rail_verdict 1.2.0 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cd73e695fc399f10d5e9dcde4f8f04294948160821c9f256234e79d6345bb8e0
-  data.tar.gz: dfb8a4b7ae5613ab75ef864dfbca00d3fa7c6241ad47937241e524aa5724b7ff
+  metadata.gz: 63845a29f84295397de20a23b72c7d6e0a9d6c969be35ac8081e2536b0a37cec
+  data.tar.gz: 6e778d530c6abe87db5997b9d5fe328ebd750ac1722ede75042195b5d98d92cf
 SHA512:
-  metadata.gz: 9faf8ca3b218e240f87800727704caa02c588d5e88fa8a614a15f0862928ad4ccd36725bbd66300d89330c9994a4f16c2f7d63cd14df2c79899b8d4380bb95de
-  data.tar.gz: 05daa4f456785c207522f9c8be75066ee0a7c112ee5681b7ea311151b3e0b2180fee7008ff97e5b79f12f439751c115a43cefc7550a1a6e16c1637296d9415c5
+  metadata.gz: beabe5b069a803549a6af55d03f16256e5ebe7e5ab6152672a7a1fa415a75827656108c01207860251fc8936fdc3bfb6397c1f53ca53f342da5ee913051d1c2a
+  data.tar.gz: 72e637013c3a4216a90fcb466c947b6b6e97bc9035166bb8b96b76b62579c76f1253eb765d1c56ac1e39dd82197489c3535a411fece8535c6cd340bd0e741ac9

data/README.md

@@ -78,18 +78,11 @@ The Lab exercises RailVerdict across realistic operational scenarios:
 - Exercising fail-closed behavior on missing or malformed analyzer output;
 - Testing release artifact installation from clean environments.
 
-### 21 / 21 External Validation Campaign
+### External Validation Campaign
 
-The 1.0 release closeout validated **21 out of 21** external scenarios:
+The Lab independently validates the published gem as an external consumer. 1.0 closeout validated **21 / 21** scenarios; **1.2.0** certification validates **81 scenarios** (14 categories, see Lab README) including Verification Receipts and PR Intelligence. See [railverdict-lab](https://github.com/pedro-dalben/railverdict-lab) for the canonical campaign and results.
 
-| Category | Scenarios | Result |
-|---|---:|:---:|
-| **Core Verification** | 12 / 12 | PASS |
-| **Operational & CI** | 6 / 6 | PASS |
-| **Release Closeout** | 3 / 3 | PASS |
-| **Total** | **21 / 21** | **PASS** |
-
-These controlled validation scenarios represent rigorous external regression verification rather than a claim of mathematically bug-free software. During development, the Lab uncovered real defects — such as test failure scoping edge cases — which were fixed before the 1.0 release.
+These controlled validation scenarios represent rigorous external regression verification rather than a claim of mathematically bug-free software. During development, the Lab uncovered real defects — such as test failure scoping edge cases and the 1.2 dogfooding hardening — which were fixed before release.
 
 ---
 
@@ -236,11 +229,73 @@ an explicit value, including every analyzer in older configuration versions,
 continues to use 30 seconds. A timeout is incomplete evidence, never a normal
 finding: a required timeout produces `INCOMPLETE` and exit code `2`.
 
-RailVerdict 1.0.1 has no CLI timeout override; the versioned configuration is
+There is no CLI timeout override; the versioned configuration (`version: 1.5`) is
 the supported public surface. SimpleCov accepts the same setting for a uniform
 configuration contract, but reads a local coverage artifact rather than
 starting an analyzer process.
 
+### 30-Second Demonstration (real output)
+
+```console
+$ railverdict check
+
+RailVerdict Verification: PASS
+Policy: no_new_debt (complete)
+Analyzers: 5 run (5 complete)
+Findings: 0 introduced, 0 existing, 0 blocking
+Exit: 0
+```
+
+Introduce a controlled defect:
+
+```ruby
+# app/models/user.rb:42
+unused = "oops" # Lint/UselessAssignment
+```
+
+```console
+$ railverdict check
+
+RailVerdict Verification: FAIL
+Policy: no_new_debt (failed)
+Findings: 1 introduced (blocking), 0 existing
+  - [rubocop] Lint/UselessAssignment in app/models/user.rb:42 (introduced)
+Exit: 1
+```
+
+Fix it, rerun → `PASS`. See `docs/release/1.2-clean-room-rehearsal.md` for automated reproduction.
+
+### Why not just CI?
+
+CI answers **“did these jobs execute successfully?”** across fragmented outputs. RailVerdict answers **“given required evidence, repository state, baseline and policy, what is the deterministic verification decision for this change?”** — normalized findings, baseline-aware policy (`no_new_debt`), changed-scope (`--changed --base`), fail-closed `INCOMPLETE` on missing evidence, and machine contracts (JSON/SARIF/exits) plus Repository State Identity and Verification Receipts. It complements CI; the example in [GitHub Actions Integration](#github-actions-integration) runs RailVerdict inside CI.
+
+### Why not just RSpec + RuboCop?
+
+Those are the evidence. RailVerdict is the verifier:
+
+```
+RSpec says:       42 tests passed.
+RuboCop says:     3 offenses.
+SimpleCov says:   91.3% coverage.
+Git says:         these 7 lines changed.
+RailVerdict says: FAIL — this change introduced a blocking finding.
+```
+
+They produce facts; policy owns the gate. `rubocop` + `rspec` + `minitest` + `simplecov` + `bundler-audit` + `Git` are inputs; `PASS/WARN/FAIL/INCOMPLETE` is the `GateResult` (see `docs/contracts.md`).
+
+### Why this matters for AI agents
+
+An AI agent can write code, run tests, and declare itself finished — but it should not be the authority deciding whether its own work is acceptable.
+
+```
+Agent --modifies--> Repository --verify--> RailVerdict
+                                           |--> deterministic evidence
+                                           |--> GateResult
+                                           `--> Verification Receipt
+```
+
+The agent proposes; the verification system decides. Receipts let agents (and humans) prove `fresh` vs `stale` after any edit — see below. AI inside RailVerdict (`explain`/`investigate`) is advisory only and never changes `GateResult`.
+
 ---
 
 ## The Default Policy Model: No New Debt
@@ -339,12 +394,28 @@ exit code `2`.
 Verification is only meaningful for the exact state that was verified. RailVerdict 1.2 binds every guarded verification to a deterministic **Repository State Identity** (HEAD + Git index snapshot + worktree delta with content hashes + configuration/baseline/waiver digests) and issues a machine-readable **Verification Receipt**:
 
 ```console
-$ railverdict receipt create --format json > receipt.json
+$ railverdict check
+# => RailVerdict Verification: PASS (exit 0)
+$ railverdict receipt create > receipt.json
+# receipt_id = sha256:<64 hex>  (no created_at, no timestamps)
+
 $ railverdict receipt verify receipt.json --format json
-{"schema_version":"1.0","status":"fresh","reasons":[],"gate":"PASS", ...}
+{"schema_version":"1.0","status":"fresh","reasons":[],"gate":"PASS"}
+```
+
+Edit anything afterwards and the same receipt reports `stale`:
+
+```console
+$ echo "# changed after verification" >> app/models/user.rb
+$ railverdict receipt verify receipt.json --format json
+{"schema_version":"1.0","status":"stale","reasons":["worktree_changed"],"gate":"PASS"}
+# exit 2 — current state is not what was verified
+
+# Same for staged, config, baseline, waiver edits:
+# head_changed | index_changed | worktree_changed | configuration_changed | baseline_changed | waivers_changed
 ```
 
-Edit anything afterwards — source, staged index, untracked files, config, baseline, waivers — and the same receipt reports `stale` with a deterministic reason (`head_changed`, `index_changed`, `worktree_changed`, `configuration_changed`, `baseline_changed`, `waivers_changed`). If the repository mutates while analyzers run, receipt issuance fails closed with `repository_changed_during_verification`. Receipts exist for PASS, FAIL, and INCOMPLETE alike; they are deterministic integrity records, not signed attestations — a trusted CI remains the trust anchor when forgery is in scope. Coding agents follow the completion protocol in [docs/agent-verification.md](docs/agent-verification.md).
+If the repository mutates while analyzers run, receipt issuance fails closed with `repository_changed_during_verification`. Receipts exist for `PASS`, `FAIL`, and `INCOMPLETE`; they are deterministic integrity records — **not signed attestations** — a trusted CI remains the trust anchor when forgery is in scope. Full protocol in [docs/agent-verification.md](docs/agent-verification.md).
 
 ```
 Deterministic Verification → PR Intelligence → Verification Receipt → Agent Verification Protocol
@@ -364,7 +435,7 @@ All analyzers in RailVerdict are **external and owned by the target project**. R
 | **SimpleCov** | Code and changed-line coverage | `>= 1, < 2` | Ingests versioned public `coverage/coverage.json` v1 (never parses internal `.resultset.json`). |
 | **bundler-audit** | Gem dependency vulnerabilities | `>= 0.9.3, < 1` | Runs `bundle exec bundler-audit check --format json` (never runs automatic updates). Robustly extracts JSON when advisory-DB download notices precede the payload. |
 
-> **Brakeman Status:** Brakeman support is **not included** in 1.0 (on HOLD pending legal and licensing review). Third-party analyzers retain their respective upstream licenses.
+> **Brakeman Status:** Brakeman support is **not included** in 1.2.0 (on HOLD pending legal and licensing review). Third-party analyzers retain their respective upstream licenses.
 
 ---
 
@@ -450,7 +521,44 @@ See [`docs/ai.md`](docs/ai.md) and [`docs/privacy.md`](docs/privacy.md) for deta
 
 ## Coding Agents & The Repair Loop
 
-RailVerdict provides a structured verification loop for AI coding agents (such as Claude, Codex, or custom agents):
+### Agent Completion Protocol (copyable for AGENTS.md / CLAUDE.md / Codex)
+
+Before declaring any code-changing task complete:
+
+1. Run the required project tests.
+2. Run `bundle exec railverdict check` (or `check --changed --base <main>` in PRs).
+3. If `FAIL`: remediate findings and rerun until `PASS` or explicitly report the blocker.
+4. If `INCOMPLETE` (exit 2): do not claim verification succeeded — fix the evidence gap (missing analyzer, bad base, shallow history).
+5. After final `PASS`, create `bundle exec railverdict receipt create > receipt.json`.
+6. Do not modify repository state after receipt creation without reverifying — `receipt verify` must stay `fresh`.
+
+`FAIL` means remediation required. `INCOMPLETE` must never be represented as `PASS`. See `docs/agent-verification.md` for the formal contract.
+
+<details><summary>AGENTS.md snippet (paste into your repo)</summary>
+
+```markdown
+## Verification
+
+Before completing any code-changing task:
+
+bundle exec railverdict check
+
+A task may only be reported as verified when RailVerdict returns PASS (exit 0).
+
+FAIL (exit 1) means remediation is required.
+
+INCOMPLETE (exit 2) means required evidence could not be obtained and must never be represented as PASS.
+
+After the final PASS, create a verification receipt: bundle exec railverdict receipt create > receipt.json
+
+Do not modify repository state after receipt creation without reverifying (receipt verify must be fresh).
+```
+
+Validated against 1.2.0: `init`, `doctor`, `check`, `pr`, `baseline create`, `findings`, `repair`, `receipt create|verify`, `mcp serve`.
+
+</details>
+
+RailVerdict also provides a structured verification loop for AI coding agents (such as Claude, Codex, or custom agents):
 
 ```
 Agent modifies code
@@ -503,6 +611,8 @@ railverdict mcp serve
 | `verify_repair` | Reruns verification and classifies whether a repair succeeded or regressed. |
 | `explain` | Generates an advisory AI explanation for a finding. |
 | `investigate` | Investigates top blocking findings across the codebase. |
+| `get_verification_receipt` | Returns the Verification Receipt for the last `verify` without rerunning analyzers (refuses stale cache). |
+| `get_pr_intelligence` | Returns PR Intelligence derived from the last `verify`'s GateResult (no rerun). |
 
 ### MCP Security Properties
 
@@ -575,7 +685,7 @@ To maintain clear technical boundaries, RailVerdict is explicitly **NOT**:
 
 ## Project Status
 
-- **Release Version:** `1.0.1`
+- **Release Version:** `1.2.0`
 - **License:** [MIT](LICENSE) (see [NOTICE](NOTICE))
 - **Trademarks:** [TRADEMARKS.md](TRADEMARKS.md)
 - **Foundation & Legal:** [docs/foundation.md](docs/foundation.md) — preliminary screen found no obvious software/tool conflict; NOT LEGAL CLEARANCE; qualified trademark review NOT PERFORMED — NON-BLOCKING BY MAINTAINER DECISION 2026-08-19 (Pedro Dalben).
@@ -605,9 +715,32 @@ To maintain clear technical boundaries, RailVerdict is explicitly **NOT**:
 
 ---
 
+## Try RailVerdict Challenge (5 minutes)
+
+1. `bundle add rail_verdict --group development,test --require false && bundle install`
+2. `bundle exec railverdict init && bundle exec railverdict doctor`
+3. `bundle exec railverdict baseline create` (or skip for greenfield) → `bundle exec railverdict check` → first gate
+4. Introduce a controlled RuboCop offense, rerun → `FAIL`, fix → `PASS`, then `railverdict receipt create && railverdict receipt verify`
+
+Tell us where it confused (see `docs/troubleshooting.md` and `docs/launch/try-challenge.md`).
+
+## FAQ
+
+**Is RailVerdict a test framework? Does it replace RSpec/RuboCop/CI?** No — it consumes them; they are evidence, it is the verifier. Run it inside CI.
+
+**Does it upload source? Require AI? Does AI decide PASS?** No/no/no — offline by default, AI advisory only off by default (`trust: redacted`).
+
+**Legacy apps?** Yes — `no_new_debt` baseline.
+
+**INCOMPLETE vs FAIL?** `FAIL` = complete verification rejected new debt; `INCOMPLETE` = required evidence missing → no gate (exit 2), never PASS.
+
+**Baseline / waiver / receipt?** Baseline snapshots current debt; waiver is exact-fingerprint, UTC-expired exemption; receipt is an integrity record (`receipt_id = sha256:`) — **not signed**, forgeable via whole-file rewrite — trusted CI is the trust anchor. Mutating after `PASS` makes receipt `stale`.
+
+**Brakeman / Ruby / Rails?** Brakeman not in 1.2.0 (HOLD); Ruby `>=3.3`, Rails `>=8.0` bounded.
+
 ## Contributing & Issues
 
-Contributions and issue reports are welcome. Please open an issue on GitHub for:
+Contributions and issue reports are welcome. See `CONTRIBUTING.md` for “how to run tests / add regression”. Issue templates: Bug, Feature request, Compatibility report. Please open an issue on GitHub for:
 
 - Analyzer compatibility and version range feedback;
 - False positives or false negatives in evidence normalization;

data/lib/rail_verdict/cli.rb

@@ -654,23 +654,24 @@ module RailVerdict
         return EXIT_NO_GATE
       end
 
+      effective_paths = begin
+        effective = Check.effective_input_paths(
+          root: @working_directory,
+          config_path: resolved_override_path(options[:config], File.join(@working_directory, DEFAULT_CONFIG_PATH)),
+          baseline_path_override: options[:baseline] && resolved_override_path(options[:baseline], nil),
+          waiver_path_override: options[:waiver] && resolved_override_path(options[:waiver], nil)
+        )
+        {
+          config: effective.fetch(:config),
+          baseline: effective.fetch(:baseline),
+          waivers: effective.fetch(:waivers)
+        }
+      end
       current_state = RepositoryState.capture(
         repository_root: @working_directory,
-        configuration_paths: begin
-          effective = Check.effective_input_paths(
-            root: @working_directory,
-            config_path: resolved_override_path(options[:config], File.join(@working_directory, DEFAULT_CONFIG_PATH)),
-            baseline_path_override: options[:baseline] && resolved_override_path(options[:baseline], nil),
-            waiver_path_override: options[:waiver] && resolved_override_path(options[:waiver], nil)
-          )
-          {
-            config: effective.fetch(:config),
-            baseline: effective.fetch(:baseline),
-            waivers: effective.fetch(:waivers)
-          }
-        end
+        configuration_paths: effective_paths
       )
-      document, _receipt = Receipt.evaluate(text, current_state: current_state)
+      document, _receipt = Receipt.evaluate(text, current_state: current_state, repository_root: @working_directory, configuration_paths: effective_paths)
       render_receipt_validation(document, options[:format])
       exit_code_for_validation(document)
     rescue RailVerdict::UsageError => error

data/lib/rail_verdict/mcp/cache.rb

@@ -6,6 +6,7 @@ require "json"
 
 require_relative "../canonical_json"
 require_relative "../repository_state"
+require_relative "../verification_environment"
 
 module RailVerdict
   module MCP
@@ -39,23 +40,32 @@ module RailVerdict
         nil
       end
 
-      # Returns the cached entry only when the CURRENT observable state still
-      # matches the state that was verified. Never reruns analyzers.
-      def fresh_entry(current_state)
+      # Returns the cached entry only when the CURRENT observable identity
+      # (repository + environment) still matches what was verified. Never reruns analyzers,
+      # but does perform lightweight version probes for environment observation.
+      def fresh_entry(current_state, current_environment = nil)
         entry = @mutex.synchronize { @entry }
         return nil if entry.nil? || entry.state_digest.nil?
         return nil if current_state.nil? || !current_state.available?
         return nil if current_state.digest != entry.state_digest
 
+        current_env = current_environment || current_environment_for(entry.outcome)
+        return nil if current_env.nil? || !current_env.available?
+        return nil if current_env.digest != entry.environment_digest
+
         entry
       end
 
-      def verification_state(current_state)
+      def verification_state(current_state, current_environment = nil)
         entry = @mutex.synchronize { @entry }
         return "verification_required" if entry.nil? || entry.state_digest.nil?
         return "state_unavailable" if current_state.nil? || !current_state.available?
         return "stale" if current_state.digest != entry.state_digest
 
+        current_env = current_environment || current_environment_for(entry.outcome)
+        return "state_unavailable" if current_env.nil? || !current_env.available?
+        return "stale" if current_env.digest != entry.environment_digest
+
         "fresh"
       end
 
@@ -78,8 +88,11 @@ module RailVerdict
         current = current_state_for(entry.outcome)
         return false if current.nil? || !current.available?
 
+        current_env = current_environment_for(entry.outcome)
+        return false if current_env.nil? || !current_env.available?
+
         current.digest == entry.state_digest &&
-          environment_digest_for(entry.outcome) == entry.environment_digest
+          current_env.digest == entry.environment_digest
       rescue StandardError
         false
       end
@@ -143,10 +156,31 @@ module RailVerdict
         }
       end
 
+      def current_environment_for(outcome)
+        root = outcome&.context&.repository_root
+        root ||= outcome&.result&.git&.fetch("repository_root", nil) rescue nil
+        return nil unless root.is_a?(String) && File.directory?(root)
+
+        real = begin
+          File.realpath(root)
+        rescue StandardError
+          return nil
+        end
+        config = outcome&.configuration
+        VerificationEnvironment.capture(repository_root: real, configuration: config)
+      rescue StandardError
+        nil
+      end
+
       def environment_digest_for(outcome)
+        env = current_environment_for(outcome)
+        return env.digest if env&.available? && env.digest
+
+        # Fallback for cases where current capture fails (e.g., no config)
         payload = {
           "railverdict_version" => RailVerdict::VERSION,
-          "ruby_version" => RUBY_VERSION,
+          "ruby_engine" => RUBY_ENGINE.to_s,
+          "ruby_version" => RUBY_VERSION.to_s,
           "analyzer_versions" => sorted_analyzer_versions(outcome)
         }
         Digest::SHA256.hexdigest(CanonicalJSON.generate(payload))

data/lib/rail_verdict/mcp/tools/get_pr_intelligence.rb

@@ -48,10 +48,23 @@ module RailVerdict
         end
 
         def call(**_rest)
-          current_state = RailVerdict::RepositoryState.capture(repository_root: @server.repository_root)
-          case @server.cache.verification_state(current_state)
+          root = @server.repository_root
+          effective_paths = begin
+            RailVerdict::Check.effective_input_paths(root: File.realpath(root), config_path: File.join(File.realpath(root), ".railverdict.yml"))
+          rescue StandardError
+            nil
+          end
+          current_state = RailVerdict::RepositoryState.capture(repository_root: root, configuration_paths: effective_paths)
+          current_env = begin
+            outcome = @server.cache.fetch_outcome
+            config = outcome&.configuration
+            RailVerdict::VerificationEnvironment.capture(repository_root: root, configuration: config)
+          rescue StandardError
+            nil
+          end
+          case @server.cache.verification_state(current_state, current_env)
           when "fresh"
-            entry = @server.cache.fresh_entry(current_state)
+            entry = @server.cache.fresh_entry(current_state, current_env)
             document = entry&.pr_intelligence_document
             if document.is_a?(Hash)
               payload = { "status" => "fresh", "pr_intelligence" => Serializers.scrub(document) }

data/lib/rail_verdict/mcp/tools/get_verification_receipt.rb

@@ -48,10 +48,24 @@ module RailVerdict
         end
 
         def call(**_rest)
-          current_state = RailVerdict::RepositoryState.capture(repository_root: @server.repository_root)
-          case @server.cache.verification_state(current_state)
+          root = @server.repository_root
+          effective_paths = begin
+            RailVerdict::Check.effective_input_paths(root: File.realpath(root), config_path: File.join(File.realpath(root), ".railverdict.yml"))
+          rescue StandardError
+            nil
+          end
+          current_state = RailVerdict::RepositoryState.capture(repository_root: root, configuration_paths: effective_paths)
+          current_env = begin
+            # Use cached outcome config if available for relevant probing
+            outcome = @server.cache.fetch_outcome
+            config = outcome&.configuration
+            RailVerdict::VerificationEnvironment.capture(repository_root: root, configuration: config)
+          rescue StandardError
+            nil
+          end
+          case @server.cache.verification_state(current_state, current_env)
           when "fresh"
-            entry = @server.cache.fresh_entry(current_state)
+            entry = @server.cache.fresh_entry(current_state, current_env)
             receipt = entry&.receipt_document
             if receipt.is_a?(Hash) && receipt["receipt_id"]
               payload = { "status" => "fresh", "receipt" => Serializers.scrub(receipt) }

data/lib/rail_verdict/receipt.rb

@@ -5,6 +5,8 @@ require "json"
 
 require_relative "canonical_json"
 require_relative "repository_state"
+require_relative "verification_environment"
+require_relative "verification_identity"
 require_relative "schema_validator"
 
 module RailVerdict
@@ -28,7 +30,7 @@ module RailVerdict
     # Builds a Verification Receipt v1 document from a guarded Check outcome.
     # Fails closed (BuildError with a deterministic code) when repository state
     # cannot be proven stable across the verification.
-    def self.build(outcome:, railverdict_version: RailVerdict::VERSION, pr_intelligence_document: nil, repair_packet_id: nil, environment_ruby_version: RUBY_VERSION)
+    def self.build(outcome:, railverdict_version: RailVerdict::VERSION, pr_intelligence_document: nil, repair_packet_id: nil, environment_ruby_version: RUBY_VERSION, environment_ruby_engine: RUBY_ENGINE)
       result = outcome&.result
       raise BuildError.new(:receipt_unavailable, "verification outcome is required") if result.nil?
 
@@ -48,6 +50,7 @@ module RailVerdict
         "schema_version" => SCHEMA_VERSION,
         "railverdict_version" => railverdict_version.to_s,
         "environment" => {
+          "ruby_engine" => environment_ruby_engine.to_s,
           "ruby_version" => environment_ruby_version.to_s,
           "analyzer_versions" => sorted_analyzer_versions(outcome)
         },
@@ -96,13 +99,19 @@ module RailVerdict
       context_versions = outcome.context&.analyzer_versions
       if context_versions.is_a?(Hash) && !context_versions.empty?
         context_versions.each do |key, value|
-          versions[key.to_s] = RailVerdict::Analyzers::Shared.canonical_tool_version(value)
+          canonical = RailVerdict::Analyzers::Shared.canonical_tool_version(value)
+          next if canonical == "unknown"
+
+          versions[key.to_s] = canonical
         end
       else
         Array(outcome.result.analyzer_results).each do |analyzer|
           next unless analyzer.tool_version.is_a?(String) && !analyzer.tool_version.strip.empty?
 
-          versions[analyzer.analyzer] = RailVerdict::Analyzers::Shared.canonical_tool_version(analyzer.tool_version)
+          canonical = RailVerdict::Analyzers::Shared.canonical_tool_version(analyzer.tool_version)
+          next if canonical == "unknown"
+
+          versions[analyzer.analyzer] = canonical
         end
       end
       versions.sort.to_h
@@ -238,7 +247,7 @@ module RailVerdict
     end
     private :state_components_of
 
-    Validation = Struct.new(:status, :reasons, :gate, :completion_status, :current_repository_digest, keyword_init: true)
+    Validation = Struct.new(:status, :reasons, :gate, :completion_status, :current_repository_digest, :current_environment_digest, keyword_init: true)
 
     FRESH = "fresh"
     STALE = "stale"
@@ -248,21 +257,73 @@ module RailVerdict
     # Full black-box evaluation of a serialized receipt document against the
     # current state: integrity first (invalid), then freshness.
     # Returns [validation_document, receipt_or_nil].
-    def self.evaluate(document_text, current_state:, railverdict_version: RailVerdict::VERSION, environment_ruby_version: RUBY_VERSION, current_analyzer_versions: nil)
+    # When current_environment/current_state are not supplied but repository_root is,
+    # they are independently observed via the canonical VerificationIdentity.
+    def self.evaluate(document_text, current_state: nil, repository_root: nil, configuration_paths: nil, railverdict_version: RailVerdict::VERSION, environment_ruby_version: RUBY_VERSION, environment_ruby_engine: RUBY_ENGINE, current_analyzer_versions: nil, current_environment: nil)
       receipt, reason = parse(document_text)
       if reason
         return [validation_document(
-          Validation.new(status: INVALID, reasons: [reason.to_s], gate: nil, completion_status: nil, current_repository_digest: nil),
+          Validation.new(status: INVALID, reasons: [reason.to_s], gate: nil, completion_status: nil, current_repository_digest: nil, current_environment_digest: nil),
           receipt_id: embedded_receipt_id(document_text)
         ), nil]
       end
 
+      # Canonical re-observation if not supplied (fail-closed trust invariant)
+      if current_state.nil? && repository_root
+        begin
+          root_real = File.realpath(repository_root)
+          paths = configuration_paths || Check.effective_input_paths(root: root_real, config_path: File.join(root_real, ".railverdict.yml"))
+          current_state = RepositoryState.capture(repository_root: root_real, configuration_paths: paths)
+        rescue StandardError
+          current_state = RepositoryState.unavailable(:repository_root_unavailable)
+        end
+      end
+
+      if current_environment.nil? && current_analyzer_versions.nil? && repository_root
+        begin
+          root_real = File.realpath(repository_root || Dir.pwd)
+          stored_analyzer_keys = receipt.document.dig("environment", "analyzer_versions")&.keys || []
+          # Resolve configuration for relevant probing
+          config = nil
+          begin
+            paths = configuration_paths || Check.effective_input_paths(root: root_real, config_path: File.join(root_real, ".railverdict.yml"))
+            cfg_path = paths[:config]
+            config = Configuration.load(cfg_path) if cfg_path && File.file?(cfg_path)
+          rescue StandardError
+            config = nil
+          end
+          current_environment = VerificationEnvironment.capture_for_receipt(stored_analyzer_keys, repository_root: root_real, configuration: config)
+        rescue StandardError
+          current_environment = VerificationEnvironment.new(
+            railverdict_version: RailVerdict::VERSION.to_s,
+            ruby_engine: RUBY_ENGINE.to_s,
+            ruby_version: RUBY_VERSION.to_s,
+            analyzer_versions: {},
+            digest: nil,
+            unavailable_reason: "environment_capture_failed",
+            available: false
+          )
+        end
+      elsif current_analyzer_versions.is_a?(Hash) && current_environment.nil?
+        # Legacy caller supplied analyzer versions hash directly -> wrap as environment
+        current_environment = VerificationEnvironment.new(
+          railverdict_version: railverdict_version.to_s,
+          ruby_engine: environment_ruby_engine.to_s,
+          ruby_version: environment_ruby_version.to_s,
+          analyzer_versions: current_analyzer_versions.sort.to_h.transform_values(&:to_s),
+          digest: nil,
+          available: true
+        )
+      end
+
       validation = validate_freshness(
         receipt: receipt,
         current_state: current_state,
         railverdict_version: railverdict_version,
         environment_ruby_version: environment_ruby_version,
-        current_analyzer_versions: current_analyzer_versions
+        environment_ruby_engine: environment_ruby_engine,
+        current_analyzer_versions: current_analyzer_versions,
+        current_environment: current_environment
       )
       [validation_document(validation, receipt_id: receipt.receipt_id), receipt]
     end
@@ -288,6 +349,7 @@ module RailVerdict
         "completion_status" => validation.completion_status,
         "current_repository_digest" => validation.current_repository_digest
       }
+      document["current_environment_digest"] = validation.current_environment_digest if validation.current_environment_digest
       errors = SchemaValidator.validate_receipt_validation(document)
       raise RailVerdict::Error, "receipt-validation-v1 failed: #{errors.join('; ')}" unless errors.empty?
 
@@ -296,18 +358,43 @@ module RailVerdict
     private_class_method :validation_document
 
     # Validates a parsed receipt against the current observable state.
-    # Analyzer versions cannot be observed without spawning analyzers, so
-    # callers that possess fresh analyzer versions may supply them via
-    # +current_analyzer_versions+; otherwise that comparison is skipped and
-    # evidence remains bound through the canonical gate projection digest.
-    def self.validate_freshness(receipt:, current_state:, railverdict_version: RailVerdict::VERSION, environment_ruby_version: RUBY_VERSION, current_analyzer_versions: nil)
-      unless current_state.available?
+    # This is the ONE canonical freshness evaluator — CLI and MCP must delegate here.
+    # It independently requires current_state and current_environment to be observed,
+    # never trusting receipt-provided values as current observation.
+    def self.validate_freshness(receipt:, current_state:, railverdict_version: RailVerdict::VERSION, environment_ruby_version: RUBY_VERSION, environment_ruby_engine: RUBY_ENGINE, current_analyzer_versions: nil, current_environment: nil)
+      # If current_environment was supplied via legacy analyzer_versions hash, normalize
+      if current_environment.nil? && current_analyzer_versions.is_a?(Hash) && !current_analyzer_versions.empty?
+        current_environment = VerificationEnvironment.new(
+          railverdict_version: railverdict_version.to_s,
+          ruby_engine: environment_ruby_engine.to_s,
+          ruby_version: environment_ruby_version.to_s,
+          analyzer_versions: current_analyzer_versions.sort.to_h.transform_values(&:to_s),
+          digest: nil,
+          available: true
+        )
+      end
+
+      unless current_state&.available?
+        reason = current_state&.unavailable_reason || :repository_state_unavailable
         return Validation.new(
           status: UNAVAILABLE,
-          reasons: ["repository_state_unavailable:#{current_state.unavailable_reason}"],
+          reasons: ["repository_state_unavailable:#{reason}"],
           gate: receipt&.gate,
           completion_status: receipt&.completion_status,
-          current_repository_digest: nil
+          current_repository_digest: nil,
+          current_environment_digest: nil
+        )
+      end
+
+      # Environment must be observable fail-closed
+      if current_environment && !current_environment.available?
+        return Validation.new(
+          status: UNAVAILABLE,
+          reasons: ["analyzer_version_unobservable:#{current_environment.unavailable_reason}"],
+          gate: receipt.gate,
+          completion_status: receipt.completion_status,
+          current_repository_digest: current_state.digest,
+          current_environment_digest: nil
         )
       end
 
@@ -322,19 +409,73 @@ module RailVerdict
       reasons << "waivers_changed" if stored.fetch("waivers_digest") != current.fetch("waivers_digest")
 
       environment = receipt.document.fetch("environment")
-      reasons << "railverdict_version_changed" if receipt.document.fetch("railverdict_version") != railverdict_version.to_s
-      reasons << "ruby_version_changed" if environment.fetch("ruby_version") != environment_ruby_version.to_s
-      if current_analyzer_versions.is_a?(Hash) && !current_analyzer_versions.empty? &&
-         environment.fetch("analyzer_versions") != current_analyzer_versions.sort.to_h.transform_values(&:to_s)
-        reasons << "analyzer_environment_changed"
+      # RailVerdict version is always checked against current (not receipt-provided)
+      current_rv = current_environment ? current_environment.railverdict_version.to_s : railverdict_version.to_s
+      reasons << "railverdict_version_changed" if receipt.document.fetch("railverdict_version") != current_rv
+
+      # Ruby version/engine: if environment observable, use it; else use supplied
+      current_ruby_version = current_environment ? current_environment.ruby_version.to_s : environment_ruby_version.to_s
+      current_ruby_engine = current_environment ? current_environment.ruby_engine.to_s : environment_ruby_engine.to_s
+      # Ruby engine: receipt may not have it (1.2 compat) — if missing, treat as mismatch if current engine is present
+      stored_ruby_engine = environment["ruby_engine"]
+      if stored_ruby_engine.nil?
+        # 1.2 receipt without engine: stale if we now track engine and it differs from default? Keep fresh for compat unless engine is not ruby/mri? For deterministic portable contract, we consider missing engine as stale only if current engine != "ruby"
+        # To avoid breaking 1.2 compat trivially, we only flag when env explicitly requires engine and receipt lacks it? Current spec says 1.2 receipts should be valid but stale when env stronger — we will flag as stale to surface drift
+        # For minimal breakage, do not flag missing engine as stale automatically; document as known limitation. Only check if receipt has engine.
+      else
+        reasons << "ruby_engine_changed" if stored_ruby_engine.to_s != current_ruby_engine
+      end
+      if environment.fetch("ruby_version") != current_ruby_version
+        reasons << "ruby_version_changed"
+      end
+
+      # Analyzer environment: only relevant analyzers (those in receipt)
+      stored_analyzers = environment.fetch("analyzer_versions")
+      if stored_analyzers.is_a?(Hash) && !stored_analyzers.empty?
+        current_analyzers = if current_environment
+                              # Only compare relevant keys
+                              filtered = current_environment.analyzer_versions.select { |k, _| stored_analyzers.key?(k) }
+                              # Also include any stored key missing in current -> drift (probed enabled set may have disabled it)
+                              # If stored key not in current, we need to probe it specifically; for now treat missing as stale
+                              stored_analyzers.keys.each do |k|
+                                filtered[k] ||= "__missing__"
+                              end
+                              filtered
+                            else
+                              current_analyzer_versions.is_a?(Hash) ? current_analyzer_versions.sort.to_h.transform_values(&:to_s) : nil
+                            end
+        if current_analyzers
+          # Detect unknown in current as unavailable handled above; now compare relevant
+          relevant_stored = stored_analyzers.sort.to_h.transform_values(&:to_s)
+          relevant_current = current_analyzers.sort.to_h.transform_values(&:to_s)
+          # If any stored "unknown" exists, treat as unavailable (fail-closed)
+          if relevant_stored.values.include?("unknown") || relevant_current.values.include?("unknown")
+            return Validation.new(
+              status: UNAVAILABLE,
+              reasons: ["analyzer_version_unobservable:unknown_or_missing"],
+              gate: receipt.gate,
+              completion_status: receipt.completion_status,
+              current_repository_digest: current_state.digest,
+              current_environment_digest: current_environment&.digest
+            )
+          end
+          # Missing relevant analyzer in current env is drift -> stale, not unavailable
+          if relevant_current.values.include?("__missing__")
+            reasons << "analyzer_environment_changed"
+          elsif relevant_stored != relevant_current
+            reasons << "analyzer_environment_changed"
+          end
+        end
       end
 
+      status = reasons.empty? ? FRESH : STALE
       Validation.new(
-        status: reasons.empty? ? FRESH : STALE,
+        status: status,
         reasons: reasons.sort,
         gate: receipt.gate,
         completion_status: receipt.completion_status,
-        current_repository_digest: current_state.digest
+        current_repository_digest: current_state.digest,
+        current_environment_digest: current_environment&.digest
       )
     end
   end

data/lib/rail_verdict/verification_environment.rb

@@ -0,0 +1,220 @@
+# frozen_string_literal: true
+
+require "digest"
+require_relative "canonical_json"
+require_relative "process_runner"
+
+module RailVerdict
+  class VerificationEnvironment
+    MAX_ENV_PROBE_BYTES = 64 * 1024
+    MAX_PROBE_TIMEOUT = 5.0
+
+    attr_reader :railverdict_version, :ruby_engine, :ruby_version, :analyzer_versions, :digest, :unavailable_reason, :available
+
+    def initialize(railverdict_version:, ruby_engine:, ruby_version:, analyzer_versions:, digest: nil, unavailable_reason: nil, available: true)
+      @railverdict_version = railverdict_version
+      @ruby_engine = ruby_engine
+      @ruby_version = ruby_version
+      @analyzer_versions = analyzer_versions.freeze
+      @digest = digest
+      @unavailable_reason = unavailable_reason
+      @available = available
+      freeze
+    end
+
+    def available?
+      @available
+    end
+
+    def self.capture(repository_root:, configuration: nil, runner: ProcessRunner, timeout_seconds: MAX_PROBE_TIMEOUT)
+      railverdict_version = RailVerdict::VERSION.to_s
+      ruby_engine = RUBY_ENGINE.to_s
+      ruby_version = RUBY_VERSION.to_s
+
+      config = configuration
+      if config.nil? && repository_root
+        begin
+          root_real = File.realpath(repository_root)
+          config_path = File.join(root_real, ".railverdict.yml")
+          config = Configuration.load(config_path) if File.file?(config_path)
+        rescue StandardError
+          config = nil
+        end
+      end
+
+      analyzer_versions = {}
+      probes_failed = []
+      if config
+        config.analyzers.each do |name, selection|
+          next unless selection.fetch("enabled")
+
+          adapter_class = Check::REGISTRY[name]
+          next unless adapter_class
+
+          adapter = build_adapter(name)
+          next unless adapter
+
+          probe_timeout = resolve_probe_timeout(config, name, timeout_seconds)
+          probe = probe_adapter(adapter, repository_root, runner, probe_timeout)
+          # Fallback for bundle exec failures in cloned fixtures without bundle install
+          if probe.nil? || probe.status != "succeeded"
+            fallback = probe_fallback(name, repository_root, runner, probe_timeout)
+            probe = fallback if fallback && fallback.status == "succeeded"
+          end
+          if name.to_s == "simplecov" && probe && probe.status == "unavailable" && probe.message.to_s.include?("coverage file is absent")
+            # SimpleCov without coverage file is not a version-probe failure; skip it
+            next
+          end
+          if probe.nil? || probe.status != "succeeded" || probe.version.nil? || probe.version.to_s.strip.empty?
+            # Non-required analyzers failing probe should not make environment unavailable; they are advisory
+            if selection["required"] == false
+              next
+            end
+            probes_failed << name
+            next
+          end
+          version = RailVerdict::Analyzers::Shared.canonical_tool_version(probe.version)
+          analyzer_versions[name.to_s] = version
+        end
+      else
+        # No configuration observable -> try all known analyzers that are present?
+        # Conservative: probe all registry entries cheaply; only succeeded probes contribute.
+        # Missing probes do not make unavailable if no config exists; use empty relevant set.
+      end
+
+      # If any enabled analyzer probe failed, environment is unobservable fail-closed
+      unless probes_failed.empty?
+        return new(
+          railverdict_version: railverdict_version,
+          ruby_engine: ruby_engine,
+          ruby_version: ruby_version,
+          analyzer_versions: analyzer_versions.sort.to_h,
+          digest: nil,
+          unavailable_reason: "analyzer_version_unobservable:#{probes_failed.sort.join(',')}",
+          available: false
+        )
+      end
+
+      # Detect "unknown" canonicalized versions as unobservable as well
+      unknown_keys = analyzer_versions.select { |_, v| v == "unknown" }.keys
+      unless unknown_keys.empty?
+        return new(
+          railverdict_version: railverdict_version,
+          ruby_engine: ruby_engine,
+          ruby_version: ruby_version,
+          analyzer_versions: analyzer_versions.sort.to_h,
+          digest: nil,
+          unavailable_reason: "analyzer_version_unobservable:#{unknown_keys.sort.join(',')}",
+          available: false
+        )
+      end
+
+      sorted = analyzer_versions.sort.to_h
+      payload = {
+        "railverdict_version" => railverdict_version,
+        "ruby_engine" => ruby_engine,
+        "ruby_version" => ruby_version,
+        "analyzer_versions" => sorted
+      }
+      digest = "sha256:#{Digest::SHA256.hexdigest(CanonicalJSON.generate(payload))}"
+      new(
+        railverdict_version: railverdict_version,
+        ruby_engine: ruby_engine,
+        ruby_version: ruby_version,
+        analyzer_versions: sorted,
+        digest: digest,
+        available: true
+      )
+    rescue StandardError => error
+      new(
+        railverdict_version: RailVerdict::VERSION.to_s,
+        ruby_engine: RUBY_ENGINE.to_s,
+        ruby_version: RUBY_VERSION.to_s,
+        analyzer_versions: {},
+        digest: nil,
+        unavailable_reason: "environment_capture_failed:#{error.class}",
+        available: false
+      )
+    end
+
+    def self.capture_for_receipt(receipt_analyzer_keys, repository_root:, configuration: nil, runner: ProcessRunner, timeout_seconds: MAX_PROBE_TIMEOUT)
+      # Only probe analyzers that are relevant (present in receipt)
+      keys = Array(receipt_analyzer_keys).map(&:to_s)
+      return capture(repository_root: repository_root, configuration: configuration, runner: runner, timeout_seconds: timeout_seconds) if keys.empty?
+
+      env = capture(repository_root: repository_root, configuration: configuration, runner: runner, timeout_seconds: timeout_seconds)
+      return env unless env.available?
+
+      # Filter to only relevant keys, but if any relevant key missing from current env -> stale (drift)
+      # The unavailable check already handled probe failures for enabled analyzers.
+      # Here we need to ensure we return only relevant versions for comparison.
+      filtered = env.analyzer_versions.select { |k, _| keys.include?(k) }
+      # If a relevant analyzer is now disabled in config but was in receipt, it's drift -> but we keep filtered empty; caller will detect mismatch
+      payload = {
+        "railverdict_version" => env.railverdict_version,
+        "ruby_engine" => env.ruby_engine,
+        "ruby_version" => env.ruby_version,
+        "analyzer_versions" => filtered.sort.to_h
+      }
+      digest = "sha256:#{Digest::SHA256.hexdigest(CanonicalJSON.generate(payload))}"
+      new(
+        railverdict_version: env.railverdict_version,
+        ruby_engine: env.ruby_engine,
+        ruby_version: env.ruby_version,
+        analyzer_versions: filtered.sort.to_h,
+        digest: digest,
+        available: true
+      )
+    end
+
+    private_class_method def self.build_adapter(name)
+      case name
+      when "rubocop" then RailVerdict::Analyzers::RuboCop.new
+      when "minitest" then RailVerdict::Analyzers::Minitest.new
+      when "rspec" then RailVerdict::Analyzers::RSpec.new
+      when "simplecov" then RailVerdict::Analyzers::SimpleCov.new
+      when "bundler_audit" then RailVerdict::Analyzers::BundlerAudit.new
+      end
+    rescue StandardError
+      nil
+    end
+
+    private_class_method def self.probe_adapter(adapter, root, runner, timeout)
+      adapter.probe(root, runner: runner, timeout_seconds: timeout)
+    rescue StandardError
+      nil
+    end
+
+    private_class_method def self.probe_fallback(name, root, runner, timeout)
+      # Try direct executable without bundle for version probing
+      cmd = case name.to_s
+            when "rubocop" then { executable: "rubocop", args_prefix: [] }
+            when "rspec" then { executable: "rspec", args_prefix: [] }
+            when "bundler_audit" then { executable: "bundler-audit", args_prefix: [] }
+            when "minitest" then { executable: "ruby", args_prefix: ["-rminitest", "-e", "puts Minitest::VERSION"] }
+            else nil
+            end
+      return nil unless cmd
+
+      # Create a temporary adapter with fallback command resolver
+      fallback_adapter = case name.to_s
+                         when "rubocop" then RailVerdict::Analyzers::RuboCop.new(command_resolver: ->(_) { cmd })
+                         when "rspec" then RailVerdict::Analyzers::RSpec.new(command_resolver: ->(_) { cmd })
+                         when "bundler_audit" then RailVerdict::Analyzers::BundlerAudit.new(command_resolver: ->(_) { cmd })
+                         when "minitest" then RailVerdict::Analyzers::Minitest.new(command_resolver: ->(_) { cmd })
+                         else nil
+                         end
+      return nil unless fallback_adapter
+
+      fallback_adapter.probe(root, runner: runner, timeout_seconds: timeout)
+    rescue StandardError
+      nil
+    end
+
+    private_class_method def self.resolve_probe_timeout(config, name, default)
+      config.analyzer_timeout_seconds(name.to_s) || [default, 5.0].min
+    rescue StandardError
+      [default, 5.0].min
+    end
+  end
+end

data/lib/rail_verdict/verification_identity.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+require "digest"
+require_relative "canonical_json"
+require_relative "repository_state"
+require_relative "verification_environment"
+
+module RailVerdict
+  class VerificationIdentity
+    attr_reader :repository_state, :environment, :digest, :unavailable_reason, :available
+
+    def initialize(repository_state:, environment:, digest: nil, unavailable_reason: nil, available: true)
+      @repository_state = repository_state
+      @environment = environment
+      @digest = digest
+      @unavailable_reason = unavailable_reason
+      @available = available
+      freeze
+    end
+
+    def available?
+      @available && @repository_state&.available? && @environment&.available?
+    end
+
+    def self.capture(repository_root:, configuration_paths: nil, configuration: nil, runner: ProcessRunner, timeout_seconds: 5.0, receipt_analyzer_keys: nil)
+      repo_state = RepositoryState.capture(repository_root: repository_root, configuration_paths: configuration_paths)
+
+      unless repo_state.available?
+        return new(
+          repository_state: repo_state,
+          environment: VerificationEnvironment.new(
+            railverdict_version: RailVerdict::VERSION.to_s,
+            ruby_engine: RUBY_ENGINE.to_s,
+            ruby_version: RUBY_VERSION.to_s,
+            analyzer_versions: {},
+            digest: nil,
+            unavailable_reason: repo_state.unavailable_reason,
+            available: false
+          ),
+          digest: nil,
+          unavailable_reason: "repository_state_unavailable:#{repo_state.unavailable_reason}",
+          available: false
+        )
+      end
+
+      config = configuration
+      if config.nil? && repository_root
+        begin
+          # Try to load config for environment capture to know enabled analyzers
+          paths = configuration_paths || Check.effective_input_paths(root: File.realpath(repository_root), config_path: File.join(File.realpath(repository_root), ".railverdict.yml"))
+          config_path = paths[:config]
+          config = Configuration.load(config_path) if config_path && File.file?(config_path)
+        rescue StandardError
+          config = nil
+        end
+      end
+
+      env = if receipt_analyzer_keys
+              VerificationEnvironment.capture_for_receipt(receipt_analyzer_keys, repository_root: repository_root, configuration: config, runner: runner, timeout_seconds: timeout_seconds)
+            else
+              VerificationEnvironment.capture(repository_root: repository_root, configuration: config, runner: runner, timeout_seconds: timeout_seconds)
+            end
+
+      unless env.available?
+        return new(
+          repository_state: repo_state,
+          environment: env,
+          digest: nil,
+          unavailable_reason: env.unavailable_reason,
+          available: false
+        )
+      end
+
+      # Digest over both repository and environment digests
+      payload = {
+        "repository_digest" => repo_state.digest,
+        "environment_digest" => env.digest
+      }
+      digest = "sha256:#{Digest::SHA256.hexdigest(CanonicalJSON.generate(payload))}"
+      new(repository_state: repo_state, environment: env, digest: digest, available: true)
+    rescue StandardError => error
+      repo_unavailable = RepositoryState.unavailable(:capture_failed)
+      env_unavailable = VerificationEnvironment.new(
+        railverdict_version: RailVerdict::VERSION.to_s,
+        ruby_engine: RUBY_ENGINE.to_s,
+        ruby_version: RUBY_VERSION.to_s,
+        analyzer_versions: {},
+        digest: nil,
+        unavailable_reason: error.class.to_s,
+        available: false
+      )
+      new(repository_state: repo_unavailable, environment: env_unavailable, digest: nil, unavailable_reason: "capture_failed:#{error.class}", available: false)
+    end
+  end
+end

data/lib/rail_verdict/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RailVerdict
-  VERSION = "1.2.0"
+  VERSION = "1.3.0"
 end

data/lib/rail_verdict.rb

@@ -41,6 +41,8 @@ require_relative "rail_verdict/pr_intelligence"
 require_relative "rail_verdict/path_safety"
 require_relative "rail_verdict/canonical_json"
 require_relative "rail_verdict/repository_state"
+require_relative "rail_verdict/verification_environment"
+require_relative "rail_verdict/verification_identity"
 require_relative "rail_verdict/receipt"
 require_relative "rail_verdict/cli"
 require_relative "rail_verdict/intelligence"

data/schemas/receipt-validation-v1.schema.json

@@ -36,6 +36,12 @@
         { "type": "null" },
         { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }
       ]
+    },
+    "current_environment_digest": {
+      "oneOf": [
+        { "type": "null" },
+        { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }
+      ]
     }
   }
 }

data/schemas/verification-receipt-v1.schema.json

@@ -52,6 +52,7 @@
       "additionalProperties": false,
       "required": ["ruby_version", "analyzer_versions"],
       "properties": {
+        "ruby_engine": { "type": "string", "minLength": 1, "maxLength": 32 },
         "ruby_version": { "type": "string", "minLength": 1, "maxLength": 32 },
         "analyzer_versions": {
           "type": "object",

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rail_verdict
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.3.0
 platform: ruby
 authors:
 - Pedro Dalben
@@ -154,6 +154,8 @@ files:
 - lib/rail_verdict/schema_validator.rb
 - lib/rail_verdict/strict_yaml.rb
 - lib/rail_verdict/verification/policy.rb
+- lib/rail_verdict/verification_environment.rb
+- lib/rail_verdict/verification_identity.rb
 - lib/rail_verdict/version.rb
 - lib/rail_verdict/waiver.rb
 - lib/rail_verdict/waiver_store.rb