diff --git a/src/VREF/COUNT b/src/VREF/COUNT
new file mode 100755
index 0000000..f61ab57
--- /dev/null
+++ b/src/VREF/COUNT
@@ -0,0 +1,51 @@
+#!/bin/bash
+
+# gitolite VREF to count number of changed/new files in a push
+
+# see gitolite docs for what the first 7 arguments mean
+
+# inputs:
+#   arg-8 is a number
+#   arg-9 is optional, and can be "NEWFILES"
+# outputs (STDOUT)
+#   arg-7 if the number of changed (or new, if arg-9 supplied) files is > arg-8
+#   otherwise nothing
+# exit status:
+#   always 0
+
+die() { echo "$@" >&2; exit 1; }
+[ -z "$8" ] && die "not meant to be run manually"
+
+newsha=$3
+oldtree=$4
+newtree=$5
+refex=$7
+
+max=$8
+
+nf=
+[ "$9" = "NEWFILES" ] && nf='--diff-filter=A'
+# NO_SIGNOFF implies NEWFILES
+[ "$9" = "NO_SIGNOFF" ] && nf='--diff-filter=A'
+
+# count files against all the other commits in the system not just $oldsha
+# (why?  consider what is $oldtree when you create a new branch, or what is
+# $oldsha when you update an old feature branch from master and then push it
+count=`git log --name-only $nf --format=%n $newtree --not --all | grep . | sort -u | wc -l`
+
+[[ $count -gt $max ]] && {
+    # count has been exceeded.  If $9 was NO_SIGNOFF there's still a chance
+    # for redemption -- if the top commit has a proper signed-off by line
+    [ "$9" = "NO_SIGNOFF" ] && {
+        author_email=$(git log --format=%ae -1 $newsha)
+        git cat-file -p $newsha |
+            egrep -i >/dev/null "^ *$count +new +files +signed-off by: *$author_email *$" && exit 0
+        echo $refex top commit message should include the text \'$count new files signed-off by: $author_email\'
+        exit 0
+    }
+    echo -n $refex "(too many "
+    [ -n "$nf" ] && echo -n "new " || echo -n "changed "
+    echo "files in this push)"
+}
+
+exit 0
diff --git a/src/VREF/FILETYPE b/src/VREF/FILETYPE
new file mode 100755
index 0000000..e61acc6
--- /dev/null
+++ b/src/VREF/FILETYPE
@@ -0,0 +1,45 @@
+#!/bin/bash
+
+# gitolite VREF to find autogenerated files
+
+# *completely* site specific; use it as an illustration of what can be done
+# with gitolite VREFs if you wish
+
+# see gitolite docs for what the first 7 arguments mean
+
+# inputs:
+#   arg-8 is currently only one possible value: AUTOGENERATED
+# outputs (STDOUT)
+#   arg-7 if any files changed in the push look like they were autogenerated
+#   otherwise nothing
+# exit status:
+#   always 0
+
+die() { echo "$@" >&2; exit 1; }
+[ -z "$8" ] && die "not meant to be run manually"
+
+newsha=$3
+oldtree=$4
+newtree=$5
+refex=$7
+
+option=$8
+
+[ "$option" = "AUTOGENERATED" ] && {
+    # currently we only look for ".java" programs with the string "Generated
+    # by the protocol buffer compiler.  DO NOT EDIT" in them.
+
+    git log --name-only $nf --format=%n $newtree --not --all |
+        grep . |
+        sort -u |
+        grep '\.java$' |
+    while read fn
+    do
+        git show "$newtree:$fn" | egrep >/dev/null \
+            'Generated by the protocol buffer compiler. +DO NOT EDIT' ||
+            continue
+
+        echo $refex
+        exit 0
+    done
+}
diff --git a/t/vrefs-1.t b/t/vrefs-1.t
new file mode 100755
index 0000000..4512ab8
--- /dev/null
+++ b/t/vrefs-1.t
@@ -0,0 +1,135 @@
+#!/usr/bin/perl
+use strict;
+use warnings;
+
+# this is hardcoded; change it if needed
+use lib "src";
+use Gitolite::Test;
+
+try "plan 90";
+
+put "conf/gitolite.conf", "
+    repo gitolite-admin
+        RW+     =   admin
+
+    \@gfoo = foo
+    \@lead = u1
+    \@dev2 = u2
+    \@dev4 = u4
+    \@devs = \@dev2 \@dev4 u6
+    repo  \@gfoo
+          RW+                   =   \@lead \@devs
+          # intentional mis-spelling
+          -     VREF/MISCOUNT/2    =   \@dev2
+          -     VREF/MISCOUNT/4    =   \@dev4
+          -     VREF/MISCOUNT/3/NEWFILES   =   u6
+          -     VREF/MISCOUNT/6            =   u6
+";
+
+try "
+    ADMIN_PUSH vr1a
+    cd ..
+    ls -al foo;                 !ok;    /cannot access foo: No such file or directory/
+    CLONE u1 file://foo;        ok;     /Cloning into/
+                                        /You appear to have cloned an empty/
+    cd foo;                     ok
+    ls -Al;                     ok;     /\.git/
+
+    # VREF not called for u1
+    tc a1 a2 a3 a4 a5;          ok;     /aaf9e8e/
+    PUSH u1 origin master;      ok;     /new branch.*master -. master/
+                                        !/helper program missing/
+                                        !/hook declined/
+                                        !/remote rejected/
+    # VREF is called for u2
+    tc b1;                      ok;     /1f440d3/
+    PUSH u2 origin;             !ok;    /helper program missing/
+                                        /hook declined/
+                                        /remote rejected/
+";
+
+put "../gitolite-admin/conf/gitolite.conf", "
+    repo gitolite-admin
+        RW+     =   admin
+
+    \@gfoo = foo
+    \@lead = u1
+    \@dev2 = u2
+    \@dev4 = u4
+    \@devs = \@dev2 \@dev4 u6
+    repo  \@gfoo
+          RW+                   =   \@lead \@devs
+          -     VREF/COUNT/2    =   \@dev2
+          -     VREF/COUNT/4    =   \@dev4
+          -     VREF/COUNT/3/NEWFILES   =   u6
+          -     VREF/COUNT/6            =   u6
+";
+
+try "
+    ADMIN_PUSH vr1b
+    cd ../foo;                  ok
+
+    # u2 1 file
+    PUSH u2 origin;             ok;     /aaf9e8e..1f440d3.*master -. master/
+
+    # u2 2 files
+    tc b2 b3;                   ok;     /c3397f7/
+    PUSH u2 origin;             ok;     /1f440d3..c3397f7.*master -. master/
+
+    # u2 3 files
+    tc c1 c2 c3;                ok;     /be242d7/
+    PUSH u2 origin;             !ok;    /W VREF/COUNT/2 foo u2 DENIED by VREF/COUNT/2/
+                                        /too many changed files in this push/
+                                        /hook declined/
+                                        /remote rejected/
+
+    # u4 3 files
+    PUSH u4 origin;             ok;     /c3397f7..be242d7.*master -. master/
+
+    # u4 4 files
+    tc d1 d2 d3 d4;             ok;     /88d80e2/
+    PUSH u4 origin;             ok;     /be242d7..88d80e2.*master -. master/
+
+    # u4 5 files
+    tc d5 d6 d7 d8 d9;          ok;     /e9c60b0/
+    PUSH u4 origin;             !ok;    /W VREF/COUNT/4 foo u4 DENIED by VREF/COUNT/4/
+                                        /too many changed files in this push/
+                                        /hook declined/
+                                        /remote rejected/
+
+    # u1 all files
+    PUSH u1 origin;             ok;     /88d80e2..e9c60b0.*master -. master/
+
+    # u6 6 old files
+    test-tick
+    tc d1 d2 d3 d4 d5 d6
+                                ok;     /2773f0a/
+    PUSH u6 origin;             ok;     /e9c60b0..2773f0a.*master -. master/
+    tag six
+
+    # u6 updates 7 old files
+    test-tick; test-tick
+    tc d1 d2 d3 d4 d5 d6 d7
+                                ok;     /d3fb574/
+    PUSH u6 origin;             !ok;    /W VREF/COUNT/6 foo u6 DENIED by VREF/COUNT/6/
+                                        /too many changed files in this push/
+                                        /hook declined/
+                                        /remote rejected/
+    reset-h six;                ok;     /HEAD is now at 2773f0a/
+
+    # u6 4 new 2 old files
+    test-tick; test-tick
+    tc d1 d2 n1 n2 n3 n4
+                                ok;     /9e90848/
+    PUSH u6 origin;             !ok;    /W VREF/COUNT/3/NEWFILES foo u6 DENIED by VREF/COUNT/3/NEWFILES/
+                                        /too many new files in this push/
+                                        /hook declined/
+                                        /remote rejected/
+    reset-h six;                ok;     /HEAD is now at 2773f0a/
+
+    # u6 3 new 3 old files
+    test-tick; test-tick
+    tc d1 d2 d3 n1 n2 n3
+                                ok;     /e47ff5d/
+    PUSH u6 origin;             ok;     /2773f0a..e47ff5d.*master -. master/
+";
diff --git a/t/vrefs-2.t b/t/vrefs-2.t
new file mode 100755
index 0000000..3ff1037
--- /dev/null
+++ b/t/vrefs-2.t
@@ -0,0 +1,106 @@
+#!/usr/bin/perl
+use strict;
+use warnings;
+
+# this is hardcoded; change it if needed
+use lib "src";
+use Gitolite::Test;
+
+try "plan 74";
+
+put "../gitolite-admin/conf/gitolite.conf", "
+    \@gfoo = foo
+    \@lead = u1
+    \@senior_devs = u2 u3
+    \@junior_devs = u4 u5 u6
+    repo  \@gfoo
+
+        RW+                                 =   \@all
+
+        RW+ VREF/COUNT/2/NO_SIGNOFF         =   \@lead
+        -   VREF/COUNT/2/NO_SIGNOFF         =   \@all
+
+        -   VREF/COUNT/10/NEWFILES          =   \@junior_devs
+
+        -   VREF/FILETYPE/AUTOGENERATED     =   \@all
+";
+
+try "
+    ADMIN_PUSH vr2a
+    cd ..
+    # setup
+    ls -al foo;                 !ok;    /cannot access foo: No such file or directory/
+    CLONE u1 file://foo;        ok;     /Cloning into/
+                                        /You appear to have cloned an empty/
+    cd foo;                     ok
+    ls -Al;                     ok;     /\.git/
+
+    # u1 push 15 new files
+    tc a b c d e f g h i j k l m n o
+                                ok;     /d8c0392/
+    PUSH u1 origin master;      ok;     /new branch.*master -. master/
+
+    # u2 push 2 new 10 old without signoff
+    tc a b c d e f g h i j u2a u2b
+                                ok;     /6787ac9/
+    PUSH u2 origin;             ok;     /d8c0392..6787ac9.*master -. master/
+
+    # u2 fail to push 3 new files without signoff
+    tc u2c u2d u2e;             ok;     /a74562b/
+    PUSH u2 origin;             !ok;    /W VREF/COUNT/2/NO_SIGNOFF foo u2 DENIED by VREF/COUNT/2/NO_SIGNOFF/
+                                        /top commit message should include the text .3 new files signed-off by: tester.example.com./
+                                        /hook declined/
+                                        /remote rejected/
+    # u2 push 15 new files with signoff
+    tc u2f u2g u2h u2i u2j u2k u2l u2m u2n u2o u2p u2q
+                                ok;     /8dd31aa/
+    git commit --allow-empty -m '15 new files signed-off by: tester\@example.com'
+                                ok;     /.master 6126489. 15 new files signed-off by: tester.example.com/
+    PUSH u2 origin;             ok;     /6787ac9..6126489.*master -. master/
+
+    # u4 push 2 new 10 old files without signoff
+    tc u4a u4b a b c d e f g h i j
+                                ok;     /76c5593/
+    PUSH u4 origin;             ok;     /6126489..76c5593.*master -. master/
+
+    # u4 fail push 3 new files withoug signoff
+    tc u4c u4d u4e;             ok;     /2a84398/
+    PUSH u4 origin;             !ok;    /W VREF/COUNT/2/NO_SIGNOFF foo u4 DENIED by VREF/COUNT/2/NO_SIGNOFF/
+                                        /top commit message should include the text .3 new files signed-off by: tester.example.com./
+                                        /hook declined/
+                                        /remote rejected/
+
+    # u4 push 10 new 5 old with signoff
+    tc u4f u4g u4h u4i u4j u4k u4l a b c d e
+                                ok;     /09b646a/
+    git commit --allow-empty -m '10 new files signed-off by: tester\@example.com'
+                                ok;     /.master 47f84b0. 10 new files signed-off by: tester.example.com/
+    PUSH u4 origin;             ok;     /76c5593..47f84b0.*master -. master/
+
+    # u4 fail push 11 new files even with signoff
+    tc u4ab u4ac u4ad u4ae u4af u4ag u4ah u4ai u4aj u4ak u4al
+                                ok;     /90e7344/
+    git commit --allow-empty -m '11 new files signed-off by: tester\@example.com'
+                                ok;     /.master 1f36537. 11 new files signed-off by: tester.example.com/
+    PUSH u4 origin;             !ok;    /W VREF/COUNT/10/NEWFILES foo u4 DENIED by VREF/COUNT/10/NEWFILES/
+                                        /too many new files in this push/
+                                        /hook declined/
+                                        /remote rejected/
+
+    # test AUTOGENERATED vref
+    glt fetch u1 origin;        ok;
+    reset-h origin/master;      ok;
+    tc not-really.java;         ok;     /0f88b2e/
+    PUSH u4 origin;             ok;     /47f84b0..0f88b2e.*master -. master/
+";
+
+put "|cat >> not-really.java", "
+    Generated by the protocol buffer compiler.  DO NOT EDIT
+";
+
+try "
+    commit -am pbc;             ok;     /b2df6ef/
+    PUSH u4 origin;             !ok;    /W VREF/FILETYPE/AUTOGENERATED foo u4 DENIED by VREF/FILETYPE/AUTOGENERATED/
+                                        /hook declined/
+                                        /remote rejected/
+";