
-    return execFileSync4(args[0], args.slice(1), {
+    return execFileSync5(args[0], args.slice(1), {
       encoding: "utf8",
       input,
       timeout: COMMAND_TIMEOUT_MS
@@ -2677,7 +2884,7 @@ function shSoftJson(args) {
   }
 }
 function sh2(args, input) {
-  return execFileSync4(args[0], args.slice(1), { encoding: "utf8", input }).trim();
+  return execFileSync5(args[0], args.slice(1), { encoding: "utf8", input }).trim();
 }
 function listTaskBranches() {
   const out = shSoft(["git", "ls-remote", "--heads", "origin", "task/*"]);
@@ -2927,7 +3134,7 @@ async function auditCommand(args) {
 }
 
 // src/commands/check.ts
-import { execFileSync as execFileSync5 } from "node:child_process";
+import { execFileSync as execFileSync6 } from "node:child_process";
 
 // src/checks/contract.ts
 var CHECK_SCHEMA_VERSION = 1;
@@ -3132,17 +3339,31 @@ function coreCheckRegistry() {
         GITHUB_TOKEN: { optional: true },
         GH_TOKEN: { optional: true }
       }
-    }
-  ];
-}
-
-// src/checks/resolver.ts
-var NAMESPACE_SEGMENT = /^[a-z0-9][a-z0-9-]*$/;
-var RESERVED_PREFIX = "vinaya";
-function isValidNamespacedKey(key) {
-  const parts = key.split("/");
-  if (parts.length !== 2)
-    return false;
+    },
+    {
+      name: "evidence-fresh",
+      run: bin("check-evidence-fresh"),
+      scope: "diff",
+      timeoutMs: 15000,
+      requiresOpenPr: true,
+      env: {
+        PR_NUMBER: { optional: true },
+        PR_BODY: { optional: true },
+        BASE_SHA: { optional: true },
+        GITHUB_TOKEN: { optional: true },
+        GH_TOKEN: { optional: true }
+      }
+    }
+  ];
+}
+
+// src/checks/resolver.ts
+var NAMESPACE_SEGMENT = /^[a-z0-9][a-z0-9-]*$/;
+var RESERVED_PREFIX = "vinaya";
+function isValidNamespacedKey(key) {
+  const parts = key.split("/");
+  if (parts.length !== 2)
+    return false;
   const [prefix, rest] = parts;
   if (!prefix || !rest)
     return false;
@@ -3177,11 +3398,16 @@ function resolveChecks(core, configChecks) {
   }
   return { resolved, failures };
 }
-function overriddenNextMinorWarning(name) {
-  return `check "${name}" shares its name with a core check — it will replace the core check starting next minor (currently it runs alongside it under the flat registry).`;
+var MAX_KEY_DISPLAY_LENGTH = 80;
+function sanitizeKeyForDisplay(key) {
+  const stripped = key.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ");
+  return stripped.length > MAX_KEY_DISPLAY_LENGTH ? `${stripped.slice(0, MAX_KEY_DISPLAY_LENGTH)}…` : stripped;
+}
+function overriddenReplacesCoreDiagnostic(name) {
+  return `check "${sanitizeKeyForDisplay(name)}" shares its name with a core check — it REPLACES that core check. The core check does not run.`;
 }
-function bareKeyNextMinorWarning(key) {
-  return `check "${key}" has no namespace and matches no core check — it will be rejected starting next minor. Rename it to "<yourname>/x".`;
+function bareKeyRejectedDiagnostic(key) {
+  return `check "${sanitizeKeyForDisplay(key)}" has no namespace and matches no core check — it is REJECTED, and \`vinaya check\` refuses the whole run rather than executing a partial ruleset. Rename it to "<yourname>/<id>", both segments matching [a-z0-9][a-z0-9-]* — prefixing alone is not enough when the bare name itself breaks that grammar ("my_check", "QALint" need a real rename, not just a prefix).`;
 }
 
 // src/checks/runner.ts
@@ -3445,7 +3671,7 @@ async function runChecks(specs, opts) {
 // src/commands/check.ts
 function git(args) {
   try {
-    return execFileSync5("git", args, { encoding: "utf8" }).trim();
+    return execFileSync6("git", args, { encoding: "utf8" }).trim();
   } catch {
     return "";
   }
@@ -3466,26 +3692,6 @@ function parseParallel(args) {
   }
   return;
 }
-function configErrorOutcome(path, error) {
-  const finding = {
-    schema: 1,
-    check: "config",
-    severity: "error",
-    message: `${path}: invalid \`checks\` registration — ${error}`,
-    agent_recovery_prompt: `Fix the invalid key/value named above in ${path}, then re-run \`vinaya check\`.`
-  };
-  return { name: "config", status: "error", exitCode: null, errors: [finding], durationMs: 0 };
-}
-function customSpecsFromConfig() {
-  const result = loadConfigChecked();
-  if (!result.ok)
-    return { specs: [], errorOutcome: configErrorOutcome(result.path, result.error), checks: undefined };
-  const checks = result.config?.checks;
-  if (!checks)
-    return { specs: [], errorOutcome: null, checks: undefined };
-  const specs = Object.entries(checks).map(([name, entry2]) => ({ name, ...entry2 }));
-  return { specs, errorOutcome: null, checks };
-}
 function classifyEnvValue(value) {
   if (value === true)
     return "passthrough";
@@ -3539,27 +3745,46 @@ function renderPlanTable(result) {
   return table.map((row) => row.map((cell, col) => (cell ?? "").padEnd(widths[col] ?? 0)).join("  ")).join(`
 `);
 }
-function resolveForPlan(configResult) {
-  if (configResult.ok) {
-    return resolveChecks(coreCheckRegistry(), configResult.config?.checks);
+function duplicateIdFailures(resolved) {
+  const seen = new Set;
+  const reported = new Set;
+  const failures = [];
+  for (const entry2 of resolved) {
+    if (!seen.has(entry2.name)) {
+      seen.add(entry2.name);
+      continue;
+    }
+    if (reported.has(entry2.name))
+      continue;
+    reported.add(entry2.name);
+    failures.push({ key: entry2.name, reason: "duplicate check id — two resolved entries claim the same name" });
   }
-  const core = resolveChecks(coreCheckRegistry(), undefined);
-  return {
-    resolved: core.resolved,
+  return failures;
+}
+var FAIL_CLOSED_RECOVERY = "Fix or remove the rejected `checks` entries named above in vinaya.config.json, then re-run `vinaya check`. Until every entry resolves, NO check runs — vinaya refuses the whole run rather than executing a partial ruleset. `vinaya check --plan` prints the same resolution, and `vinaya doctor` carries the permanent diagnostic for each rejected entry.";
+function refusal(message) {
+  return { schema: 1, check: "config", severity: "error", message, agent_recovery_prompt: FAIL_CLOSED_RECOVERY };
+}
+function resolveForRun(configResult) {
+  const base = configResult.ok ? resolveChecks(coreCheckRegistry(), configResult.config?.checks) : {
+    resolved: resolveChecks(coreCheckRegistry(), undefined).resolved,
     failures: [{ key: configResult.path, reason: `invalid \`checks\` registration — ${configResult.error}` }]
   };
+  const duplicates = duplicateIdFailures(base.resolved);
+  const refusals = [
+    ...base.failures.map((failure) => configResult.ok ? refusal(bareKeyRejectedDiagnostic(failure.key)) : refusal(`${failure.key}: ${failure.reason} — refusing to run any check.`)),
+    ...duplicates.map((failure) => refusal(`${failure.key}: ${failure.reason} — refusing to run any check.`))
+  ];
+  return { result: { resolved: base.resolved, failures: [...base.failures, ...duplicates] }, refusals };
 }
-function printClassificationWarnings(configChecks) {
-  const classification = resolveChecks(coreCheckRegistry(), configChecks);
-  for (const entry2 of classification.resolved) {
-    if (entry2.state === "overridden")
-      process.stdout.write(`${overriddenNextMinorWarning(entry2.name)}
-`);
-  }
-  for (const failure of classification.failures) {
-    process.stdout.write(`${bareKeyNextMinorWarning(failure.key)}
-`);
-  }
+function substitutionNotices(resolved) {
+  return resolved.filter((entry2) => entry2.state === "overridden").map((entry2) => ({
+    schema: 1,
+    check: "config",
+    severity: "warning",
+    message: overriddenReplacesCoreDiagnostic(entry2.name),
+    agent_recovery_prompt: `If replacing the core check "${entry2.name}" was intended, nothing to do — this is a notice, not a failure. If it was not, remove or rename that \`checks\` entry in vinaya.config.json so the core check runs again.`
+  }));
 }
 async function checkCommand(args) {
   const jsonOutput = args.includes("--json");
@@ -3570,8 +3795,8 @@ async function checkCommand(args) {
   const planRequested = args.includes("--plan");
   const positional = args.filter((a) => !a.startsWith("--"));
   const requestedName = positional[0];
+  const { result, refusals } = resolveForRun(loadConfigChecked());
   if (planRequested) {
-    const result = resolveForPlan(loadConfigChecked());
     if (jsonOutput) {
       process.stdout.write(`${JSON.stringify(renderPlanJson(result), null, 2)}
 `);
@@ -3579,18 +3804,50 @@ async function checkCommand(args) {
       process.stdout.write(`${renderPlanTable(result)}
 `);
     }
-    process.exit(result.failures.length > 0 ? 1 : 0);
+    process.exitCode = result.failures.length > 0 ? 1 : 0;
+    return;
   }
   if (!allRequested && !requestedName) {
     console.error("Usage: vinaya check <name> | --all | --plan [--json] [--diff-only] [--local] [--parallel[=n]]");
-    process.exit(2);
+    process.exitCode = 2;
+    return;
+  }
+  if (refusals.length > 0) {
+    const outcome = {
+      name: "config",
+      status: "error",
+      exitCode: null,
+      errors: refusals,
+      durationMs: 0
+    };
+    for (const e of refusals)
+      emitCheckError(e);
+    if (jsonOutput) {
+      printJson({ checks: [outcome] });
+    } else {
+      process.stdout.write(`✗ ${outcome.name}: refused — no checks ran
+`);
+      for (const e of refusals)
+        process.stdout.write(`    ${e.severity}: ${e.message}
+`);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const allSpecs = result.resolved.map((entry2) => entry2.spec);
+  const notices = substitutionNotices(result.resolved);
+  for (const notice of notices)
+    emitCheckError(notice);
+  if (!jsonOutput) {
+    for (const notice of notices)
+      process.stdout.write(`⚠ ${notice.message}
+`);
   }
-  const { specs: customSpecs, errorOutcome, checks: configChecks } = customSpecsFromConfig();
-  const allSpecs = [...coreCheckRegistry(), ...customSpecs];
   const specsToRun = allRequested ? allSpecs.filter(runsUnderAll) : allSpecs.filter((s) => s.name === requestedName);
   if (!allRequested && specsToRun.length === 0) {
     console.error(`Unknown check: ${requestedName}`);
-    process.exit(2);
+    process.exitCode = 2;
+    return;
   }
   const changed = diffOnly ? changedFiles() : null;
   const outcomes = specsToRun.length > 0 ? await runChecks(specsToRun, {
@@ -3600,15 +3857,14 @@ async function checkCommand(args) {
     defaultTimeoutMs: 30000,
     localOnly
   }) : [];
-  const allOutcomes = errorOutcome ? [...outcomes, errorOutcome] : outcomes;
-  for (const o of allOutcomes) {
+  for (const o of outcomes) {
     for (const e of o.errors)
       emitCheckError(e);
   }
   if (jsonOutput) {
-    printJson({ checks: allOutcomes });
+    printJson({ checks: outcomes });
   } else {
-    for (const o of allOutcomes) {
+    for (const o of outcomes) {
       const symbol = o.status === "pass" ? "✓" : o.status === "skipped" ? "·" : "✗";
       process.stdout.write(`${symbol} ${o.name}: ${o.status} (${Math.round(o.durationMs)}ms)
 `);
@@ -3616,21 +3872,20 @@ async function checkCommand(args) {
         process.stdout.write(`    ${e.severity}: ${e.message}
 `);
     }
-    printClassificationWarnings(configChecks);
   }
-  const failed = allOutcomes.some((o) => o.status === "fail" || o.status === "error" || o.status === "timeout");
-  process.exit(failed ? 1 : 0);
+  const failed = outcomes.some((o) => o.status === "fail" || o.status === "error" || o.status === "timeout");
+  process.exitCode = failed ? 1 : 0;
 }
 
 // src/commands/demo.ts
-import { execFileSync as execFileSync6, spawnSync } from "node:child_process";
+import { execFileSync as execFileSync7, spawnSync } from "node:child_process";
 import { existsSync as existsSync6, readFileSync as readFileSync5, rmSync as rmSync2, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
 import { isAbsolute as isAbsolute2, join as join7 } from "node:path";
 var DEMO_BRANCH_PREFIX = "vinaya/demo-break-";
 var FIXTURE_PATH = ".vinaya-demo-brief.md";
 var STATE_FILENAME = "vinaya-demo-state.json";
 function gitCapture(repoRoot, args) {
-  return execFileSync6("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+  return execFileSync7("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 function currentBranchName(repoRoot) {
   try {
@@ -3641,7 +3896,7 @@ function currentBranchName(repoRoot) {
 }
 function branchExists(repoRoot, name) {
   try {
-    execFileSync6("git", ["rev-parse", "--verify", "--quiet", `refs/heads/${name}`], {
+    execFileSync7("git", ["rev-parse", "--verify", "--quiet", `refs/heads/${name}`], {
       cwd: repoRoot,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -3843,7 +4098,8 @@ async function demoBreakCommand(args) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync8, readFileSync as readFileSync8, statSync as statSync2 } from "node:fs";
+import { execFileSync as execFileSync8 } from "node:child_process";
+import { existsSync as existsSync8, readdirSync as readdirSync3, readFileSync as readFileSync8, statSync as statSync2 } from "node:fs";
 import { join as join9 } from "node:path";
 
 // src/lib/self-host.ts
@@ -4124,13 +4380,94 @@ function diagnoseCustomChecks(repoRoot, config) {
   }
   return findings;
 }
+function listTrackedFiles(repoRoot) {
+  try {
+    return execFileSync8("git", ["ls-files"], { cwd: repoRoot, encoding: "utf-8" }).split(`
+`).map((s) => s.trim()).filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+function diagnoseDocOwnersHealth(repoRoot) {
+  const path = join9(repoRoot, DOC_OWNERS_PATH);
+  const content = existsSync8(path) ? readFileSync8(path, "utf-8") : null;
+  const state = classifyDocOwnersManifest(content);
+  if (state === "absent" || state === "empty")
+    return [];
+  const { bindings } = parseDocOwners(content);
+  if (bindings.length === 0)
+    return [];
+  const codeFiles = listTrackedFiles(repoRoot).filter(isCodeFile);
+  const findings = [];
+  for (const b of bindings) {
+    let flagged = false;
+    const re = globToRegex(b.glob);
+    if (!codeFiles.some((f) => re.test(f))) {
+      flagged = true;
+      findings.push(warn("doc-owners", `${DOC_OWNERS_PATH}:${b.lineNum} binds glob '${b.glob}', which matches none of the ${codeFiles.length} ` + "tracked code file(s) in this repo — the code it names may have been deleted, renamed, or never " + "existed. Repoint the binding to the code's new location, or remove it."));
+    }
+    if (!isUrlPointer(b.pointer)) {
+      const pointerPath = join9(repoRoot, pointerToPath(b.pointer));
+      if (!existsSync8(pointerPath)) {
+        flagged = true;
+        findings.push(warn("doc-owners", `${DOC_OWNERS_PATH}:${b.lineNum} points to ${b.pointer}, which does not exist on disk. Repoint the ` + "binding, or add the missing doc."));
+      }
+    }
+    if (!flagged) {
+      findings.push(ok("doc-owners", `${DOC_OWNERS_PATH}:${b.lineNum} — '${b.glob}' → ${b.pointer} is live.`));
+    }
+  }
+  return findings;
+}
+var LEGACY_AEG_PACKAGES_PATH = ".aeg/packages";
+function readWorkspacesForDoctor(repoRoot) {
+  const fromPackageJson = () => {
+    try {
+      const pkg = JSON.parse(readFileSync8(join9(repoRoot, "package.json"), "utf-8"));
+      return Array.isArray(pkg.workspaces) ? pkg.workspaces.filter((w) => typeof w === "string") : [];
+    } catch {
+      return [];
+    }
+  };
+  const fromPnpmWorkspaceYaml = () => {
+    try {
+      return parsePnpmWorkspaceYaml(readFileSync8(join9(repoRoot, "pnpm-workspace.yaml"), "utf-8"));
+    } catch {
+      return [];
+    }
+  };
+  return [...fromPackageJson(), ...fromPnpmWorkspaceYaml()];
+}
+function listChildDirsForDoctor(dir, repoRoot) {
+  try {
+    return readdirSync3(join9(repoRoot, dir), { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    return [];
+  }
+}
+function diagnoseBlastRadiusDeprecation(repoRoot, config) {
+  const derived = deriveWorkspacePackageDomains(readWorkspacesForDoctor(repoRoot), (dir) => listChildDirsForDoctor(dir, repoRoot));
+  const defaults = deriveBuiltinCrossCuttingDefaults((p) => existsSync8(join9(repoRoot, p)));
+  const covered = new Set([...derived, ...defaults]);
+  const configExtra = new Set(config?.blastRadius?.extraDomains ?? []);
+  const legacyPath = join9(repoRoot, LEGACY_AEG_PACKAGES_PATH);
+  if (!existsSync8(legacyPath)) {
+    return [
+      info("blast-radius", `checkBlastRadiusScope is active via live derivation (${derived.length} packages/* domain(s)) + built-in defaults (${defaults.length} present) — no ${LEGACY_AEG_PACKAGES_PATH}, and the check is not dormant.`)
+    ];
+  }
+  const legacyEntries = readFileSync8(legacyPath, "utf-8").split(`
+`).map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith("#"));
+  const uncovered = legacyEntries.filter((e) => !covered.has(e) && !configExtra.has(e));
+  const migrationNote = uncovered.length === 0 ? "every entry is already covered by live derivation, the built-in defaults, or vinaya.config.json blastRadius.extraDomains — the file can be deleted." : `migrate ${uncovered.length} entr${uncovered.length === 1 ? "y" : "ies"} not yet covered before deleting it: ${uncovered.join(", ")}.`;
+  return [
+    warn("blast-radius", `${LEGACY_AEG_PACKAGES_PATH} is deprecated — checkBlastRadiusScope now derives packages/* domains live and ships built-in cross-cutting defaults. Declare anything beyond those in vinaya.config.json's blastRadius.extraDomains instead. ${migrationNote}`)
+  ];
+}
 function diagnoseEnvDeclarations(repoRoot, config) {
-  const customSpecs = Object.entries(config?.checks ?? {}).map(([name, entry2]) => ({
-    name,
-    ...entry2,
-    run: join9(repoRoot, entry2.run)
-  }));
-  const missing = checksMissingEnvDeclaration([...coreCheckRegistry(), ...customSpecs]);
+  const resolved = resolveChecks(coreCheckRegistry(), config?.checks).resolved;
+  const specs = resolved.map((entry2) => entry2.source === "config" ? { ...entry2.spec, run: join9(repoRoot, entry2.spec.run) } : entry2.spec);
+  const missing = checksMissingEnvDeclaration(specs);
   const findings = missing.map((name) => info("env", envDeclarationWarning(name)));
   for (const message of lintEnvDeclarations(config?.checks)) {
     findings.push(warn("env", message));
@@ -4142,10 +4479,10 @@ function diagnoseCheckClassification(config) {
   const findings = [];
   for (const entry2 of classification.resolved) {
     if (entry2.state === "overridden")
-      findings.push(warn("checks", overriddenNextMinorWarning(entry2.name)));
+      findings.push(warn("checks", overriddenReplacesCoreDiagnostic(entry2.name)));
   }
   for (const failure of classification.failures) {
-    findings.push(warn("checks", bareKeyNextMinorWarning(failure.key)));
+    findings.push(error("checks", bareKeyRejectedDiagnostic(failure.key)));
   }
   return findings;
 }
@@ -4187,6 +4524,29 @@ async function diagnoseBranchProtection(deps, owner, repo) {
   }
   return info("branch-protection", "main branch protection could not be determined (no gh auth, no remote, or a permission gap).");
 }
+var TEST_INVOCATION_SUBSTRINGS = ["npm test", "npm run test", "bun test", "bunx turbo test"];
+function diagnoseTestCi(repoRoot) {
+  let pkg;
+  try {
+    pkg = JSON.parse(readFileSync8(join9(repoRoot, "package.json"), "utf-8"));
+  } catch {
+    return [];
+  }
+  const testScript = pkg?.scripts?.test;
+  if (typeof testScript !== "string" || testScript.trim() === "")
+    return [];
+  const workflowsDir = join9(repoRoot, ".github/workflows");
+  const files = existsSync8(workflowsDir) ? readdirSync3(workflowsDir).filter((name) => statSync2(join9(workflowsDir, name)).isFile()) : [];
+  const invoked = files.some((name) => {
+    const content = readFileSync8(join9(workflowsDir, name), "utf-8");
+    return TEST_INVOCATION_SUBSTRINGS.some((s) => content.includes(s));
+  });
+  if (invoked)
+    return [];
+  return [
+    warn("test-ci", "no workflow under .github/workflows/ appears to invoke this repo's `package.json` test script — " + "vinaya requires a Test Plan on every PR and enforces it as a blocking gate, but nothing here verifies that tests actually run.")
+  ];
+}
 function symbolFor(severity) {
   switch (severity) {
     case "ok":
@@ -4240,12 +4600,15 @@ async function runDoctor(args, deps) {
     hasDrift = install.hasDrift;
     findings.push(...await diagnoseHookRouting(repo.repoRoot, hookDir, deps.readHooksPath));
     findings.push(...diagnoseCustomChecks(repo.repoRoot, configRead.config));
+    findings.push(...diagnoseDocOwnersHealth(repo.repoRoot));
   }
+  findings.push(...diagnoseBlastRadiusDeprecation(repo.repoRoot, configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseEnvDeclarations(repo.repoRoot, configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseCheckClassification(configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseGlobalConfigChecks());
   findings.push(...await diagnoseEnvironment(deps, hasDrift));
   findings.push(await diagnoseBranchProtection(deps, repo.owner, repo.repo));
+  findings.push(...diagnoseTestCi(repo.repoRoot));
   const healthy = findings.every((f) => f.severity === "ok" || f.severity === "info");
   if (jsonOutput) {
     printJson({ healthy, findings });
@@ -4259,7 +4622,7 @@ async function doctorCommand(args) {
 }
 
 // src/commands/doctrine.ts
-import { existsSync as existsSync9 } from "node:fs";
+import { existsSync as existsSync9, readdirSync as readdirSync4 } from "node:fs";
 import { dirname as dirname4, join as join10, sep as sep3 } from "node:path";
 var ENTRY_SEGMENTS = ["skills", "aeg", "SKILL.md"];
 function resolveDoctrineRoot(pkg = packageRoot(import.meta.url)) {
@@ -4272,6 +4635,12 @@ function resolveDoctrineRoot(pkg = packageRoot(import.meta.url)) {
   }
   return null;
 }
+function listRoleNames(root) {
+  const rolesDir = join10(root, "roles");
+  if (!existsSync9(rolesDir))
+    return [];
+  return readdirSync4(rolesDir).filter((name) => name.endsWith(".md")).map((name) => name.slice(0, -".md".length)).sort();
+}
 function doctrineCommand(args) {
   const root = resolveDoctrineRoot();
   if (root === null) {
@@ -4279,6 +4648,24 @@ function doctrineCommand(args) {
 `);
     process.exit(1);
   }
+  const roleFlagIndex = args.indexOf("--role");
+  if (roleFlagIndex !== -1) {
+    const roleName = args[roleFlagIndex + 1];
+    const validRoleNames = listRoleNames(root);
+    if (roleName === undefined || roleName.startsWith("--") || !validRoleNames.includes(roleName)) {
+      process.stderr.write(`vinaya doctrine --role: '${roleName ?? ""}' is not a known role. ` + `Valid role names: ${validRoleNames.join(", ")}
+`);
+      process.exit(1);
+    }
+    const entry3 = join10(root, "roles", `${roleName}.md`);
+    if (args.includes("--json")) {
+      printJson({ root, entry: entry3 });
+      return;
+    }
+    process.stdout.write(`${entry3}
+`);
+    return;
+  }
   const entry2 = join10(root, ...ENTRY_SEGMENTS);
   if (args.includes("--json")) {
     printJson({ root, entry: entry2 });
@@ -4695,7 +5082,7 @@ async function initProductCommand(args) {
 }
 
 // src/commands/issue.ts
-import { execFileSync as execFileSync7 } from "node:child_process";
+import { execFileSync as execFileSync9 } from "node:child_process";
 
 // src/lib/forge-write.ts
 import { mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "node:fs";
@@ -4918,7 +5305,7 @@ function locateBodyOrRefuse(ghArgs, retryCommand) {
 function fetchForgeLabels(issueRef) {
   let out;
   try {
-    out = execFileSync7("gh", ["issue", "view", issueRef, "--json", "labels"], {
+    out = execFileSync9("gh", ["issue", "view", issueRef, "--json", "labels"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -4946,7 +5333,7 @@ function reportPass(json, command) {
 function runGhWrite(ghCmd, ghArgs, bodyResult, json) {
   const { finalArgs, cleanup: cleanup2 } = resolveShippableArgs(ghArgs, bodyResult);
   try {
-    const out = execFileSync7("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
+    const out = execFileSync9("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
     const url = out.trim();
     if (json)
       printJson({ validated: true, written: true, url });
@@ -5021,17 +5408,27 @@ import { chmodSync as chmodSync2, existsSync as existsSync13, mkdirSync as mkdir
 import { join as join15 } from "node:path";
 var TEMPLATE_PATH = join15(packageRoot(import.meta.url), "templates", "custom-check.template.ts");
 var CHECKS_DIR = join15("scripts", "vinaya-checks");
-var VALID_NAME = /^[a-z0-9][a-z0-9-]*$/;
+var USAGE = "Usage: vinaya new check <yourname>/<id>  (both segments: lowercase letters, digits, hyphens; e.g. myteam/vocab-check)";
 function newCheckCommand(args) {
   const name = args[0];
-  if (!name || !VALID_NAME.test(name)) {
-    console.error("Usage: vinaya new check <name>  (name: lowercase letters, digits, hyphens)");
+  if (!name) {
+    console.error(USAGE);
+    process.exit(2);
+  }
+  if (coreCheckRegistry().some((spec) => spec.name === name)) {
+    console.error(`Refusing: "${name}" is a core check id. Registering it under \`checks\` REPLACES that core check — the core one stops running — so a scaffolded stub is never the right shape for it. Pick a namespaced name, or write the override entry by hand if you really mean to replace the core check.`);
+    process.exit(2);
+  }
+  if (!isValidNamespacedKey(name)) {
+    console.error(`Refusing: "${name}" is not a valid check id. ${USAGE.slice("Usage: ".length)}
+\`vinaya check\` refuses the entire run over a key it cannot resolve, so a bare, un-namespaced name would brick every check invocation in this repo.`);
     process.exit(2);
   }
   const scriptsDir = join15(process.cwd(), CHECKS_DIR);
   if (!existsSync13(scriptsDir))
     mkdirSync4(scriptsDir, { recursive: true });
-  const targetPath = join15(scriptsDir, `${name}.ts`);
+  const fileStem = name.slice(name.indexOf("/") + 1);
+  const targetPath = join15(scriptsDir, `${fileStem}.ts`);
   if (existsSync13(targetPath)) {
     console.error(`Error: ${targetPath} already exists.`);
     process.exit(1);
@@ -5040,7 +5437,7 @@ function newCheckCommand(args) {
   const contents = template.split("{{CHECK_NAME}}").join(name);
   writeFileSync7(targetPath, contents, "utf-8");
   chmodSync2(targetPath, 493);
-  const relPath = join15(CHECKS_DIR, `${name}.ts`);
+  const relPath = join15(CHECKS_DIR, `${fileStem}.ts`);
   const registration = JSON.stringify({ checks: { [name]: { run: `./${relPath}`, scope: "diff" } } }, null, 2);
   process.stdout.write(`Created ${relPath}
 
@@ -5050,12 +5447,12 @@ ${registration}
 }
 
 // src/commands/pr.ts
-import { execFileSync as execFileSync8 } from "node:child_process";
+import { execFileSync as execFileSync10 } from "node:child_process";
 var RETRY_CREATE2 = "vinaya pr create --validate-only …";
 var RETRY_EDIT2 = "vinaya pr edit <n> --validate-only …";
 function git2(args) {
   try {
-    return execFileSync8("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync10("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return "";
   }
@@ -5089,7 +5486,7 @@ function reportPass2(json, command) {
 function runGhWrite2(ghCmd, ghArgs, bodyResult, json) {
   const { finalArgs, cleanup: cleanup2 } = resolveShippableArgs(ghArgs, bodyResult);
   try {
-    const out = execFileSync8("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
+    const out = execFileSync10("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
     const url = out.trim();
     if (json)
       printJson({ validated: true, written: true, url });
@@ -5103,7 +5500,7 @@ function runGhWrite2(ghCmd, ghArgs, bodyResult, json) {
 function fetchPrForgeContext(prRef) {
   let viewOut;
   try {
-    viewOut = execFileSync8("gh", ["pr", "view", prRef, "--json", "headRefName,files"], {
+    viewOut = execFileSync10("gh", ["pr", "view", prRef, "--json", "headRefName,files"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -5204,14 +5601,193 @@ function prEditCommand(args) {
   runGhWrite2(["pr", "edit", prRef], ghArgs, bodyResult, json);
 }
 
+// src/commands/pr-report.ts
+import { execFileSync as execFileSync11, spawnSync as spawnSync2 } from "node:child_process";
+import { existsSync as existsSync14, readFileSync as readFileSync14, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join16 } from "node:path";
+var EVIDENCE_START = "<!-- AEG:EVIDENCE:START -->";
+var EVIDENCE_END = "<!-- AEG:EVIDENCE:END -->";
+function git3(args) {
+  try {
+    return execFileSync11("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+  } catch {
+    return "";
+  }
+}
+
+class GitCommandError extends Error {
+  args;
+  cause;
+  constructor(args, cause) {
+    super(`\`git ${args.join(" ")}\` failed: ${cause}`);
+    this.args = args;
+    this.cause = cause;
+    this.name = "GitCommandError";
+  }
+}
+function gitStrict(args) {
+  try {
+    return execFileSync11("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+  } catch (err) {
+    const stderr = err.stderr;
+    throw new GitCommandError(args, String(stderr ?? err.message).trim() || "non-zero exit");
+  }
+}
+
+class UnresolvableMergeBaseError extends Error {
+  head;
+  triedRefs;
+  constructor(head, triedRefs) {
+    super(`could not resolve a merge-base for HEAD (${head}) against any of: ${triedRefs.join(", ")}. ` + `This repo's default branch may not be named "main", or "origin" may not be configured — set BASE_SHA to override.`);
+    this.head = head;
+    this.triedRefs = triedRefs;
+    this.name = "UnresolvableMergeBaseError";
+  }
+}
+function resolveMergeBase(head) {
+  const primary = process.env.BASE_SHA || "origin/main";
+  const tried = primary === "main" ? [primary] : [primary, "main"];
+  for (const ref of tried) {
+    const base = git3(["merge-base", ref, head]);
+    if (base)
+      return base;
+  }
+  throw new UnresolvableMergeBaseError(head, tried);
+}
+function computeGroupA() {
+  const head = gitStrict(["rev-parse", "HEAD"]);
+  const base = resolveMergeBase(head);
+  const numstat = gitStrict(["diff", `${base}...${head}`, "--numstat"]);
+  return { head, base, numstat };
+}
+function resolveSelfEntry() {
+  const root = packageRoot(import.meta.url);
+  const dist = join16(root, "dist", "index.js");
+  return existsSync14(dist) ? dist : join16(root, "src", "index.ts");
+}
+var FAILING_STATUSES = new Set(["fail", "error", "timeout"]);
+function anyGateFailed(outcomes) {
+  return outcomes.some((o) => FAILING_STATUSES.has(o.status));
+}
+function runRealGates() {
+  const entry2 = resolveSelfEntry();
+  const proc = spawnSync2(process.execPath, [entry2, "check", "--all", "--diff-only", "--json"], {
+    cwd: process.cwd(),
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    maxBuffer: 32 * 1024 * 1024
+  });
+  const stdout = proc.stdout ?? "";
+  try {
+    const parsed = JSON.parse(stdout);
+    const outcomes = parsed.data.checks;
+    return { outcomes, failed: anyGateFailed(outcomes) };
+  } catch {
+    return {
+      outcomes: [
+        {
+          name: "check",
+          status: "error",
+          errors: [
+            { severity: "error", message: "`vinaya check --all --diff-only --json` did not produce parseable output." }
+          ]
+        }
+      ],
+      failed: true
+    };
+  }
+}
+function renderGroupA(groupA) {
+  return [
+    "### Group A — recomputable",
+    "",
+    `\`git diff ${groupA.base}...${groupA.head} --numstat\``,
+    "",
+    "```",
+    groupA.numstat,
+    "```"
+  ].join(`
+`);
+}
+function renderGroupB(outcomes) {
+  const sorted = [...outcomes].sort((a, b) => a.name.localeCompare(b.name));
+  const lines = sorted.flatMap((o) => {
+    const rows = [`${o.name}: ${o.status}`];
+    for (const e of o.errors)
+      rows.push(`  ${e.severity}: ${e.message}`);
+    return rows;
+  });
+  return ["### Group B — attested", "", "`vinaya check --all --diff-only`", "", "```", lines.join(`
+`), "```"].join(`
+`);
+}
+function buildBlockInner(groupA, gateOutcomes) {
+  return [`Head: ${groupA.head}`, "", renderGroupA(groupA), "", renderGroupB(gateOutcomes)].join(`
+`);
+}
+function replaceEvidenceBlock(body, blockInner) {
+  const full = `${EVIDENCE_START}
+${blockInner}
+${EVIDENCE_END}`;
+  const bounds = anchoredRegionBounds(body, "EVIDENCE");
+  if (bounds) {
+    return `${body.slice(0, bounds.outerStart)}${full}${body.slice(bounds.outerEnd)}`;
+  }
+  const sep4 = body.length === 0 || body.endsWith(`
+`) ? "" : `
+`;
+  return `${body}${sep4}
+${full}
+`;
+}
+async function buildReport(opts = {}) {
+  const groupA = opts.groupA ?? computeGroupA();
+  const gateRunner = opts.gateRunner ?? runRealGates;
+  const gateResult = await gateRunner();
+  const blockInner = buildBlockInner(groupA, gateResult.outcomes);
+  const block = `${EVIDENCE_START}
+${blockInner}
+${EVIDENCE_END}`;
+  return { block, blockInner, gatesFailed: gateResult.failed, gateOutcomes: gateResult.outcomes };
+}
+async function prReportCommand(args) {
+  const writeIdx = args.indexOf("--write");
+  const writePath = writeIdx !== -1 ? args[writeIdx + 1] : undefined;
+  if (writeIdx !== -1 && !writePath) {
+    console.error("Usage: vinaya pr report [--write <body-file>]");
+    process.exit(2);
+  }
+  let result;
+  try {
+    result = await buildReport();
+  } catch (err) {
+    if (err instanceof UnresolvableMergeBaseError || err instanceof GitCommandError) {
+      console.error(`vinaya pr report: refused — ${err.message}`);
+      process.exit(1);
+    }
+    throw err;
+  }
+  if (writePath) {
+    const existing = existsSync14(writePath) ? readFileSync14(writePath, "utf8") : "";
+    const updated = replaceEvidenceBlock(existing, result.blockInner);
+    writeFileSync8(writePath, updated);
+    process.stdout.write(`Wrote AEG:EVIDENCE block to ${writePath}
+`);
+  } else {
+    process.stdout.write(`${result.block}
+`);
+  }
+  process.exit(result.gatesFailed ? 1 : 0);
+}
+
 // src/commands/quickstart.ts
-import { execFileSync as execFileSync9 } from "node:child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync15 } from "node:fs";
-import { join as join17 } from "node:path";
+import { execFileSync as execFileSync12 } from "node:child_process";
+import { existsSync as existsSync16, readFileSync as readFileSync16 } from "node:fs";
+import { join as join18 } from "node:path";
 
 // src/lib/doc-owners-write.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync5, readFileSync as readFileSync14, writeFileSync as writeFileSync8 } from "node:fs";
-import { dirname as dirname6, join as join16 } from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync5, readFileSync as readFileSync15, writeFileSync as writeFileSync9 } from "node:fs";
+import { dirname as dirname6, join as join17 } from "node:path";
 function bindingLine(glob, pointer) {
   return `${glob}  ${pointer}`;
 }
@@ -5227,23 +5803,23 @@ function appendDocOwnersBinding(content, glob, pointer) {
 `;
 }
 function planDocOwnersBinding(repoRoot, glob, pointer) {
-  const abs2 = join16(repoRoot, DOC_OWNERS_PATH);
+  const abs2 = join17(repoRoot, DOC_OWNERS_PATH);
   const line = bindingLine(glob, pointer);
-  if (!existsSync14(abs2)) {
+  if (!existsSync15(abs2)) {
     return { action: "create-host", line, path: DOC_OWNERS_PATH };
   }
-  const existing = readFileSync14(abs2, "utf-8");
+  const existing = readFileSync15(abs2, "utf-8");
   const already = parseDocOwners(existing).bindings.some((b) => b.glob === glob);
   return { action: already ? "skip-present" : "append-row", line, path: DOC_OWNERS_PATH };
 }
 function applyDocOwnersBinding(repoRoot, plan, glob, pointer) {
-  const abs2 = join16(repoRoot, DOC_OWNERS_PATH);
+  const abs2 = join17(repoRoot, DOC_OWNERS_PATH);
   if (plan.action === "create-host") {
     mkdirSync5(dirname6(abs2), { recursive: true });
-    writeFileSync8(abs2, freshDocOwners(glob, pointer), "utf-8");
+    writeFileSync9(abs2, freshDocOwners(glob, pointer), "utf-8");
   } else if (plan.action === "append-row") {
-    const existing = readFileSync14(abs2, "utf-8");
-    writeFileSync8(abs2, appendDocOwnersBinding(existing, glob, pointer), "utf-8");
+    const existing = readFileSync15(abs2, "utf-8");
+    writeFileSync9(abs2, appendDocOwnersBinding(existing, glob, pointer), "utf-8");
   }
 }
 function renderDocOwnersBindingDiffLine(plan) {
@@ -5303,7 +5879,7 @@ function pointerIsMissingLocalFile(repoRoot, pointer) {
   if (/^https?:\/\//i.test(pointer))
     return false;
   const path = pointer.split("#")[0] ?? pointer;
-  return !existsSync15(join17(repoRoot, path));
+  return !existsSync16(join18(repoRoot, path));
 }
 async function bindDocOwnerLoop(deps, repoRoot) {
   let any = false;
@@ -5370,7 +5946,7 @@ async function registerProjectLoop(deps) {
   }
 }
 function readPackageVersion() {
-  const pkg = JSON.parse(readFileSync15(join17(packageRoot(import.meta.url), "package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync16(join18(packageRoot(import.meta.url), "package.json"), "utf-8"));
   return pkg.version;
 }
 function realDeps6() {
@@ -5401,7 +5977,7 @@ function realDeps6() {
   };
 }
 function execGit(repoRoot, args) {
-  return execFileSync9("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+  return execFileSync12("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 function errorDetail(err) {
   const stderr = err.stderr;
@@ -5517,11 +6093,331 @@ async function quickstartCommand(args) {
   process.exit(await runQuickstart(args, realDeps6()));
 }
 
+// src/commands/review-post.ts
+import { execFileSync as execFileSync13 } from "node:child_process";
+import { readFileSync as readFileSync17, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join19 } from "node:path";
+class FindingsParseError extends Error {
+}
+var CODE_REVIEW_SEVERITIES = ["BLOCKER", "MAJOR", "MINOR"];
+var SECURITY_SEVERITIES = ["CRITICAL", "HIGH", "MEDIUM", "LOW"];
+function parseFindingsFile(content, allowedSeverities) {
+  const lines = content.split(`
+`).map((l) => l.trim()).filter((l) => l.length > 0);
+  return lines.map((line, idx) => {
+    const parts = line.split("|");
+    if (parts.length !== 3) {
+      throw new FindingsParseError(`findings file line ${idx + 1}: expected exactly 3 \`|\`-delimited fields (SEVERITY|file:line|description), found ${parts.length}: ${line}`);
+    }
+    const severity = parts[0].trim().toUpperCase();
+    const location = parts[1].trim();
+    const description = parts[2].trim();
+    if (!allowedSeverities.includes(severity)) {
+      throw new FindingsParseError(`findings file line ${idx + 1}: severity "${parts[0]}" is not one of ${allowedSeverities.join("|")}: ${line}`);
+    }
+    if (!location || !description) {
+      throw new FindingsParseError(`findings file line ${idx + 1}: file:line and description must both be non-empty: ${line}`);
+    }
+    return { severity, location, description };
+  });
+}
+function sortBySeverity(findings, order) {
+  return findings.map((f, i) => ({ f, i })).sort((a, b) => order.indexOf(a.f.severity) - order.indexOf(b.f.severity) || a.i - b.i).map(({ f }) => f);
+}
+function renderFindingsSection(findings) {
+  if (findings.length === 0)
+    return "None.";
+  return findings.map((f, i) => `${i + 1}. [${f.severity}] ${f.location} — ${f.description}`).join(`
+`);
+}
+function renderTokensLine(role, roleLabel, input) {
+  return `Tokens: ${input.taskId}: ${role} — ${roleLabel} — ${input.model} — ${input.tokensIn}/${input.tokensOut}/${input.cost}`;
+}
+var CODE_REVIEW_VERDICT_TEXT = {
+  APPROVE: "APPROVE",
+  REQUEST_CHANGES: "REQUEST CHANGES"
+};
+function renderCodeReviewComment(input) {
+  const sorted = sortBySeverity(input.findings, CODE_REVIEW_SEVERITIES);
+  return [
+    `VERDICT: ${CODE_REVIEW_VERDICT_TEXT[input.verdict]}`,
+    "",
+    `Judged head: ${input.headSha}`,
+    "",
+    `BRIEF CONFORMANCE: ${input.briefConformance}`,
+    `SPEC CONFORMANCE: ${input.specConformance}`,
+    "",
+    "FINDINGS (ordered by severity):",
+    renderFindingsSection(sorted),
+    "",
+    `SCOPE: ${input.scope}`,
+    `TESTS: ${input.tests}`,
+    `DOCS: ${input.docs}`,
+    "",
+    renderTokensLine("review", "Reviewer", input)
+  ].join(`
+`);
+}
+function isNoneFoundClaim(value) {
+  return value.trim().toLowerCase().replace(/[-_]+/g, " ").replace(/\s+/g, " ") === "none found";
+}
+function renderSecurityComment(input) {
+  const sorted = sortBySeverity(input.findings, SECURITY_SEVERITIES);
+  const lines = [
+    `VERDICT: ${input.verdict}`,
+    "",
+    `Judged head: ${input.headSha}`,
+    "",
+    "FINDINGS (ordered by severity):",
+    renderFindingsSection(sorted),
+    "",
+    `CONFIG SCAN: ${input.configScan}`,
+    ""
+  ];
+  if (input.secretsEvidence !== null) {
+    lines.push("```", input.secretsEvidence, "```", "");
+  }
+  lines.push(`SECRETS: ${input.secrets}`, "", renderTokensLine("security", "Security", input));
+  return lines.join(`
+`);
+}
+function isBoundToHead(extraction, headSha) {
+  if (!extraction.headSha)
+    return false;
+  return headSha.toLowerCase().startsWith(extraction.headSha.toLowerCase());
+}
+function checkExtraction(extraction, expectedValue, headSha) {
+  if (extraction.danglingNote) {
+    return {
+      ok: false,
+      reason: `no clean VERDICT was found on re-fetch (${extraction.danglingNote}) — the posted comment does not match the gate's line-anchored \`VERDICT:\` pattern.`
+    };
+  }
+  if (extraction.value !== expectedValue) {
+    return {
+      ok: false,
+      reason: `re-extraction found VERDICT "${extraction.value}", expected "${expectedValue}" — the posted comment's VERDICT line does not match what this command rendered.`
+    };
+  }
+  if (!extraction.headSha) {
+    return { ok: false, reason: "the winning VERDICT comment carries no `Judged head:` line on re-fetch." };
+  }
+  if (!isBoundToHead(extraction, headSha)) {
+    return {
+      ok: false,
+      reason: `re-extraction found \`Judged head: ${extraction.headSha}\`, which does not cover the resolved head ${headSha}.`
+    };
+  }
+  return { ok: true, reason: "clean" };
+}
+function principalBodies(comments, principalAllowlist) {
+  return comments.filter((c) => isPrincipal(c.author, principalAllowlist)).map((c) => c.body);
+}
+function verifyPostedCodeReview(comments, verdict, headSha, principalAllowlist) {
+  return checkExtraction(extractCodeReviewVerdict(principalBodies(comments, principalAllowlist)), CODE_REVIEW_VERDICT_TEXT[verdict], headSha);
+}
+function verifyPostedSecurity(comments, verdict, headSha, principalAllowlist) {
+  return checkExtraction(extractSecurityReviewVerdict(principalBodies(comments, principalAllowlist)), verdict, headSha);
+}
+function parseFlags(args) {
+  const map = new Map;
+  for (let i = 0;i < args.length; i++) {
+    const a = args[i];
+    if (a.startsWith("--")) {
+      const value = args[i + 1];
+      if (value === undefined || value.startsWith("--")) {
+        map.set(a, "");
+        continue;
+      }
+      map.set(a, value);
+      i++;
+    }
+  }
+  return map;
+}
+function refuseCmd(message, recovery) {
+  refuse([makeCheckError("review-post", message, recovery)]);
+}
+function requireFlag(flags2, name) {
+  const v = flags2.get(name);
+  if (v === undefined || v === "") {
+    refuseCmd(`Missing required \`${name}\` flag.`, `Pass \`${name} <value>\`, then re-run \`vinaya review post ...\`.`);
+  }
+  return v;
+}
+function requireTokenField(flags2, name) {
+  const v = requireFlag(flags2, name);
+  if (v !== "-" && !/^\d+$/.test(v)) {
+    refuseCmd(`\`${name} ${v}\` is neither a non-negative integer nor \`-\` (unknown).`, `Pass a whole number or \`-\` for ${name}.`);
+  }
+  return v;
+}
+function readFindingsFile(path, allowedSeverities) {
+  if (!path)
+    return [];
+  let content;
+  try {
+    content = readFileSync17(path, "utf8");
+  } catch {
+    refuseCmd(`Could not read findings file at ${path}.`, "Check the path and re-run.");
+  }
+  try {
+    return parseFindingsFile(content, allowedSeverities);
+  } catch (err) {
+    if (err instanceof FindingsParseError) {
+      refuseCmd(err.message, "Fix the malformed line in the findings file, then re-run.");
+    }
+    throw err;
+  }
+}
+function normalizeCodeReviewVerdict(raw) {
+  const v = raw.trim().toUpperCase().replace(/[-\s]+/g, "_");
+  if (v === "APPROVE")
+    return "APPROVE";
+  if (v === "REQUEST_CHANGES")
+    return "REQUEST_CHANGES";
+  refuseCmd(`\`--verdict ${raw}\` is not APPROVE or REQUEST_CHANGES.`, "Pass `--verdict APPROVE` or `--verdict REQUEST_CHANGES`.");
+}
+function normalizeSecurityVerdict(raw) {
+  const v = raw.trim().toUpperCase();
+  if (v === "PASS")
+    return "PASS";
+  if (v === "FAIL")
+    return "FAIL";
+  refuseCmd(`\`--verdict ${raw}\` is not PASS or FAIL.`, "Pass `--verdict PASS` or `--verdict FAIL`.");
+}
+function gh(args) {
+  try {
+    return execFileSync13("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+  } catch (err) {
+    const stderr = err.stderr;
+    throw new Error(String(stderr ?? err.message).trim() || "gh command failed");
+  }
+}
+function resolveHeadSha(pr) {
+  let out;
+  try {
+    out = gh(["pr", "view", pr, "--json", "headRefOid", "-q", ".headRefOid"]);
+  } catch (err) {
+    refuseCmd(`Could not resolve PR ${pr}'s head via \`gh pr view --json headRefOid\`: ${err instanceof Error ? err.message : String(err)}`, "Confirm `gh auth status` passes and the PR number is correct, then re-run.");
+  }
+  if (!out) {
+    refuseCmd(`\`gh pr view ${pr} --json headRefOid\` returned no head sha.`, "Confirm PR exists, then re-run.");
+  }
+  return out;
+}
+function postComment(pr, body) {
+  const tmp = join19(tmpdir2(), `vinaya-review-post-${process.pid}-${Date.now()}.md`);
+  writeFileSync10(tmp, body);
+  try {
+    return gh(["pr", "comment", pr, "--body-file", tmp]).trim();
+  } catch (err) {
+    refuseCmd(`Rendered comment failed to post via \`gh pr comment\`: ${err instanceof Error ? err.message : String(err)}`, "Check `gh auth status`/network, then re-run — nothing was posted.");
+  } finally {
+    rmSync4(tmp, { force: true });
+  }
+}
+function fetchComments(pr) {
+  const out = gh(["pr", "view", pr, "--json", "comments"]);
+  const parsed = JSON.parse(out);
+  return parsed.comments.map((c) => ({ body: c.body, author: c.author?.login ?? null }));
+}
+async function reviewPostCommand(args) {
+  const json = args.includes("--json");
+  const flags2 = parseFlags(args.filter((a) => a !== "--json"));
+  const role = flags2.get("--role");
+  if (role !== "code-reviewer" && role !== "security") {
+    refuseCmd(`\`--role ${role ?? "(missing)"}\` is not \`code-reviewer\` or \`security\`.`, "Pass `--role code-reviewer` or `--role security`.");
+  }
+  const pr = requireFlag(flags2, "--pr");
+  const taskId = requireFlag(flags2, "--task-id");
+  const model = requireFlag(flags2, "--model");
+  const tokensIn = requireTokenField(flags2, "--tokens-in");
+  const tokensOut = requireTokenField(flags2, "--tokens-out");
+  const cost = requireFlag(flags2, "--cost");
+  const tokens = { taskId, model, tokensIn, tokensOut, cost };
+  const headSha = resolveHeadSha(pr);
+  const principalAllowlist = resolvePrincipalAllowlist(loadTrustAnchorConfig());
+  let body;
+  let verify;
+  if (role === "code-reviewer") {
+    const verdict = normalizeCodeReviewVerdict(requireFlag(flags2, "--verdict"));
+    const findings = readFindingsFile(flags2.get("--findings-file"), CODE_REVIEW_SEVERITIES);
+    if (findings.some((f) => f.severity === "BLOCKER") && verdict === "APPROVE") {
+      refuseCmd("Findings include a BLOCKER but `--verdict APPROVE` — reviewer.md requires REQUEST CHANGES whenever any BLOCKER finding exists.", "Pass `--verdict REQUEST_CHANGES`, or fix the finding severity if BLOCKER was a miscategorization.");
+    }
+    const input = {
+      ...tokens,
+      headSha,
+      verdict,
+      briefConformance: requireFlag(flags2, "--brief-conformance"),
+      specConformance: requireFlag(flags2, "--spec-conformance"),
+      findings,
+      scope: requireFlag(flags2, "--scope"),
+      tests: requireFlag(flags2, "--tests"),
+      docs: requireFlag(flags2, "--docs")
+    };
+    body = renderCodeReviewComment(input);
+    verify = (comments2) => verifyPostedCodeReview(comments2, verdict, headSha, principalAllowlist);
+  } else {
+    const verdict = normalizeSecurityVerdict(requireFlag(flags2, "--verdict"));
+    const findings = readFindingsFile(flags2.get("--findings-file"), SECURITY_SEVERITIES);
+    if (findings.some((f) => f.severity === "CRITICAL" || f.severity === "HIGH") && verdict === "PASS") {
+      refuseCmd("Findings include a CRITICAL/HIGH finding but `--verdict PASS` — security.md requires FAIL whenever any CRITICAL or HIGH finding exists.", "Pass `--verdict FAIL`, or fix the finding severity if it was a miscategorization.");
+    }
+    const secrets = requireFlag(flags2, "--secrets");
+    const secretsEvidenceFile = flags2.get("--secrets-evidence-file");
+    if (isNoneFoundClaim(secrets) && !secretsEvidenceFile) {
+      refuseCmd('`--secrets` normalizes to "none found" but no `--secrets-evidence-file` was given — security.md: "SECRETS: none found" with no scan output pasted is an unbacked self-attestation.', "Pass `--secrets-evidence-file <path>` containing the actual scanner output, or change `--secrets` to describe what was found instead.");
+    }
+    let secretsEvidence = null;
+    if (secretsEvidenceFile) {
+      try {
+        secretsEvidence = readFileSync17(secretsEvidenceFile, "utf8");
+      } catch {
+        refuseCmd(`Could not read secrets evidence file at ${secretsEvidenceFile}.`, "Check the path and re-run.");
+      }
+    }
+    const input = {
+      ...tokens,
+      headSha,
+      verdict,
+      findings,
+      configScan: requireFlag(flags2, "--config-scan"),
+      secrets,
+      secretsEvidence
+    };
+    body = renderSecurityComment(input);
+    verify = (comments2) => verifyPostedSecurity(comments2, verdict, headSha, principalAllowlist);
+  }
+  const url = postComment(pr, body);
+  let comments;
+  try {
+    comments = fetchComments(pr);
+  } catch (err) {
+    refuseCmd(`Posted the comment (${url}) but could not re-fetch PR ${pr}'s comments to self-verify: ${err instanceof Error ? err.message : String(err)}`, "Check `gh auth status`/network and manually confirm the posted comment parses cleanly — this command could not verify it.");
+  }
+  const result = verify(comments);
+  if (!result.ok) {
+    refuseCmd(`Posted comment ${url}, but self-verification FAILED on re-parse: ${result.reason}`, "The posted comment does not re-parse clean through the same extractCodeReviewVerdict/extractSecurityReviewVerdict functions the merge gate calls. Do not treat the post as valid — inspect the comment and this command for drift, fix, and re-run.");
+  }
+  if (json) {
+    printJson({ posted: true, url, role, headSha, selfVerified: true });
+  } else {
+    process.stdout.write(`${body}
+
+Posted: ${url}
+Self-verification: clean — re-parsed VERDICT is bound to head ${headSha}.
+`);
+  }
+}
+
 // src/commands/studio.ts
 import { execFile as execFile5, spawn as spawn2 } from "node:child_process";
-import { existsSync as existsSync16, readFileSync as readFileSync16, renameSync } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync18, renameSync } from "node:fs";
 import net from "node:net";
-import { dirname as dirname7, join as join18 } from "node:path";
+import { dirname as dirname7, join as join20 } from "node:path";
 import { promisify as promisify5 } from "node:util";
 
 // src/lib/studio-bundle.ts
@@ -5537,25 +6433,25 @@ var FALLBACK_PORT = 3108;
 function resolveStudioTarget(cwd, moduleUrl = import.meta.url) {
   let dir = cwd;
   for (;; ) {
-    const webDir = join18(dir, "apps", "vinaya-studio", "web");
-    const pkgPath = join18(webDir, "package.json");
-    if (existsSync16(pkgPath)) {
+    const webDir = join20(dir, "apps", "vinaya-studio", "web");
+    const pkgPath = join20(webDir, "package.json");
+    if (existsSync17(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync16(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync18(pkgPath, "utf-8"));
         if (pkg.name === "@atta/vinaya-studio-web") {
           return { kind: "workspace", webDir };
         }
       } catch {}
     }
-    if (existsSync16(join18(dir, ".git")))
+    if (existsSync17(join20(dir, ".git")))
       break;
     const parent = dirname7(dir);
     if (parent === dir)
       break;
     dir = parent;
   }
-  const standaloneWebDir = join18(packageRoot(moduleUrl), "studio-standalone", "apps", "vinaya-studio", "web");
-  if (existsSync16(join18(standaloneWebDir, "server.js"))) {
+  const standaloneWebDir = join20(packageRoot(moduleUrl), "studio-standalone", "apps", "vinaya-studio", "web");
+  if (existsSync17(join20(standaloneWebDir, "server.js"))) {
     return { kind: "package", packageDir: standaloneWebDir };
   }
   return { kind: "missing" };
@@ -5575,9 +6471,9 @@ function isPortFree(port) {
   });
 }
 function ensureStudioNodeModules(bundleRoot) {
-  const real = join18(bundleRoot, "node_modules");
-  const packed = join18(bundleRoot, STUDIO_NODE_MODULES_PACKED_DIRNAME);
-  if (!existsSync16(real) && existsSync16(packed)) {
+  const real = join20(bundleRoot, "node_modules");
+  const packed = join20(bundleRoot, STUDIO_NODE_MODULES_PACKED_DIRNAME);
+  if (!existsSync17(real) && existsSync17(packed)) {
     renameSync(packed, real);
   }
 }
@@ -5603,8 +6499,8 @@ async function runStudio(cwd, args, moduleUrl = import.meta.url) {
     case "workspace":
       return spawnDev(target.webDir, args);
     case "package": {
-      const bundleRoot = join18(target.packageDir, "..", "..", "..");
-      return spawnStandalone(cwd, join18(target.packageDir, "server.js"), bundleRoot);
+      const bundleRoot = join20(target.packageDir, "..", "..", "..");
+      return spawnStandalone(cwd, join20(target.packageDir, "server.js"), bundleRoot);
     }
     case "missing":
       console.error("Vinaya Studio isn't available in this install — no published @attalabs/vinaya build bundles the Studio app yet. Inside a checkout that contains Studio's source (apps/vinaya-studio/web), `vinaya studio` runs it directly.");
@@ -5613,8 +6509,8 @@ async function runStudio(cwd, args, moduleUrl = import.meta.url) {
 }
 
 // src/commands/upgrade.ts
-import { existsSync as existsSync17, readFileSync as readFileSync17, rmSync as rmSync4, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync18, readFileSync as readFileSync19, rmSync as rmSync5, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join21 } from "node:path";
 function realDeps7() {
   return {
     detectRepo: detectGitRepo,
@@ -5632,12 +6528,12 @@ function flags2(args) {
   return { dryRun: args.includes("--dry-run"), yes: args.includes("--yes") };
 }
 function readManifest3(repoRoot) {
-  const p = join19(repoRoot, CONFIG_PATH);
-  if (!existsSync17(p))
+  const p = join21(repoRoot, CONFIG_PATH);
+  if (!existsSync18(p))
     return { kind: "missing" };
   let raw;
   try {
-    raw = JSON.parse(readFileSync17(p, "utf-8"));
+    raw = JSON.parse(readFileSync19(p, "utf-8"));
   } catch (err) {
     return { kind: "invalid", error: `invalid JSON: ${err.message}` };
   }
@@ -5653,17 +6549,17 @@ function readManifest3(repoRoot) {
   return { kind: "ok", manifest: parsed.data.managed };
 }
 function writeManifestVersion(repoRoot, manifest) {
-  const configAbs = join19(repoRoot, CONFIG_PATH);
-  const seed = JSON.parse(readFileSync17(configAbs, "utf-8"));
+  const configAbs = join21(repoRoot, CONFIG_PATH);
+  const seed = JSON.parse(readFileSync19(configAbs, "utf-8"));
   const updated = { ...manifest, version: MANAGED_MANIFEST_VERSION };
-  writeFileSync9(configAbs, `${JSON.stringify({ ...seed, managed: updated }, null, 2)}
+  writeFileSync11(configAbs, `${JSON.stringify({ ...seed, managed: updated }, null, 2)}
 `, "utf-8");
 }
 function stripFor(repoRoot, path, marker, comment) {
   const abs2 = resolveManagedBlockPath(repoRoot, path);
-  if (!existsSync17(abs2))
+  if (!existsSync18(abs2))
     return { path, marker, comment, present: false, removesHost: false };
-  const stripped = stripBlockFromContent(readFileSync17(abs2, "utf-8"), marker, comment);
+  const stripped = stripBlockFromContent(readFileSync19(abs2, "utf-8"), marker, comment);
   if (stripped === null)
     return { path, marker, comment, present: false, removesHost: false };
   return { path, marker, comment, present: true, removesHost: blockStripLeavesEmpty(stripped) };
@@ -5690,9 +6586,9 @@ function planHookRouting(repoRoot, manifest, recorded, hooksPathValue) {
   const blocked = [];
   for (const b of legacy) {
     const abs2 = resolveManagedBlockPath(repoRoot, b.path);
-    if (!existsSync17(abs2))
+    if (!existsSync18(abs2))
       continue;
-    const stripped = stripBlockFromContent(readFileSync17(abs2, "utf-8"), b.marker, b.comment);
+    const stripped = stripBlockFromContent(readFileSync19(abs2, "utf-8"), b.marker, b.comment);
     if (stripped === null)
       blocked.push(`${b.path} exists without vinaya's managed block`);
     else if (!blockStripLeavesEmpty(stripped))
@@ -5727,8 +6623,8 @@ function planUpgrade(ops, repoRoot, manifest, routing) {
   const ownedBlocks = new Set(manifest.blocks.map((b) => blockKey(b.path, b.marker)));
   for (const op of ops) {
     if (op.kind === "create-file") {
-      const abs2 = join19(repoRoot, op.path);
-      const exists = existsSync17(abs2);
+      const abs2 = join21(repoRoot, op.path);
+      const exists = existsSync18(abs2);
       const owned = ownedFiles.has(op.path);
       let action;
       if (op.path === CONFIG_PATH || op.path === DOC_OWNERS_PATH) {
@@ -5738,7 +6634,7 @@ function planUpgrade(ops, repoRoot, manifest, routing) {
       } else if (!exists) {
         action = "recreate";
         hasChanges = true;
-      } else if (readFileSync17(abs2, "utf-8") !== op.content) {
+      } else if (readFileSync19(abs2, "utf-8") !== op.content) {
         action = "regenerate";
         hasChanges = true;
       } else {
@@ -5751,11 +6647,11 @@ function planUpgrade(ops, repoRoot, manifest, routing) {
       let action;
       if (!owned) {
         action = "not-installed";
-      } else if (!existsSync17(abs2)) {
+      } else if (!existsSync18(abs2)) {
         action = "recreate-host";
         hasChanges = true;
       } else {
-        const content = readFileSync17(abs2, "utf-8");
+        const content = readFileSync19(abs2, "utf-8");
         const { begin, end } = markerLines(op.marker, op.comment);
         if (!(content.includes(begin) && content.includes(end))) {
           action = "recreate-append";
@@ -5855,10 +6751,10 @@ function renderUpgradeDiff(plan) {
 }
 function regenerateBlock(repoRoot, op) {
   const abs2 = resolveManagedBlockPath(repoRoot, op.path);
-  const content = readFileSync17(abs2, "utf-8");
+  const content = readFileSync19(abs2, "utf-8");
   const stripped = stripBlockFromContent(content, op.marker, op.comment);
   if (stripped !== null) {
-    writeFileSync9(abs2, stripped.endsWith(`
+    writeFileSync11(abs2, stripped.endsWith(`
 `) ? stripped : `${stripped}
 `, "utf-8");
   }
@@ -5868,7 +6764,7 @@ function applyUpgrade(plan, repoRoot) {
   for (const e of plan.entries) {
     if (e.kind === "create-file") {
       if (e.action === "regenerate" || e.action === "recreate") {
-        writeFileWithDirs(join19(repoRoot, e.op.path), e.op.content, e.op.mode);
+        writeFileWithDirs(join21(repoRoot, e.op.path), e.op.content, e.op.mode);
       }
     } else {
       if (e.action === "recreate-host")
@@ -5883,15 +6779,15 @@ function applyUpgrade(plan, repoRoot) {
     if (!s.present)
       continue;
     const abs2 = resolveManagedBlockPath(repoRoot, s.path);
-    if (!existsSync17(abs2))
+    if (!existsSync18(abs2))
       continue;
-    const stripped = stripBlockFromContent(readFileSync17(abs2, "utf-8"), s.marker, s.comment);
+    const stripped = stripBlockFromContent(readFileSync19(abs2, "utf-8"), s.marker, s.comment);
     if (stripped === null)
       continue;
     if (blockStripLeavesEmpty(stripped))
-      rmSync4(abs2, { force: true });
+      rmSync5(abs2, { force: true });
     else
-      writeFileSync9(abs2, stripped.endsWith(`
+      writeFileSync11(abs2, stripped.endsWith(`
 `) ? stripped : `${stripped}
 `, "utf-8");
   }
@@ -5973,16 +6869,16 @@ async function upgradeCommand(args) {
 }
 
 // src/commands/waiver.ts
-import { execFileSync as execFileSync10 } from "node:child_process";
+import { execFileSync as execFileSync14 } from "node:child_process";
 function labelFor(kind) {
   return kind === "docs" ? WAIVER_LABEL : WAIVER_LABEL_REVIEW;
 }
-function gh(args) {
-  return execFileSync10("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: process.env }).trim();
+function gh2(args) {
+  return execFileSync14("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: process.env }).trim();
 }
 function detectPrNumber() {
   try {
-    const out = gh(["pr", "view", "--json", "number", "-q", ".number"]);
+    const out = gh2(["pr", "view", "--json", "number", "-q", ".number"]);
     return /^\d+$/.test(out) ? out : null;
   } catch {
     return null;
@@ -6078,8 +6974,8 @@ Reason: ${reason}`];
   }
   process.stdout.write(`Applying \`${label2}\` to PR #${prNumber} under your authenticated \`gh\` identity — vinaya never fabricates an actor.
 `);
-  execFileSync10("gh", editArgs, { stdio: "inherit", env: process.env });
-  execFileSync10("gh", commentArgs, { stdio: "inherit", env: process.env });
+  execFileSync14("gh", editArgs, { stdio: "inherit", env: process.env });
+  execFileSync14("gh", commentArgs, { stdio: "inherit", env: process.env });
   process.stdout.write(`
 ✓ Label applied and reason posted as a PR comment.
 `);
@@ -6149,7 +7045,8 @@ var COMMANDS = [
     ],
     details: [
       "Each spawned check's child process sees only a fixed baseline (`PATH`, `LANG`, `HOME`, `HTTPS_PROXY`, `HTTP_PROXY`, `NO_PROXY`, `TMPDIR`) plus whatever its `CheckSpec['env']` declaration explicitly forwards — never the full parent environment. A required (`true`) or unsatisfied `anyOf` declaration missing from the caller's environment synthesizes a `CheckError` before the check ever spawns. Declare `env` (a core check's own registration, or `vinaya.config.json`'s `checks.<name>.env` for a custom one) for any check that reads `process.env`/`Bun.env`/`Deno.env` directly — `vinaya doctor` carries the permanent diagnostic for one that doesn't.",
-      "`--plan` composes with `--json`. It requires zero env vars and never prints an env value — only how each one resolves (passthrough, optional, literal, or anyOf). A `FAIL_CLOSED` entry (a bare key with no namespace matching no core check) always renders inline rather than being dropped, and exits non-zero. `--plan` previews what the next minor's execution will enforce — `vinaya check` itself still runs the flat, unvalidated registry this release.",
+      "The resolved registry IS what runs. A `checks` key that exactly matches a core check id REPLACES that core check (the core one does not run); any other key must be namespaced `<yourname>/<id>`. Anything the resolver cannot classify — a malformed entry, a bare un-namespaced key matching no core id, a duplicate id — makes `vinaya check` refuse the ENTIRE run: exit 1, nothing executes, never a partial ruleset and never a core-only fallback. `vinaya doctor` carries the permanent diagnostic for each rejected entry, so a refused config is still diagnosable.",
+      "`--plan` composes with `--json`. It requires zero env vars and never prints an env value — only how each one resolves (passthrough, optional, literal, or anyOf). A `FAIL_CLOSED` entry always renders inline rather than being dropped, and exits non-zero. `--plan` and execution read the same resolution, so what the plan prints is what runs.",
       "`--local` exists because a `requiresOpenPr` check (the core `closes-n`/`test-plan`, or a custom check declaring the same field) can only evaluate for real once a pull request exists — the generated `pre-commit`/`pre-push` hooks pass it so the first commit on a fresh task branch is never asked to satisfy a PR-body field before a PR can possibly exist. CI's `vinaya-checks.yml` omits it, so these checks always run for real once a PR is open."
     ],
     status: "shipped"
@@ -6157,6 +7054,9 @@ var COMMANDS = [
   {
     name: "new check",
     description: "Scaffold a custom check into ./scripts/vinaya-checks/",
+    details: [
+      "Takes the REGISTRATION KEY, not a bare name: `vinaya new check <yourname>/<id>` writes `./scripts/vinaya-checks/<id>.ts` and prints the namespaced `checks` entry to paste. It refuses a bare, un-namespaced name — `vinaya check` refuses its entire run over a key it cannot resolve, so scaffolding one would brick every check invocation in the repo — and refuses a core check id, since registering one REPLACES that core gate and a scaffolded stub is never what an adopter means by that."
+    ],
     status: "shipped"
   },
   {
@@ -6191,6 +7091,21 @@ var COMMANDS = [
     ],
     status: "shipped"
   },
+  {
+    name: "pr report",
+    description: "Emit the AEG:EVIDENCE block — a PR body's factual claims, from commands, never typed",
+    flags: [
+      {
+        flag: "--write",
+        description: "Path to the PR body file; replaces the content between the AEG:EVIDENCE anchors in place"
+      }
+    ],
+    details: [
+      "Two groups: Group A (recomputable) is the head sha and a width-invariant `git diff --numstat` against the merge-base with `BASE_SHA` (else `origin/main`, then `main`) — `check-evidence-fresh` recomputes and byte-compares this exactly. Group B (attested) is the result of `vinaya check --all --diff-only`, this CLI's own portable gate suite — `check-evidence-fresh` can only check it for staleness (the block's recorded head still matches the PR's real head), never re-run it.",
+      "With no `--write`, prints the block to stdout instead of writing a file. Exits non-zero whenever the gate run failed, whether or not `--write` was given — the block records a failing result rather than hiding one, and a non-zero exit stops a scripted `--write && open-pr` from carrying a failing suite onto the forge."
+    ],
+    status: "shipped"
+  },
   {
     name: "issue create",
     description: "Open an issue after full brief-schema validation",
@@ -6220,12 +7135,55 @@ var COMMANDS = [
     ],
     status: "shipped"
   },
+  {
+    name: "review post",
+    description: "Render, post, and self-verify a code-reviewer or security-review verdict comment on a PR",
+    flags: [
+      { flag: "--role", description: "`code-reviewer` or `security` — selects which role template is rendered" },
+      {
+        flag: "--pr",
+        description: "Target PR number — its real head is resolved via `gh pr view`, never caller-supplied"
+      },
+      {
+        flag: "--verdict",
+        description: "code-reviewer: `APPROVE` | `REQUEST_CHANGES`. security: `PASS` | `FAIL`"
+      },
+      {
+        flag: "--findings-file",
+        description: "One finding per line: `SEVERITY|file:line|description` (`|`-delimited). Omit for zero findings."
+      },
+      { flag: "--brief-conformance", description: "code-reviewer only: the BRIEF CONFORMANCE line" },
+      { flag: "--spec-conformance", description: "code-reviewer only: the SPEC CONFORMANCE line" },
+      { flag: "--scope", description: "code-reviewer only: the SCOPE line" },
+      { flag: "--tests", description: "code-reviewer only: the TESTS line" },
+      { flag: "--docs", description: "code-reviewer only: the DOCS line" },
+      { flag: "--config-scan", description: "security only: the CONFIG SCAN line" },
+      { flag: "--secrets", description: "security only: the SECRETS line" },
+      {
+        flag: "--secrets-evidence-file",
+        description: 'security only: required whenever `--secrets` claims "none found" — the pasted scanner output backing that claim'
+      },
+      { flag: "--task-id", description: "the closing `Tokens:` line's task id" },
+      { flag: "--model", description: "the closing `Tokens:` line's model name" },
+      { flag: "--tokens-in", description: "a non-negative integer, or `-` if unknown" },
+      { flag: "--tokens-out", description: "a non-negative integer, or `-` if unknown" },
+      { flag: "--cost", description: "free text, or `-` if unknown" },
+      { flag: "--json", description: "Enveloped JSON output (schema: 1)" }
+    ],
+    details: [
+      "Every structural line (`VERDICT:`, `Judged head:`) is rendered from this command's own validated enum/sha inputs — never from a caller-supplied string — so a Reviewer's free-typed prose can no longer produce a shape the merge gate's line-anchored regex fails to see.",
+      "Refuses a contradictory verdict before posting anything: a BLOCKER finding with `--verdict APPROVE`, or a CRITICAL/HIGH finding with `--verdict PASS`, is rejected outright, mirroring each role doc's own consistency rule.",
+      "After posting, re-fetches the PR's comments and runs them through the exact `extractCodeReviewVerdict`/`extractSecurityReviewVerdict` functions `checkReviewGate` calls — the same functions, not a second implementation — and exits non-zero naming precisely what failed to re-parse if the post does not come back clean and bound to the resolved head. There is no `--skip-verify` escape."
+    ],
+    status: "shipped"
+  },
   {
     name: "doctor",
     description: "Diagnose hook, workflow, and config health — report only, never mutates",
     flags: [{ flag: "--json", description: "Enveloped JSON output (schema: 1)" }],
     details: [
-      'Carries the same env-declaration diagnostic `vinaya check` warns with — permanently, at `info` severity, not just ahead of the spawn-default flip — plus a `warn`-severity lint over suspicious `env` literal forms (a stray `"true"`/`"false"` string, or a high-entropy literal that reads like a leaked secret committed to config).'
+      'Carries the same env-declaration diagnostic `vinaya check` warns with — permanently, at `info` severity, not just ahead of the spawn-default flip — plus a `warn`-severity lint over suspicious `env` literal forms (a stray `"true"`/`"false"` string, or a high-entropy literal that reads like a leaked secret committed to config).',
+      "Also carries the two permanent `checks`-classification diagnostics: a config key that REPLACES a core check (`warn`), and a bare un-namespaced key that is REJECTED (`error`, naming the rename requirement). These are the reason a config `vinaya check` now refuses outright is still diagnosable — the refusal runs nothing, so `doctor` is the surface that explains why."
     ],
     status: "shipped"
   },
@@ -6364,9 +7322,9 @@ function printHelp() {
 }
 
 // src/index.ts
-var PACKAGE_ROOT = join20(dirname8(fileURLToPath2(import.meta.url)), "..");
+var PACKAGE_ROOT = join22(dirname8(fileURLToPath2(import.meta.url)), "..");
 function readVersion2() {
-  const pkg = JSON.parse(readFileSync18(join20(PACKAGE_ROOT, "package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync20(join22(PACKAGE_ROOT, "package.json"), "utf-8"));
   return pkg.version;
 }
 var [, , command, ...args] = process.argv;
@@ -6449,8 +7407,10 @@ try {
         prCreateCommand(rest);
       } else if (subcommand === "edit") {
         prEditCommand(rest);
+      } else if (subcommand === "report") {
+        await prReportCommand(rest);
       } else {
-        console.error(`Unknown 'pr' subcommand: ${subcommand ?? "(none)"} (expected 'create' or 'edit')`);
+        console.error(`Unknown 'pr' subcommand: ${subcommand ?? "(none)"} (expected 'create', 'edit', or 'report')`);
         process.exit(2);
       }
       break;
@@ -6467,6 +7427,16 @@ try {
       }
       break;
     }
+    case "review": {
+      const [subcommand, ...rest] = args;
+      if (subcommand === "post") {
+        await reviewPostCommand(rest);
+      } else {
+        console.error(`Unknown 'review' subcommand: ${subcommand ?? "(none)"} (expected 'post')`);
+        process.exit(2);
+      }
+      break;
+    }
     case "demo": {
       const [subcommand, ...rest] = args;
       if (subcommand === "break") {