Ring 0 push checks

How the push hook runs

The managed pre-push hook (.vinaya/hooks/pre-push) runs four steps in order:

1. 1

   Format

   Biome, over the files changed since the remote base.

2. 2

   Record what is being pushed

   It reads git's pre-push input into VINAYA_PUSH_REFS and exports it.

3. 3

   Run the Vinaya checks

   vinaya check --all --local, with VINAYA_HOST=hook set. This is the gate.

4. 4

   Typecheck and test

   bunx turbo typecheck --affected, then the test files the import graph selects, plus any in prePush.alwaysRun.

The gate passes --local, which skips every check that declares requiresOpenPr. It passes neither --skip-full nor --diff-only, so it runs every Ring 0 check:

• the 11 scope: 'diff' checks that already ran at commit (see Ring 0 commit checks);
• the 14 scope: 'full' checks below, which the commit hook skips (skip reason full-scope, pre-commit) and which run for the first time here.

main-branch-refusal is one of the 11 commit checks. It is listed on this page too, because it refuses a push as well as a commit.

--diff-only never skips a scope: 'full' check, so all 14 run again in CI.

Where they run again

None of these 14 declares validates, so none runs on the pull-request write path.

Checks

coherence

A task branch, its tranche, its Issue and the forge must tell one story, so drift between them is refused before more work lands on it.

dispatch-readiness

A task may only be worked when its Issue, dependencies and conflicts allow it, so a push from a task that is not ready is refused.

registry-gates

The gate registry, the hooks, the workflows and the doctrine must describe one set of gates, so any disagreement among them is refused.

branch-topology

A task branch's name names a task, so a push is refused when no such task exists on the forge.

dead-branch-push

Work on a branch whose pull request is already merged or closed is finished, and pushing there would reopen it.

first-push-dispatch

The first push of a task branch is the moment work starts, so it must come from a task that is ready to dispatch.

reader-resolvable-prose

Prose a reader cannot resolve, such as a forge number or an undefined coined term, is useless to anyone without the author's context.

retired-vocabulary

Terms Vinaya has retired must not come back into the doctrine, where they would describe a method that no longer exists.

doctrine-portability

Shipped doctrine is read in other repositories, so it must not cite paths that exist only in the repository it was written in.

doctrine-no-procedures

Doctrine describes rules, not runbooks, and a command sequence in doctrine goes stale as soon as the commands change.

doc-claims

An AEG:CLAIM marker binds a sentence to text in a cited file, and when the file stops holding that text, the sentence is no longer true.

workspace-escape

A constructed file path that reaches into another workspace package is invisible to the dependency graph and breaks silently when that package moves.

quoted-command

A doc that quotes a command or config line as present fact goes stale when the quoted file changes, so marked quotes are compared with their file.

main-branch-refusal

Work belongs on its own branch and reaches the default branch only by pull request, so a commit or a push on the default branch is refused.

token-collection-wired

When usage collection is wired but cannot reach its transcript, token reports would silently go empty, so that broken wiring is refused.

What gets logged

Every vinaya check run writes gate events:

See Events for every field.

Configuration

What's next