diff --git a/contrib/VREF/gl-VREF-FILETYPE b/contrib/VREF/gl-VREF-FILETYPE
new file mode 100755
index 0000000..e61acc6
--- /dev/null
+++ b/contrib/VREF/gl-VREF-FILETYPE
@@ -0,0 +1,45 @@
+#!/bin/bash
+
+# gitolite VREF to find autogenerated files
+
+# *completely* site specific; use it as an illustration of what can be done
+# with gitolite VREFs if you wish
+
+# see gitolite docs for what the first 7 arguments mean
+
+# inputs:
+#   arg-8 is currently only one possible value: AUTOGENERATED
+# outputs (STDOUT)
+#   arg-7 if any files changed in the push look like they were autogenerated
+#   otherwise nothing
+# exit status:
+#   always 0
+
+die() { echo "$@" >&2; exit 1; }
+[ -z "$8" ] && die "not meant to be run manually"
+
+newsha=$3
+oldtree=$4
+newtree=$5
+refex=$7
+
+option=$8
+
+[ "$option" = "AUTOGENERATED" ] && {
+    # currently we only look for ".java" programs with the string "Generated
+    # by the protocol buffer compiler.  DO NOT EDIT" in them.
+
+    git log --name-only $nf --format=%n $newtree --not --all |
+        grep . |
+        sort -u |
+        grep '\.java$' |
+    while read fn
+    do
+        git show "$newtree:$fn" | egrep >/dev/null \
+            'Generated by the protocol buffer compiler. +DO NOT EDIT' ||
+            continue
+
+        echo $refex
+        exit 0
+    done
+}
diff --git a/t/t14-vrefs b/t/t14-vrefs-1
similarity index 100%
rename from t/t14-vrefs
rename to t/t14-vrefs-1
diff --git a/t/t14-vrefs-2 b/t/t14-vrefs-2
new file mode 100644
index 0000000..ff6e3e3
--- /dev/null
+++ b/t/t14-vrefs-2
@@ -0,0 +1,131 @@
+# vim: ft=sh:
+tsh pwd || die '## tsh not installed?'
+
+# note 'tc' is an abbreviation for 'test-commit' in tsh lingo
+
+for wr in 0 1
+do
+    for bc in 0 1
+    do
+        cd $TESTDIR
+        $TESTDIR/rollback || die "rollback failed"
+        editrc GL_WILDREPOS $wr
+        editrc GL_BIG_CONFIG $bc
+
+        # ----------
+
+        name "INTERNAL"
+        echo "
+            @gfoo = foo
+            @lead = u1
+            @senior_devs = u2 u3
+            @junior_devs = u4 u5 u6
+            repo  @gfoo
+
+                RW+                                 =   @all
+
+                RW+ VREF/COUNT/2/NO_SIGNOFF         =   @lead
+                -   VREF/COUNT/2/NO_SIGNOFF         =   @all
+
+                -   VREF/COUNT/10/NEWFILES          =   @junior_devs
+
+                -   VREF/FILETYPE/AUTOGENERATED     =   @all
+        " | ugc
+
+        name "setup"
+        cd ~/td
+        tsh "
+            ls -al foo;         !ok;    /cannot access foo: No such file or directory/
+            clone u1:foo;       ok;     /Cloning into/
+                                        /You appear to have cloned an empty/
+        "
+        cd foo
+        tsh "
+            ls -Al;             ok;     /\.git/
+        "
+
+        name "u1 can push 15 new files"
+        tsh "
+            tc a b c d e f g h i j k l m n o
+                                ok;     /d8c0392/
+            push-om;            ok;     /new branch.*master -. master/
+        "
+
+        name "u2 can push 2 new and 10 old files without signoff"
+        tsh "
+            tc a b c d e f g h i j u2a u2b
+                                ok;     /6787ac9/
+            push u2:foo;        ok;     /d8c0392..6787ac9.*master -. master/
+        "
+        name "u2 cannot push 3 new files without signoff"
+        tsh "
+            tc u2c u2d u2e;     ok;     /a74562b/
+            push u2:foo;        !ok;    /W VREF/COUNT/2/NO_SIGNOFF foo u2 DENIED by VREF/COUNT/2/NO_SIGNOFF/
+                                        /top commit message should include the text .3 new files signed-off by: tester.example.com./
+                                        /hook declined/
+                                        /remote rejected/
+        "
+        name "u2 can push 15 new files with signoff"
+        tsh "
+            tc u2f u2g u2h u2i u2j u2k u2l u2m u2n u2o u2p u2q
+                                ok;     /8dd31aa/
+            git commit --allow-empty -m '15 new files signed-off by: tester@example.com'
+                                ok;     /.master 6126489. 15 new files signed-off by: tester.example.com/
+            push u2:foo;        ok;     /6787ac9..6126489.*master -. master/
+        "
+
+        name "u4 can push 2 new and 10 old files without signoff"
+        tsh "
+            tc u4a u4b a b c d e f g h i j
+                                ok;     /76c5593/
+            push u4:foo;        ok;     /6126489..76c5593.*master -. master/
+        "
+        name "u4 cannot push 3 new files without signoff"
+        tsh "
+            tc u4c u4d u4e;     ok;     /2a84398/
+            push u4:foo;        !ok;    /W VREF/COUNT/2/NO_SIGNOFF foo u4 DENIED by VREF/COUNT/2/NO_SIGNOFF/
+                                        /top commit message should include the text .3 new files signed-off by: tester.example.com./
+                                        /hook declined/
+                                        /remote rejected/
+        "
+        name "u4 can push 10 new and 5 old files with signoff"
+        tsh "
+            tc u4f u4g u4h u4i u4j u4k u4l a b c d e
+                                ok;     /09b646a/
+            git commit --allow-empty -m '10 new files signed-off by: tester@example.com'
+                                ok;     /.master 47f84b0. 10 new files signed-off by: tester.example.com/
+            push u4:foo;        ok;     /76c5593..47f84b0.*master -. master/
+        "
+        name "u4 cannot push 11 new files even with signoff"
+        tsh "
+            tc u4ab u4ac u4ad u4ae u4af u4ag u4ah u4ai u4aj u4ak u4al
+                                ok;     /90e7344/
+            git commit --allow-empty -m '11 new files signed-off by: tester@example.com'
+                                ok;     /.master 1f36537. 11 new files signed-off by: tester.example.com/
+            push u4:foo;        !ok;    /W VREF/COUNT/10/NEWFILES foo u4 DENIED by VREF/COUNT/10/NEWFILES/
+                                        /too many new files in this push/
+                                        /hook declined/
+                                        /remote rejected/
+        "
+
+        name "test AUTOGENERATED vref"
+        tsh "
+            fetch;              ok;
+            reset-h origin/master;
+                                ok;
+        "
+        tsh "
+            tc not-really.java; ok;     /0f88b2e/
+            push u4:foo;        ok;     /47f84b0..0f88b2e.*master -. master/
+        "
+        echo "Generated by the protocol buffer compiler.  DO NOT EDIT" >> not-really.java
+        tsh "
+            commit -am pbc;     ok;     /aa3d8da/
+            push u4:foo;        !ok;    /W VREF/FILETYPE/AUTOGENERATED foo u4 DENIED by VREF/FILETYPE/AUTOGENERATED/
+                                        /hook declined/
+                                        /remote rejected/
+        "
+
+        name INTERNAL
+    done
+done
diff --git a/t/test-driver.sh b/t/test-driver.sh
index b7088b2..7ab67f0 100755
--- a/t/test-driver.sh
+++ b/t/test-driver.sh
@@ -162,4 +162,4 @@ do
 done
 
 # this keeps changing as we add tests
-echo 1..3459
+echo 1..3723