@neurcode-ai/cli 0.9.29 → 0.9.31

package/dist/commands/verify.js

@@ -58,6 +58,8 @@ const custom_policy_rules_1 = require("../utils/custom-policy-rules");
 const policy_exceptions_1 = require("../utils/policy-exceptions");
 const policy_governance_1 = require("../utils/policy-governance");
 const policy_audit_1 = require("../utils/policy-audit");
+const governance_1 = require("../utils/governance");
+const policy_1 = require("@neurcode-ai/policy");
 // Import chalk with fallback
 let chalk;
 try {
@@ -290,14 +292,89 @@ function resolveAuditIntegrityStatus(requireIntegrity, auditIntegrity) {
         issues,
     };
 }
+async function recordVerificationIfRequested(options, config, payload) {
+    if (!options.record) {
+        return;
+    }
+    if (!config.apiKey) {
+        if (!payload.jsonMode) {
+            console.log(chalk.yellow('\n⚠️  --record flag requires API key'));
+            console.log(chalk.dim('   Set NEURCODE_API_KEY environment variable or use --api-key flag'));
+        }
+        return;
+    }
+    await reportVerification(payload.grade, payload.violations, payload.verifyResult, config.apiKey, config.apiUrl || 'https://api.neurcode.com', payload.projectId, payload.jsonMode, payload.governance);
+}
 /**
  * Execute policy-only verification (General Governance mode)
  * Returns the exit code to use
  */
-async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRoot, config, client, source) {
+async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRoot, config, client, source, projectId, orgGovernanceSettings, aiLogSigningKey, aiLogSigner) {
     if (!options.json) {
         console.log(chalk.cyan('🛡️  General Governance mode (policy only, no plan linked)\n'));
     }
+    const governanceAnalysis = (0, governance_1.evaluateGovernance)({
+        projectRoot,
+        task: 'Policy-only verification',
+        expectedFiles: [],
+        diffFiles,
+        contextCandidates: diffFiles.map((file) => file.path),
+        orgGovernance: orgGovernanceSettings,
+        signingKey: aiLogSigningKey,
+        signer: aiLogSigner,
+    });
+    const governancePayload = buildGovernancePayload(governanceAnalysis, orgGovernanceSettings);
+    const contextPolicyViolations = governanceAnalysis.contextPolicy.violations.filter((item) => !ignoreFilter(item.file));
+    if (contextPolicyViolations.length > 0) {
+        const message = `Context policy violation: ${contextPolicyViolations.map((item) => item.file).join(', ')}`;
+        const contextPolicyViolationItems = contextPolicyViolations.map((item) => ({
+            file: item.file,
+            rule: `context_policy:${item.rule}`,
+            severity: 'block',
+            message: item.reason,
+        }));
+        if (options.json) {
+            console.log(JSON.stringify({
+                grade: 'F',
+                score: 0,
+                verdict: 'FAIL',
+                violations: contextPolicyViolationItems,
+                message,
+                scopeGuardPassed: false,
+                bloatCount: 0,
+                bloatFiles: [],
+                plannedFilesModified: 0,
+                totalPlannedFiles: 0,
+                adherenceScore: 0,
+                mode: 'policy_only',
+                policyOnly: true,
+                policyOnlySource: source,
+                ...governancePayload,
+            }, null, 2));
+        }
+        else {
+            console.log(chalk.red('❌ Context policy violation detected (policy-only mode).'));
+            contextPolicyViolations.forEach((item) => {
+                console.log(chalk.red(`   • ${item.file}: ${item.reason}`));
+            });
+            console.log(chalk.dim(`\n${message}`));
+        }
+        await recordVerificationIfRequested(options, config, {
+            grade: 'F',
+            violations: contextPolicyViolationItems,
+            verifyResult: {
+                adherenceScore: 0,
+                verdict: 'FAIL',
+                bloatCount: 0,
+                bloatFiles: [],
+                message,
+            },
+            projectId,
+            jsonMode: Boolean(options.json),
+            governance: governancePayload,
+        });
+        return 2;
+    }
     let policyViolations = [];
     let policyDecision = 'allow';
     const requirePolicyLock = options.requirePolicyLock === true || isEnabledFlag(process.env.NEURCODE_VERIFY_REQUIRE_POLICY_LOCK);
@@ -369,12 +446,13 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
     }
     if (policyLockEvaluation.enforced && !policyLockEvaluation.matched) {
         const message = policyLockMismatchMessage(policyLockEvaluation.mismatches);
+        const lockViolationItems = toPolicyLockViolations(policyLockEvaluation.mismatches);
         if (options.json) {
             console.log(JSON.stringify({
                 grade: 'F',
                 score: 0,
                 verdict: 'FAIL',
-                violations: toPolicyLockViolations(policyLockEvaluation.mismatches),
+                violations: lockViolationItems,
                 message,
                 scopeGuardPassed: true,
                 bloatCount: 0,
@@ -385,6 +463,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
                 mode: 'policy_only',
                 policyOnly: true,
                 policyOnlySource: source,
+                ...governancePayload,
                 policyLock: {
                     enforced: true,
                     matched: false,
@@ -401,6 +480,20 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
             });
             console.log(chalk.dim('\n   If drift is intentional, regenerate baseline with `neurcode policy lock`.\n'));
         }
+        await recordVerificationIfRequested(options, config, {
+            grade: 'F',
+            violations: lockViolationItems,
+            verifyResult: {
+                adherenceScore: 0,
+                verdict: 'FAIL',
+                bloatCount: 0,
+                bloatFiles: [],
+                message,
+            },
+            projectId,
+            jsonMode: Boolean(options.json),
+            governance: governancePayload,
+        });
         return 2;
     }
     if (!options.json && effectiveRules.customRules.length > 0) {
@@ -516,6 +609,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
             mode: 'policy_only',
             policyOnly: true,
             policyOnlySource: source,
+            ...governancePayload,
             policyLock: {
                 enforced: policyLockEvaluation.enforced,
                 matched: policyLockEvaluation.matched,
@@ -555,8 +649,23 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
         if (governance.audit.requireIntegrity && !auditIntegrityStatus.valid) {
             console.log(chalk.red('   Policy audit integrity check failed'));
         }
+        displayGovernanceInsights(governanceAnalysis, { explain: options.explain });
         console.log(chalk.dim(`\n${message}`));
     }
+    await recordVerificationIfRequested(options, config, {
+        grade,
+        violations: violationsOutput,
+        verifyResult: {
+            adherenceScore: score,
+            verdict: effectiveVerdict,
+            bloatCount: 0,
+            bloatFiles: [],
+            message,
+        },
+        projectId,
+        jsonMode: Boolean(options.json),
+        governance: governancePayload,
+    });
     return effectiveVerdict === 'FAIL' ? 2 : effectiveVerdict === 'WARN' ? 1 : 0;
 }
 async function verifyCommand(options) {
@@ -610,6 +719,31 @@ async function verifyCommand(options) {
             orgId: (0, state_1.getOrgId)(),
             projectId: projectId || null,
         };
+        const aiLogSigningKey = process.env.NEURCODE_GOVERNANCE_SIGNING_KEY ||
+            process.env.NEURCODE_AI_LOG_SIGNING_KEY ||
+            null;
+        const aiLogSigner = process.env.NEURCODE_GOVERNANCE_SIGNER || process.env.USER || 'neurcode-cli';
+        let orgGovernanceSettings = null;
+        if (config.apiKey) {
+            try {
+                const remoteSettings = await client.getOrgGovernanceSettings();
+                if (remoteSettings) {
+                    orgGovernanceSettings = {
+                        contextPolicy: (0, policy_1.normalizeContextPolicy)(remoteSettings.contextPolicy),
+                        requireSignedAiLogs: remoteSettings.requireSignedAiLogs === true,
+                        requireManualApproval: remoteSettings.requireManualApproval !== false,
+                        minimumManualApprovals: Math.max(1, Math.min(5, Math.floor(remoteSettings.minimumManualApprovals || 1))),
+                        updatedAt: remoteSettings.updatedAt,
+                    };
+                }
+            }
+            catch (error) {
+                if (!options.json) {
+                    const message = error instanceof Error ? error.message : 'Unknown error';
+                    console.log(chalk.dim(`   Org governance settings unavailable, using local policy only (${message})`));
+                }
+            }
+        }
         const recordVerifyEvent = (verdict, note, changedFiles, planId) => {
             if (!brainScope.orgId || !brainScope.projectId) {
                 return;
@@ -727,13 +861,81 @@ async function verifyCommand(options) {
             const normalized = toUnixPath(filePath || '');
             return ignoreFilter(normalized) || runtimeIgnoreSet.has(normalized);
         };
+        const baselineContextPolicyLocal = (0, policy_1.loadContextPolicy)(projectRoot);
+        const baselineContextPolicy = orgGovernanceSettings?.contextPolicy
+            ? (0, policy_1.mergeContextPolicies)(baselineContextPolicyLocal, orgGovernanceSettings.contextPolicy)
+            : baselineContextPolicyLocal;
+        const baselineContextPolicyEvaluation = (0, policy_1.evaluateContextPolicyForChanges)(diffFiles.map((file) => file.path), baselineContextPolicy, diffFiles.map((file) => file.path));
+        const baselineContextViolations = baselineContextPolicyEvaluation.violations.filter((item) => !shouldIgnore(item.file));
+        if (baselineContextViolations.length > 0) {
+            const baselineGovernance = (0, governance_1.evaluateGovernance)({
+                projectRoot,
+                task: 'Context policy validation',
+                expectedFiles: [],
+                diffFiles,
+                contextCandidates: diffFiles.map((file) => file.path),
+                orgGovernance: orgGovernanceSettings,
+                signingKey: aiLogSigningKey,
+                signer: aiLogSigner,
+            });
+            const baselineGovernancePayload = buildGovernancePayload(baselineGovernance, orgGovernanceSettings);
+            const message = `Context access policy violation: ${baselineContextViolations.map((item) => item.file).join(', ')}`;
+            const baselineContextViolationItems = baselineContextViolations.map((item) => ({
+                file: item.file,
+                rule: `context_policy:${item.rule}`,
+                severity: 'block',
+                message: item.reason,
+            }));
+            recordVerifyEvent('FAIL', `context_policy_violations=${baselineContextViolations.length}`, diffFiles.map((f) => f.path));
+            if (options.json) {
+                console.log(JSON.stringify({
+                    grade: 'F',
+                    score: 0,
+                    verdict: 'FAIL',
+                    violations: baselineContextViolationItems,
+                    adherenceScore: 0,
+                    bloatCount: 0,
+                    bloatFiles: [],
+                    plannedFilesModified: 0,
+                    totalPlannedFiles: 0,
+                    message,
+                    scopeGuardPassed: false,
+                    ...baselineGovernancePayload,
+                    mode: 'policy_violation',
+                    policyOnly: false,
+                }, null, 2));
+            }
+            else {
+                console.log(chalk.red('\n⛔ Context Policy Violation'));
+                baselineContextViolations.forEach((item) => {
+                    console.log(chalk.red(`   • ${item.file}: ${item.reason}`));
+                });
+                console.log(chalk.dim(`\nRisk level: ${baselineGovernance.blastRadius.riskScore.toUpperCase()}`));
+                console.log(chalk.red('\nAction blocked.\n'));
+            }
+            await recordVerificationIfRequested(options, config, {
+                grade: 'F',
+                violations: baselineContextViolationItems,
+                verifyResult: {
+                    adherenceScore: 0,
+                    verdict: 'FAIL',
+                    bloatCount: 0,
+                    bloatFiles: [],
+                    message,
+                },
+                projectId: projectId || undefined,
+                jsonMode: Boolean(options.json),
+                governance: baselineGovernancePayload,
+            });
+            process.exit(2);
+        }
         if (!options.json) {
             console.log(chalk.cyan('\n📊 Analyzing changes against plan...'));
             console.log(chalk.dim(`   Found ${summary.totalFiles} file(s) changed`));
             console.log(chalk.dim(`   ${summary.totalAdded} lines added, ${summary.totalRemoved} lines removed\n`));
         }
         const runPolicyOnlyModeAndExit = async (source) => {
-            const exitCode = await executePolicyOnlyMode(options, diffFiles, shouldIgnore, projectRoot, config, client, source);
+            const exitCode = await executePolicyOnlyMode(options, diffFiles, shouldIgnore, projectRoot, config, client, source, projectId || undefined, orgGovernanceSettings, aiLogSigningKey, aiLogSigner);
             const changedFiles = diffFiles.map((f) => f.path);
             const verdict = exitCode === 2 ? 'FAIL' : exitCode === 1 ? 'WARN' : 'PASS';
             recordVerifyEvent(verdict, `policy_only_source=${source};exit=${exitCode}`, changedFiles);
@@ -782,6 +984,7 @@ async function verifyCommand(options) {
         if (!planId) {
             if (requirePlan) {
                 const changedFiles = diffFiles.map((f) => f.path);
+                const message = 'Plan ID is required in strict mode. Run "neurcode plan" first or pass --plan-id.';
                 recordVerifyEvent('FAIL', 'missing_plan_id;require_plan=true', changedFiles);
                 if (options.json) {
                     console.log(JSON.stringify({
@@ -794,7 +997,7 @@ async function verifyCommand(options) {
                         bloatFiles: [],
                         plannedFilesModified: 0,
                         totalPlannedFiles: 0,
-                        message: 'Plan ID is required in strict mode. Run "neurcode plan" first or pass --plan-id.',
+                        message,
                         scopeGuardPassed: false,
                         mode: 'plan_required',
                         policyOnly: false,
@@ -805,6 +1008,19 @@ async function verifyCommand(options) {
                     console.log(chalk.dim('   Run "neurcode plan" first or pass --plan-id <id>.'));
                     console.log(chalk.dim('   Use --policy-only only when intentionally running general governance checks.'));
                 }
+                await recordVerificationIfRequested(options, config, {
+                    grade: 'F',
+                    violations: [],
+                    verifyResult: {
+                        adherenceScore: 0,
+                        verdict: 'FAIL',
+                        bloatCount: 0,
+                        bloatFiles: [],
+                        message,
+                    },
+                    projectId: projectId || undefined,
+                    jsonMode: Boolean(options.json),
+                });
                 process.exit(1);
             }
             if (!options.json) {
@@ -824,6 +1040,7 @@ async function verifyCommand(options) {
         }
         // Track if scope guard passed - this takes priority over AI grading
         let scopeGuardPassed = false;
+        let governanceResult = null;
         try {
             // Step A: Get Modified Files (already have from diffFiles)
             const modifiedFiles = diffFiles.map(f => f.path);
@@ -831,10 +1048,29 @@ async function verifyCommand(options) {
             const planData = await client.getPlan(finalPlanId);
             // Extract original intent from plan (for constraint checking)
             const originalIntent = planData.intent || '';
+            const planTitle = typeof planData.content.title === 'string'
+                ? planData.content.title?.trim()
+                : '';
+            const planSummary = typeof planData.content.summary === 'string' ? planData.content.summary.trim() : '';
+            const governanceTask = planTitle || planSummary || originalIntent || 'Plan verification';
             // Get approved files from plan (only files with action CREATE or MODIFY)
             const planFiles = planData.content.files
                 .filter(f => f.action === 'CREATE' || f.action === 'MODIFY')
                 .map(f => f.path);
+            const planDependencies = Array.isArray(planData.content.dependencies)
+                ? planData.content.dependencies.filter((item) => typeof item === 'string')
+                : [];
+            governanceResult = (0, governance_1.evaluateGovernance)({
+                projectRoot,
+                task: governanceTask,
+                expectedFiles: planFiles,
+                expectedDependencies: planDependencies,
+                diffFiles,
+                contextCandidates: planFiles,
+                orgGovernance: orgGovernanceSettings,
+                signingKey: aiLogSigningKey,
+                signer: aiLogSigner,
+            });
             // Get sessionId from state file (.neurcode/state.json) first, then fallback to config
             // Fallback to sessionId from plan if not in state/config
             // This is the session_id string needed to fetch the session
@@ -881,31 +1117,51 @@ async function verifyCommand(options) {
             // Step D: The Block (only report scope violations for non-ignored files)
             if (filteredViolations.length > 0) {
                 recordVerifyEvent('FAIL', `scope_violation=${filteredViolations.length}`, modifiedFiles, finalPlanId);
+                const scopeViolationItems = filteredViolations.map((file) => ({
+                    file,
+                    rule: 'scope_guard',
+                    severity: 'block',
+                    message: 'File modified outside the plan',
+                }));
+                const scopeViolationMessage = `Scope violation: ${filteredViolations.length} file(s) modified outside the plan`;
                 if (options.json) {
                     // Output JSON for scope violation BEFORE exit. Must include violations for GitHub Action annotations.
-                    const violationsOutput = filteredViolations.map((file) => ({
-                        file,
-                        rule: 'scope_guard',
-                        severity: 'block',
-                        message: 'File modified outside the plan',
-                    }));
                     const jsonOutput = {
                         grade: 'F',
                         score: 0,
                         verdict: 'FAIL',
-                        violations: violationsOutput,
+                        violations: scopeViolationItems,
                         adherenceScore: 0,
                         bloatCount: filteredViolations.length,
                         bloatFiles: filteredViolations,
                         plannedFilesModified: 0,
                         totalPlannedFiles: planFiles.length,
-                        message: `Scope violation: ${filteredViolations.length} file(s) modified outside the plan`,
+                        message: scopeViolationMessage,
                         scopeGuardPassed: false,
                         mode: 'plan_enforced',
                         policyOnly: false,
+                        ...(governanceResult
+                            ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                            : {}),
                     };
                     // CRITICAL: Print JSON first, then exit
                     console.log(JSON.stringify(jsonOutput, null, 2));
+                    await recordVerificationIfRequested(options, config, {
+                        grade: 'F',
+                        violations: scopeViolationItems,
+                        verifyResult: {
+                            adherenceScore: 0,
+                            verdict: 'FAIL',
+                            bloatCount: filteredViolations.length,
+                            bloatFiles: filteredViolations,
+                            message: scopeViolationMessage,
+                        },
+                        projectId: projectId || undefined,
+                        jsonMode: true,
+                        governance: governanceResult
+                            ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                            : undefined,
+                    });
                     process.exit(1);
                 }
                 else {
@@ -922,7 +1178,26 @@ async function verifyCommand(options) {
                     filteredViolations.forEach(file => {
                         console.log(chalk.dim(`   neurcode allow ${file}`));
                     });
+                    if (governanceResult) {
+                        displayGovernanceInsights(governanceResult, { explain: options.explain });
+                    }
                     console.log('');
+                    await recordVerificationIfRequested(options, config, {
+                        grade: 'F',
+                        violations: scopeViolationItems,
+                        verifyResult: {
+                            adherenceScore: 0,
+                            verdict: 'FAIL',
+                            bloatCount: filteredViolations.length,
+                            bloatFiles: filteredViolations,
+                            message: scopeViolationMessage,
+                        },
+                        projectId: projectId || undefined,
+                        jsonMode: false,
+                        governance: governanceResult
+                            ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                            : undefined,
+                    });
                     process.exit(1);
                 }
             }
@@ -1010,13 +1285,14 @@ async function verifyCommand(options) {
             }
             if (policyLockEvaluation.enforced && !policyLockEvaluation.matched) {
                 const message = policyLockMismatchMessage(policyLockEvaluation.mismatches);
+                const lockViolationItems = toPolicyLockViolations(policyLockEvaluation.mismatches);
                 recordVerifyEvent('FAIL', 'policy_lock_mismatch', diffFiles.map((f) => f.path), finalPlanId);
                 if (options.json) {
                     console.log(JSON.stringify({
                         grade: 'F',
                         score: 0,
                         verdict: 'FAIL',
-                        violations: toPolicyLockViolations(policyLockEvaluation.mismatches),
+                        violations: lockViolationItems,
                         adherenceScore: 0,
                         bloatCount: 0,
                         bloatFiles: [],
@@ -1026,6 +1302,9 @@ async function verifyCommand(options) {
                         scopeGuardPassed,
                         mode: 'plan_enforced',
                         policyOnly: false,
+                        ...(governanceResult
+                            ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                            : {}),
                         policyLock: {
                             enforced: true,
                             matched: false,
@@ -1042,6 +1321,22 @@ async function verifyCommand(options) {
                     });
                     console.log(chalk.dim('\n   If this drift is intentional, regenerate baseline with `neurcode policy lock`.\n'));
                 }
+                await recordVerificationIfRequested(options, config, {
+                    grade: 'F',
+                    violations: lockViolationItems,
+                    verifyResult: {
+                        adherenceScore: 0,
+                        verdict: 'FAIL',
+                        bloatCount: 0,
+                        bloatFiles: [],
+                        message,
+                    },
+                    projectId: projectId || undefined,
+                    jsonMode: Boolean(options.json),
+                    governance: governanceResult
+                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                        : undefined,
+                });
                 process.exit(2);
             }
         }
@@ -1079,6 +1374,9 @@ async function verifyCommand(options) {
                     mode: 'plan_enforced',
                     policyOnly: false,
                     tier: 'FREE',
+                    ...(governanceResult
+                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                        : {}),
                     policyLock: {
                         enforced: policyLockEvaluation.enforced,
                         matched: policyLockEvaluation.matched,
@@ -1309,6 +1607,9 @@ async function verifyCommand(options) {
                     totalPlannedFiles: verifyResult.totalPlannedFiles,
                     mode: 'plan_enforced',
                     policyOnly: false,
+                    ...(governanceResult
+                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                        : {}),
                     policyLock: {
                         enforced: policyLockEvaluation.enforced,
                         matched: policyLockEvaluation.matched,
@@ -1330,28 +1631,22 @@ async function verifyCommand(options) {
                         : {}),
                 };
                 console.log(JSON.stringify(jsonOutput, null, 2));
-                // Report to Neurcode Cloud if --record flag is set (after JSON output)
-                if (options.record && config.apiKey) {
-                    const violations = [
-                        ...filteredBloatFiles.map((file) => ({
-                            rule: 'scope_guard',
-                            file: file,
-                            severity: 'block',
-                            message: 'File modified outside the plan',
-                        })),
-                        ...policyViolations.map(v => ({
-                            rule: v.rule,
-                            file: v.file,
-                            severity: v.severity,
-                            message: v.message,
-                        })),
-                    ];
-                    // Report in background (don't await to avoid blocking JSON output)
-                    reportVerification(grade, violations, verifyResult, config.apiKey, config.apiUrl, projectId || undefined, true // jsonMode = true
-                    ).catch(() => {
-                        // Error already logged in reportVerification
-                    });
-                }
+                await recordVerificationIfRequested(options, config, {
+                    grade,
+                    violations: violations,
+                    verifyResult: {
+                        adherenceScore: verifyResult.adherenceScore,
+                        verdict: effectiveVerdict,
+                        bloatCount: filteredBloatFiles.length,
+                        bloatFiles: filteredBloatFiles,
+                        message: effectiveMessage,
+                    },
+                    projectId: projectId || undefined,
+                    jsonMode: true,
+                    governance: governanceResult
+                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                        : undefined,
+                });
                 // Exit based on effective verdict (same logic as below)
                 if (shouldForceGovernancePass) {
                     process.exit(0);
@@ -1376,6 +1671,9 @@ async function verifyCommand(options) {
                     bloatFiles: displayBloatFiles,
                     bloatCount: displayBloatFiles.length,
                 }, policyViolations);
+                if (governanceResult) {
+                    displayGovernanceInsights(governanceResult, { explain: options.explain });
+                }
                 if (policyExceptionsSummary.suppressed > 0) {
                     console.log(chalk.yellow(`\n⚠️  Policy exceptions applied: ${policyExceptionsSummary.suppressed}`));
                     if (policyExceptionsSummary.matchedExceptionIds.length > 0) {
@@ -1397,34 +1695,37 @@ async function verifyCommand(options) {
                 }
             }
             // Report to Neurcode Cloud if --record flag is set
-            if (options.record) {
-                if (!config.apiKey) {
-                    if (!options.json) {
-                        console.log(chalk.yellow('\n⚠️  --record flag requires API key'));
-                        console.log(chalk.dim('   Set NEURCODE_API_KEY environment variable or use --api-key flag'));
-                    }
-                }
-                else {
-                    // Include scope bloat and custom policy violations in the report (excluding .neurcodeignore'd paths)
-                    const filteredBloatForReport = (verifyResult.bloatFiles || []).filter((f) => !shouldIgnore(f));
-                    const violations = [
-                        ...filteredBloatForReport.map((file) => ({
-                            rule: 'scope_guard',
-                            file: file,
-                            severity: 'block',
-                            message: 'File modified outside the plan',
-                        })),
-                        ...policyViolations.map(v => ({
-                            rule: v.rule,
-                            file: v.file,
-                            severity: v.severity,
-                            message: v.message,
-                        })),
-                    ];
-                    await reportVerification(grade, violations, verifyResult, config.apiKey, config.apiUrl, projectId || undefined, false // jsonMode = false
-                    );
-                }
-            }
+            const filteredBloatForReport = (verifyResult.bloatFiles || []).filter((f) => !shouldIgnore(f));
+            const reportViolations = [
+                ...filteredBloatForReport.map((file) => ({
+                    rule: 'scope_guard',
+                    file: file,
+                    severity: 'block',
+                    message: 'File modified outside the plan',
+                })),
+                ...policyViolations.map((v) => ({
+                    rule: v.rule,
+                    file: v.file,
+                    severity: v.severity,
+                    message: v.message,
+                })),
+            ];
+            await recordVerificationIfRequested(options, config, {
+                grade,
+                violations: reportViolations,
+                verifyResult: {
+                    adherenceScore: verifyResult.adherenceScore,
+                    verdict: effectiveVerdict,
+                    bloatCount: filteredBloatForReport.length,
+                    bloatFiles: filteredBloatForReport,
+                    message: effectiveMessage,
+                },
+                projectId: projectId || undefined,
+                jsonMode: false,
+                governance: governanceResult
+                    ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                    : undefined,
+            });
             // Governance override: keep PASS only when scope guard passes and failure is due
             // to server-side bloat mismatch (allowed files unknown to verify API).
             if (shouldForceGovernancePass) {
@@ -1610,10 +1911,67 @@ function collectCIContext() {
     }
     return context;
 }
+const REPORT_MAX_ARRAY_ITEMS = 120;
+const REPORT_MAX_STRING_LENGTH = 4000;
+const REPORT_MAX_OBJECT_DEPTH = 6;
+function compactReportValue(value, depth = 0, seen = new WeakSet()) {
+    if (value == null) {
+        return value;
+    }
+    if (typeof value === 'string') {
+        return value.length > REPORT_MAX_STRING_LENGTH
+            ? `${value.slice(0, REPORT_MAX_STRING_LENGTH)}...[truncated]`
+            : value;
+    }
+    if (typeof value !== 'object') {
+        return value;
+    }
+    if (depth >= REPORT_MAX_OBJECT_DEPTH) {
+        return '[truncated]';
+    }
+    if (Array.isArray(value)) {
+        const items = value.slice(0, REPORT_MAX_ARRAY_ITEMS).map((item) => compactReportValue(item, depth + 1, seen));
+        if (value.length > REPORT_MAX_ARRAY_ITEMS) {
+            items.push(`[truncated ${value.length - REPORT_MAX_ARRAY_ITEMS} item(s)]`);
+        }
+        return items;
+    }
+    if (seen.has(value)) {
+        return '[circular]';
+    }
+    seen.add(value);
+    const compacted = {};
+    for (const [key, nestedValue] of Object.entries(value)) {
+        compacted[key] = compactReportValue(nestedValue, depth + 1, seen);
+    }
+    return compacted;
+}
+function buildCompactVerificationPayload(payload) {
+    const compactViolations = payload.violations.slice(0, REPORT_MAX_ARRAY_ITEMS);
+    if (payload.violations.length > REPORT_MAX_ARRAY_ITEMS) {
+        compactViolations.push({
+            rule: 'report_payload_compaction',
+            file: '__meta__',
+            severity: 'warn',
+            message: `Truncated ${payload.violations.length - REPORT_MAX_ARRAY_ITEMS} additional violation(s) for upload`,
+        });
+    }
+    return {
+        ...payload,
+        violations: compactViolations,
+        bloatFiles: payload.bloatFiles.slice(0, REPORT_MAX_ARRAY_ITEMS),
+        message: payload.message.length > REPORT_MAX_STRING_LENGTH
+            ? `${payload.message.slice(0, REPORT_MAX_STRING_LENGTH)}...[truncated]`
+            : payload.message,
+        governance: payload.governance
+            ? compactReportValue(payload.governance)
+            : undefined,
+    };
+}
 /**
  * Report verification results to Neurcode Cloud
  */
-async function reportVerification(grade, violations, verifyResult, apiKey, apiUrl, projectId, jsonMode) {
+async function reportVerification(grade, violations, verifyResult, apiKey, apiUrl, projectId, jsonMode, governance) {
     try {
         const ciContext = collectCIContext();
         const payload = {
@@ -1629,23 +1987,38 @@ async function reportVerification(grade, violations, verifyResult, apiKey, apiUr
             branch: ciContext.branch,
             workflowRunId: ciContext.workflowRunId,
             projectId,
+            governance,
         };
-        const response = await fetch(`${apiUrl}/api/v1/action/verifications`, {
+        const postPayload = async (requestPayload) => fetch(`${apiUrl}/api/v1/action/verifications`, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
                 'Authorization': `Bearer ${apiKey}`,
             },
-            body: JSON.stringify(payload),
+            body: JSON.stringify(requestPayload),
         });
+        let response = await postPayload(payload);
+        let compactedUpload = false;
+        if (response.status === 413) {
+            response = await postPayload(buildCompactVerificationPayload(payload));
+            compactedUpload = true;
+        }
         if (!response.ok) {
             const errorText = await response.text();
-            throw new Error(`HTTP ${response.status}: ${errorText}`);
+            const compactError = errorText.replace(/\s+/g, ' ').trim().slice(0, 400);
+            throw new Error(`HTTP ${response.status}: ${compactError}`);
+        }
+        let result = {};
+        try {
+            result = (await response.json());
+        }
+        catch {
+            // Some proxies may return empty success bodies; treat as recorded.
         }
-        const result = await response.json();
         // Only log if not in json mode to avoid polluting stdout
         if (!jsonMode) {
-            console.log(chalk.dim(`\n✅ Verification result reported to Neurcode Cloud (ID: ${result.id})`));
+            const suffix = compactedUpload ? ' (compact payload)' : '';
+            console.log(chalk.dim(`\n✅ Verification result reported to Neurcode Cloud (ID: ${result.id || 'ok'})${suffix}`));
         }
     }
     catch (error) {
@@ -1657,6 +2030,68 @@ async function reportVerification(grade, violations, verifyResult, apiKey, apiUr
         }
     }
 }
+function buildGovernancePayload(governance, orgGovernanceSettings) {
+    return {
+        contextPolicy: governance.contextPolicy,
+        blastRadius: governance.blastRadius,
+        suspiciousChange: governance.suspiciousChange,
+        changeJustification: governance.changeJustification,
+        governanceDecision: governance.governanceDecision,
+        aiChangeLog: {
+            path: governance.aiChangeLogPath,
+            auditPath: governance.aiChangeLogAuditPath,
+            integrity: governance.aiChangeLogIntegrity,
+        },
+        policySources: governance.policySources,
+        orgGovernance: orgGovernanceSettings
+            ? {
+                requireSignedAiLogs: orgGovernanceSettings.requireSignedAiLogs,
+                requireManualApproval: orgGovernanceSettings.requireManualApproval,
+                minimumManualApprovals: orgGovernanceSettings.minimumManualApprovals,
+                updatedAt: orgGovernanceSettings.updatedAt || null,
+            }
+            : null,
+    };
+}
+function displayGovernanceInsights(governance, options = {}) {
+    const maxUnexpectedFiles = options.maxUnexpectedFiles ?? 20;
+    const decision = governance.governanceDecision;
+    console.log(chalk.bold.white('\nBlast Radius:'));
+    console.log(chalk.dim(`   Files touched: ${governance.blastRadius.filesChanged}`));
+    console.log(chalk.dim(`   Functions impacted: ${governance.blastRadius.functionsAffected}`));
+    console.log(chalk.dim(`   Modules impacted: ${governance.blastRadius.modulesAffected.join(', ') || 'none'}`));
+    if (governance.blastRadius.dependenciesAdded.length > 0) {
+        console.log(chalk.dim(`   Dependencies added: ${governance.blastRadius.dependenciesAdded.join(', ')}`));
+    }
+    console.log(chalk.dim(`   Risk level: ${governance.blastRadius.riskScore.toUpperCase()}`));
+    console.log(chalk.dim(`   Governance decision: ${decision.decision.toUpperCase().replace('_', ' ')} | Avg relevance: ${decision.averageRelevanceScore}`));
+    console.log(chalk.dim(`   Policy source: ${governance.policySources.mode}${governance.policySources.orgPolicy ? ' (org + local)' : ' (local)'}`));
+    console.log(governance.aiChangeLogIntegrity.valid
+        ? chalk.dim(`   AI change-log integrity: valid (${governance.aiChangeLogIntegrity.signed ? 'signed' : 'unsigned'})`)
+        : chalk.red(`   AI change-log integrity: invalid (${governance.aiChangeLogIntegrity.issues.join('; ') || 'unknown'})`));
+    if (governance.suspiciousChange.flagged) {
+        console.log(chalk.red('\nSuspicious Change Detected'));
+        console.log(chalk.red(`   Plan expected files: ${governance.suspiciousChange.expectedFiles} | AI modified files: ${governance.suspiciousChange.actualFiles}`));
+        governance.suspiciousChange.unexpectedFiles.slice(0, maxUnexpectedFiles).forEach((filePath) => {
+            console.log(chalk.red(`   • ${filePath}`));
+        });
+        console.log(chalk.red(`   Confidence: ${governance.suspiciousChange.confidence}`));
+    }
+    if (decision.lowRelevanceFiles.length > 0) {
+        console.log(chalk.yellow('\nLow Relevance Files'));
+        decision.lowRelevanceFiles.slice(0, 10).forEach((item) => {
+            console.log(chalk.yellow(`   • ${item.file} (score ${item.relevanceScore}, ${item.planLink.replace('_', ' ')})`));
+        });
+    }
+    if (options.explain) {
+        console.log(chalk.bold.white('\nAI Change Justification:'));
+        console.log(chalk.dim(`   Task: ${governance.changeJustification.task}`));
+        governance.changeJustification.changes.forEach((item) => {
+            const relevance = typeof item.relevanceScore === 'number' ? ` [score ${item.relevanceScore}]` : '';
+            console.log(chalk.dim(`   • ${item.file} — ${item.reason}${relevance}`));
+        });
+    }
+}
 /**
  * Display verification results in a formatted report card
  */