@neurcode-ai/cli 0.9.30 → 0.9.32

package/dist/commands/verify.js

@@ -241,6 +241,57 @@ function isEnabledFlag(value) {
     const normalized = value.trim().toLowerCase();
     return normalized === '1' || normalized === 'true' || normalized === 'yes' || normalized === 'on';
 }
+function parseSigningKeyRing(raw) {
+    if (!raw || !raw.trim()) {
+        return {};
+    }
+    const out = {};
+    for (const token of raw.split(/[,\n;]+/)) {
+        const trimmed = token.trim();
+        if (!trimmed)
+            continue;
+        const separator = trimmed.indexOf('=');
+        if (separator <= 0)
+            continue;
+        const keyId = trimmed.slice(0, separator).trim();
+        const key = trimmed.slice(separator + 1).trim();
+        if (!keyId || !key)
+            continue;
+        out[keyId] = key;
+    }
+    return out;
+}
+function resolveGovernanceSigningConfig() {
+    const signingKeys = parseSigningKeyRing(process.env.NEURCODE_GOVERNANCE_SIGNING_KEYS);
+    const envSigningKey = process.env.NEURCODE_GOVERNANCE_SIGNING_KEY?.trim() ||
+        process.env.NEURCODE_AI_LOG_SIGNING_KEY?.trim() ||
+        '';
+    const requestedKeyId = process.env.NEURCODE_GOVERNANCE_SIGNING_KEY_ID?.trim() || '';
+    const signer = process.env.NEURCODE_GOVERNANCE_SIGNER || process.env.USER || 'neurcode-cli';
+    let signingKey = envSigningKey || null;
+    let signingKeyId = requestedKeyId || null;
+    if (!signingKey && Object.keys(signingKeys).length > 0) {
+        if (signingKeyId && signingKeys[signingKeyId]) {
+            signingKey = signingKeys[signingKeyId];
+        }
+        else {
+            const fallbackKeyId = Object.keys(signingKeys).sort((a, b) => a.localeCompare(b))[0];
+            signingKey = signingKeys[fallbackKeyId];
+            signingKeyId = signingKeyId || fallbackKeyId;
+        }
+    }
+    return {
+        signingKey,
+        signingKeyId,
+        signingKeys,
+        signer,
+    };
+}
+function isSignedAiLogsRequired(orgGovernanceSettings) {
+    return (orgGovernanceSettings?.requireSignedAiLogs === true ||
+        isEnabledFlag(process.env.NEURCODE_GOVERNANCE_REQUIRE_SIGNED_LOGS) ||
+        isEnabledFlag(process.env.NEURCODE_AI_LOG_REQUIRE_SIGNED));
+}
 function policyLockMismatchMessage(mismatches) {
     if (mismatches.length === 0) {
         return 'Policy lock baseline check failed';
@@ -292,11 +343,24 @@ function resolveAuditIntegrityStatus(requireIntegrity, auditIntegrity) {
         issues,
     };
 }
+async function recordVerificationIfRequested(options, config, payload) {
+    if (!options.record) {
+        return;
+    }
+    if (!config.apiKey) {
+        if (!payload.jsonMode) {
+            console.log(chalk.yellow('\n⚠️  --record flag requires API key'));
+            console.log(chalk.dim('   Set NEURCODE_API_KEY environment variable or use --api-key flag'));
+        }
+        return;
+    }
+    await reportVerification(payload.grade, payload.violations, payload.verifyResult, config.apiKey, config.apiUrl || 'https://api.neurcode.com', payload.projectId, payload.jsonMode, payload.governance);
+}
 /**
  * Execute policy-only verification (General Governance mode)
  * Returns the exit code to use
  */
-async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRoot, config, client, source, orgGovernanceSettings, aiLogSigningKey, aiLogSigner) {
+async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRoot, config, client, source, projectId, orgGovernanceSettings, aiLogSigningKey, aiLogSigningKeyId, aiLogSigningKeys, aiLogSigner) {
     if (!options.json) {
         console.log(chalk.cyan('🛡️  General Governance mode (policy only, no plan linked)\n'));
     }
@@ -308,22 +372,142 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
         contextCandidates: diffFiles.map((file) => file.path),
         orgGovernance: orgGovernanceSettings,
         signingKey: aiLogSigningKey,
+        signingKeyId: aiLogSigningKeyId,
+        signingKeys: aiLogSigningKeys,
         signer: aiLogSigner,
     });
+    const governancePayload = buildGovernancePayload(governanceAnalysis, orgGovernanceSettings);
     const contextPolicyViolations = governanceAnalysis.contextPolicy.violations.filter((item) => !ignoreFilter(item.file));
+    const signedLogsRequired = isSignedAiLogsRequired(orgGovernanceSettings);
+    if (signedLogsRequired && !governanceAnalysis.aiChangeLogIntegrity.valid) {
+        const message = `AI change-log integrity check failed: ${governanceAnalysis.aiChangeLogIntegrity.issues.join('; ') || 'unknown issue'}`;
+        if (options.json) {
+            console.log(JSON.stringify({
+                grade: 'F',
+                score: 0,
+                verdict: 'FAIL',
+                violations: [
+                    {
+                        file: '.neurcode/ai-change-log.json',
+                        rule: 'ai_change_log_integrity',
+                        severity: 'block',
+                        message,
+                    },
+                ],
+                message,
+                scopeGuardPassed: false,
+                bloatCount: 0,
+                bloatFiles: [],
+                plannedFilesModified: 0,
+                totalPlannedFiles: 0,
+                adherenceScore: 0,
+                mode: 'policy_only',
+                policyOnly: true,
+                policyOnlySource: source,
+                ...governancePayload,
+            }, null, 2));
+        }
+        else {
+            console.log(chalk.red('❌ AI change-log integrity validation failed (policy-only mode).'));
+            console.log(chalk.red(`   ${message}`));
+        }
+        await recordVerificationIfRequested(options, config, {
+            grade: 'F',
+            violations: [
+                {
+                    file: '.neurcode/ai-change-log.json',
+                    rule: 'ai_change_log_integrity',
+                    severity: 'block',
+                    message,
+                },
+            ],
+            verifyResult: {
+                adherenceScore: 0,
+                verdict: 'FAIL',
+                bloatCount: 0,
+                bloatFiles: [],
+                message,
+            },
+            projectId,
+            jsonMode: Boolean(options.json),
+            governance: governancePayload,
+        });
+        return 2;
+    }
+    if (governanceAnalysis.governanceDecision.decision === 'block') {
+        const message = governanceAnalysis.governanceDecision.summary
+            || 'Governance decision matrix returned BLOCK.';
+        const reasonCodes = governanceAnalysis.governanceDecision.reasonCodes || [];
+        if (options.json) {
+            console.log(JSON.stringify({
+                grade: 'F',
+                score: 0,
+                verdict: 'FAIL',
+                violations: [
+                    {
+                        file: '.neurcode/ai-change-log.json',
+                        rule: 'governance_decision_block',
+                        severity: 'block',
+                        message,
+                    },
+                ],
+                message,
+                scopeGuardPassed: false,
+                bloatCount: 0,
+                bloatFiles: [],
+                plannedFilesModified: 0,
+                totalPlannedFiles: 0,
+                adherenceScore: 0,
+                mode: 'policy_only',
+                policyOnly: true,
+                policyOnlySource: source,
+                ...governancePayload,
+            }, null, 2));
+        }
+        else {
+            console.log(chalk.red('❌ Governance decision blocked this change set (policy-only mode).'));
+            if (reasonCodes.length > 0) {
+                console.log(chalk.red(`   Reasons: ${reasonCodes.join(', ')}`));
+            }
+            console.log(chalk.red(`   ${message}`));
+        }
+        await recordVerificationIfRequested(options, config, {
+            grade: 'F',
+            violations: [
+                {
+                    file: '.neurcode/ai-change-log.json',
+                    rule: 'governance_decision_block',
+                    severity: 'block',
+                    message,
+                },
+            ],
+            verifyResult: {
+                adherenceScore: 0,
+                verdict: 'FAIL',
+                bloatCount: 0,
+                bloatFiles: [],
+                message,
+            },
+            projectId,
+            jsonMode: Boolean(options.json),
+            governance: governancePayload,
+        });
+        return 2;
+    }
     if (contextPolicyViolations.length > 0) {
         const message = `Context policy violation: ${contextPolicyViolations.map((item) => item.file).join(', ')}`;
+        const contextPolicyViolationItems = contextPolicyViolations.map((item) => ({
+            file: item.file,
+            rule: `context_policy:${item.rule}`,
+            severity: 'block',
+            message: item.reason,
+        }));
         if (options.json) {
             console.log(JSON.stringify({
                 grade: 'F',
                 score: 0,
                 verdict: 'FAIL',
-                violations: contextPolicyViolations.map((item) => ({
-                    file: item.file,
-                    rule: `context_policy:${item.rule}`,
-                    severity: 'block',
-                    message: item.reason,
-                })),
+                violations: contextPolicyViolationItems,
                 message,
                 scopeGuardPassed: false,
                 bloatCount: 0,
@@ -334,7 +518,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
                 mode: 'policy_only',
                 policyOnly: true,
                 policyOnlySource: source,
-                ...buildGovernancePayload(governanceAnalysis, orgGovernanceSettings),
+                ...governancePayload,
             }, null, 2));
         }
         else {
@@ -344,6 +528,20 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
             });
             console.log(chalk.dim(`\n${message}`));
         }
+        await recordVerificationIfRequested(options, config, {
+            grade: 'F',
+            violations: contextPolicyViolationItems,
+            verifyResult: {
+                adherenceScore: 0,
+                verdict: 'FAIL',
+                bloatCount: 0,
+                bloatFiles: [],
+                message,
+            },
+            projectId,
+            jsonMode: Boolean(options.json),
+            governance: governancePayload,
+        });
         return 2;
     }
     let policyViolations = [];
@@ -417,12 +615,13 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
     }
     if (policyLockEvaluation.enforced && !policyLockEvaluation.matched) {
         const message = policyLockMismatchMessage(policyLockEvaluation.mismatches);
+        const lockViolationItems = toPolicyLockViolations(policyLockEvaluation.mismatches);
         if (options.json) {
             console.log(JSON.stringify({
                 grade: 'F',
                 score: 0,
                 verdict: 'FAIL',
-                violations: toPolicyLockViolations(policyLockEvaluation.mismatches),
+                violations: lockViolationItems,
                 message,
                 scopeGuardPassed: true,
                 bloatCount: 0,
@@ -433,7 +632,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
                 mode: 'policy_only',
                 policyOnly: true,
                 policyOnlySource: source,
-                ...buildGovernancePayload(governanceAnalysis, orgGovernanceSettings),
+                ...governancePayload,
                 policyLock: {
                     enforced: true,
                     matched: false,
@@ -450,6 +649,20 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
             });
             console.log(chalk.dim('\n   If drift is intentional, regenerate baseline with `neurcode policy lock`.\n'));
         }
+        await recordVerificationIfRequested(options, config, {
+            grade: 'F',
+            violations: lockViolationItems,
+            verifyResult: {
+                adherenceScore: 0,
+                verdict: 'FAIL',
+                bloatCount: 0,
+                bloatFiles: [],
+                message,
+            },
+            projectId,
+            jsonMode: Boolean(options.json),
+            governance: governancePayload,
+        });
         return 2;
     }
     if (!options.json && effectiveRules.customRules.length > 0) {
@@ -565,7 +778,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
             mode: 'policy_only',
             policyOnly: true,
             policyOnlySource: source,
-            ...buildGovernancePayload(governanceAnalysis, orgGovernanceSettings),
+            ...governancePayload,
             policyLock: {
                 enforced: policyLockEvaluation.enforced,
                 matched: policyLockEvaluation.matched,
@@ -608,6 +821,20 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
         displayGovernanceInsights(governanceAnalysis, { explain: options.explain });
         console.log(chalk.dim(`\n${message}`));
     }
+    await recordVerificationIfRequested(options, config, {
+        grade,
+        violations: violationsOutput,
+        verifyResult: {
+            adherenceScore: score,
+            verdict: effectiveVerdict,
+            bloatCount: 0,
+            bloatFiles: [],
+            message,
+        },
+        projectId,
+        jsonMode: Boolean(options.json),
+        governance: governancePayload,
+    });
     return effectiveVerdict === 'FAIL' ? 2 : effectiveVerdict === 'WARN' ? 1 : 0;
 }
 async function verifyCommand(options) {
@@ -661,10 +888,11 @@ async function verifyCommand(options) {
             orgId: (0, state_1.getOrgId)(),
             projectId: projectId || null,
         };
-        const aiLogSigningKey = process.env.NEURCODE_GOVERNANCE_SIGNING_KEY ||
-            process.env.NEURCODE_AI_LOG_SIGNING_KEY ||
-            null;
-        const aiLogSigner = process.env.NEURCODE_GOVERNANCE_SIGNER || process.env.USER || 'neurcode-cli';
+        const signingConfig = resolveGovernanceSigningConfig();
+        const aiLogSigningKey = signingConfig.signingKey;
+        const aiLogSigningKeyId = signingConfig.signingKeyId;
+        const aiLogSigningKeys = signingConfig.signingKeys;
+        const aiLogSigner = signingConfig.signer;
         let orgGovernanceSettings = null;
         if (config.apiKey) {
             try {
@@ -686,6 +914,8 @@ async function verifyCommand(options) {
                 }
             }
         }
+        const signedLogsRequired = isSignedAiLogsRequired(orgGovernanceSettings);
+        const hasSigningMaterial = Boolean(aiLogSigningKey) || Object.keys(aiLogSigningKeys).length > 0;
         const recordVerifyEvent = (verdict, note, changedFiles, planId) => {
             if (!brainScope.orgId || !brainScope.projectId) {
                 return;
@@ -707,6 +937,60 @@ async function verifyCommand(options) {
                 // Never block verify flow on Brain persistence failures.
             }
         };
+        if (signedLogsRequired && !hasSigningMaterial) {
+            const message = 'Signed AI change-logs are required but no signing key is configured. Set NEURCODE_GOVERNANCE_SIGNING_KEY or NEURCODE_GOVERNANCE_SIGNING_KEYS.';
+            recordVerifyEvent('FAIL', 'missing_signing_key_material');
+            if (options.json) {
+                console.log(JSON.stringify({
+                    grade: 'F',
+                    score: 0,
+                    verdict: 'FAIL',
+                    violations: [
+                        {
+                            file: '.neurcode/ai-change-log.json',
+                            rule: 'ai_change_log_signing_required',
+                            severity: 'block',
+                            message,
+                        },
+                    ],
+                    adherenceScore: 0,
+                    bloatCount: 0,
+                    bloatFiles: [],
+                    plannedFilesModified: 0,
+                    totalPlannedFiles: 0,
+                    message,
+                    scopeGuardPassed: false,
+                    mode: 'plan_enforced',
+                    policyOnly: false,
+                }, null, 2));
+            }
+            else {
+                console.log(chalk.red('\n⛔ Governance Signing Key Missing'));
+                console.log(chalk.red(`   ${message}`));
+                console.log(chalk.dim('   Recommended: set NEURCODE_GOVERNANCE_SIGNING_KEY_ID and key ring via NEURCODE_GOVERNANCE_SIGNING_KEYS.'));
+            }
+            await recordVerificationIfRequested(options, config, {
+                grade: 'F',
+                violations: [
+                    {
+                        file: '.neurcode/ai-change-log.json',
+                        rule: 'ai_change_log_signing_required',
+                        severity: 'block',
+                        message,
+                    },
+                ],
+                verifyResult: {
+                    adherenceScore: 0,
+                    verdict: 'FAIL',
+                    bloatCount: 0,
+                    bloatFiles: [],
+                    message,
+                },
+                projectId: projectId || undefined,
+                jsonMode: Boolean(options.json),
+            });
+            process.exit(2);
+        }
         // Determine which diff to capture (staged + unstaged for full current work)
         let diffText;
         if (options.staged) {
@@ -818,21 +1102,25 @@ async function verifyCommand(options) {
                 contextCandidates: diffFiles.map((file) => file.path),
                 orgGovernance: orgGovernanceSettings,
                 signingKey: aiLogSigningKey,
+                signingKeyId: aiLogSigningKeyId,
+                signingKeys: aiLogSigningKeys,
                 signer: aiLogSigner,
             });
+            const baselineGovernancePayload = buildGovernancePayload(baselineGovernance, orgGovernanceSettings);
             const message = `Context access policy violation: ${baselineContextViolations.map((item) => item.file).join(', ')}`;
+            const baselineContextViolationItems = baselineContextViolations.map((item) => ({
+                file: item.file,
+                rule: `context_policy:${item.rule}`,
+                severity: 'block',
+                message: item.reason,
+            }));
             recordVerifyEvent('FAIL', `context_policy_violations=${baselineContextViolations.length}`, diffFiles.map((f) => f.path));
             if (options.json) {
                 console.log(JSON.stringify({
                     grade: 'F',
                     score: 0,
                     verdict: 'FAIL',
-                    violations: baselineContextViolations.map((item) => ({
-                        file: item.file,
-                        rule: `context_policy:${item.rule}`,
-                        severity: 'block',
-                        message: item.reason,
-                    })),
+                    violations: baselineContextViolationItems,
                     adherenceScore: 0,
                     bloatCount: 0,
                     bloatFiles: [],
@@ -840,7 +1128,7 @@ async function verifyCommand(options) {
                     totalPlannedFiles: 0,
                     message,
                     scopeGuardPassed: false,
-                    ...buildGovernancePayload(baselineGovernance, orgGovernanceSettings),
+                    ...baselineGovernancePayload,
                     mode: 'policy_violation',
                     policyOnly: false,
                 }, null, 2));
@@ -853,6 +1141,20 @@ async function verifyCommand(options) {
                 console.log(chalk.dim(`\nRisk level: ${baselineGovernance.blastRadius.riskScore.toUpperCase()}`));
                 console.log(chalk.red('\nAction blocked.\n'));
             }
+            await recordVerificationIfRequested(options, config, {
+                grade: 'F',
+                violations: baselineContextViolationItems,
+                verifyResult: {
+                    adherenceScore: 0,
+                    verdict: 'FAIL',
+                    bloatCount: 0,
+                    bloatFiles: [],
+                    message,
+                },
+                projectId: projectId || undefined,
+                jsonMode: Boolean(options.json),
+                governance: baselineGovernancePayload,
+            });
             process.exit(2);
         }
         if (!options.json) {
@@ -861,7 +1163,7 @@ async function verifyCommand(options) {
             console.log(chalk.dim(`   ${summary.totalAdded} lines added, ${summary.totalRemoved} lines removed\n`));
         }
         const runPolicyOnlyModeAndExit = async (source) => {
-            const exitCode = await executePolicyOnlyMode(options, diffFiles, shouldIgnore, projectRoot, config, client, source, orgGovernanceSettings, aiLogSigningKey, aiLogSigner);
+            const exitCode = await executePolicyOnlyMode(options, diffFiles, shouldIgnore, projectRoot, config, client, source, projectId || undefined, orgGovernanceSettings, aiLogSigningKey, aiLogSigningKeyId, aiLogSigningKeys, aiLogSigner);
             const changedFiles = diffFiles.map((f) => f.path);
             const verdict = exitCode === 2 ? 'FAIL' : exitCode === 1 ? 'WARN' : 'PASS';
             recordVerifyEvent(verdict, `policy_only_source=${source};exit=${exitCode}`, changedFiles);
@@ -910,6 +1212,7 @@ async function verifyCommand(options) {
         if (!planId) {
             if (requirePlan) {
                 const changedFiles = diffFiles.map((f) => f.path);
+                const message = 'Plan ID is required in strict mode. Run "neurcode plan" first or pass --plan-id.';
                 recordVerifyEvent('FAIL', 'missing_plan_id;require_plan=true', changedFiles);
                 if (options.json) {
                     console.log(JSON.stringify({
@@ -922,7 +1225,7 @@ async function verifyCommand(options) {
                         bloatFiles: [],
                         plannedFilesModified: 0,
                         totalPlannedFiles: 0,
-                        message: 'Plan ID is required in strict mode. Run "neurcode plan" first or pass --plan-id.',
+                        message,
                         scopeGuardPassed: false,
                         mode: 'plan_required',
                         policyOnly: false,
@@ -933,6 +1236,19 @@ async function verifyCommand(options) {
                     console.log(chalk.dim('   Run "neurcode plan" first or pass --plan-id <id>.'));
                     console.log(chalk.dim('   Use --policy-only only when intentionally running general governance checks.'));
                 }
+                await recordVerificationIfRequested(options, config, {
+                    grade: 'F',
+                    violations: [],
+                    verifyResult: {
+                        adherenceScore: 0,
+                        verdict: 'FAIL',
+                        bloatCount: 0,
+                        bloatFiles: [],
+                        message,
+                    },
+                    projectId: projectId || undefined,
+                    jsonMode: Boolean(options.json),
+                });
                 process.exit(1);
             }
             if (!options.json) {
@@ -981,6 +1297,8 @@ async function verifyCommand(options) {
                 contextCandidates: planFiles,
                 orgGovernance: orgGovernanceSettings,
                 signingKey: aiLogSigningKey,
+                signingKeyId: aiLogSigningKeyId,
+                signingKeys: aiLogSigningKeys,
                 signer: aiLogSigner,
             });
             // Get sessionId from state file (.neurcode/state.json) first, then fallback to config
@@ -1029,25 +1347,26 @@ async function verifyCommand(options) {
             // Step D: The Block (only report scope violations for non-ignored files)
             if (filteredViolations.length > 0) {
                 recordVerifyEvent('FAIL', `scope_violation=${filteredViolations.length}`, modifiedFiles, finalPlanId);
+                const scopeViolationItems = filteredViolations.map((file) => ({
+                    file,
+                    rule: 'scope_guard',
+                    severity: 'block',
+                    message: 'File modified outside the plan',
+                }));
+                const scopeViolationMessage = `Scope violation: ${filteredViolations.length} file(s) modified outside the plan`;
                 if (options.json) {
                     // Output JSON for scope violation BEFORE exit. Must include violations for GitHub Action annotations.
-                    const violationsOutput = filteredViolations.map((file) => ({
-                        file,
-                        rule: 'scope_guard',
-                        severity: 'block',
-                        message: 'File modified outside the plan',
-                    }));
                     const jsonOutput = {
                         grade: 'F',
                         score: 0,
                         verdict: 'FAIL',
-                        violations: violationsOutput,
+                        violations: scopeViolationItems,
                         adherenceScore: 0,
                         bloatCount: filteredViolations.length,
                         bloatFiles: filteredViolations,
                         plannedFilesModified: 0,
                         totalPlannedFiles: planFiles.length,
-                        message: `Scope violation: ${filteredViolations.length} file(s) modified outside the plan`,
+                        message: scopeViolationMessage,
                         scopeGuardPassed: false,
                         mode: 'plan_enforced',
                         policyOnly: false,
@@ -1057,6 +1376,22 @@ async function verifyCommand(options) {
                     };
                     // CRITICAL: Print JSON first, then exit
                     console.log(JSON.stringify(jsonOutput, null, 2));
+                    await recordVerificationIfRequested(options, config, {
+                        grade: 'F',
+                        violations: scopeViolationItems,
+                        verifyResult: {
+                            adherenceScore: 0,
+                            verdict: 'FAIL',
+                            bloatCount: filteredViolations.length,
+                            bloatFiles: filteredViolations,
+                            message: scopeViolationMessage,
+                        },
+                        projectId: projectId || undefined,
+                        jsonMode: true,
+                        governance: governanceResult
+                            ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                            : undefined,
+                    });
                     process.exit(1);
                 }
                 else {
@@ -1077,6 +1412,22 @@ async function verifyCommand(options) {
                         displayGovernanceInsights(governanceResult, { explain: options.explain });
                     }
                     console.log('');
+                    await recordVerificationIfRequested(options, config, {
+                        grade: 'F',
+                        violations: scopeViolationItems,
+                        verifyResult: {
+                            adherenceScore: 0,
+                            verdict: 'FAIL',
+                            bloatCount: filteredViolations.length,
+                            bloatFiles: filteredViolations,
+                            message: scopeViolationMessage,
+                        },
+                        projectId: projectId || undefined,
+                        jsonMode: false,
+                        governance: governanceResult
+                            ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                            : undefined,
+                    });
                     process.exit(1);
                 }
             }
@@ -1164,13 +1515,14 @@ async function verifyCommand(options) {
             }
             if (policyLockEvaluation.enforced && !policyLockEvaluation.matched) {
                 const message = policyLockMismatchMessage(policyLockEvaluation.mismatches);
+                const lockViolationItems = toPolicyLockViolations(policyLockEvaluation.mismatches);
                 recordVerifyEvent('FAIL', 'policy_lock_mismatch', diffFiles.map((f) => f.path), finalPlanId);
                 if (options.json) {
                     console.log(JSON.stringify({
                         grade: 'F',
                         score: 0,
                         verdict: 'FAIL',
-                        violations: toPolicyLockViolations(policyLockEvaluation.mismatches),
+                        violations: lockViolationItems,
                         adherenceScore: 0,
                         bloatCount: 0,
                         bloatFiles: [],
@@ -1199,6 +1551,22 @@ async function verifyCommand(options) {
                     });
                     console.log(chalk.dim('\n   If this drift is intentional, regenerate baseline with `neurcode policy lock`.\n'));
                 }
+                await recordVerificationIfRequested(options, config, {
+                    grade: 'F',
+                    violations: lockViolationItems,
+                    verifyResult: {
+                        adherenceScore: 0,
+                        verdict: 'FAIL',
+                        bloatCount: 0,
+                        bloatFiles: [],
+                        message,
+                    },
+                    projectId: projectId || undefined,
+                    jsonMode: Boolean(options.json),
+                    governance: governanceResult
+                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                        : undefined,
+                });
                 process.exit(2);
             }
         }
@@ -1379,13 +1747,23 @@ async function verifyCommand(options) {
             const verifyResult = await client.verifyPlan(finalPlanId, diffStats, changedFiles, projectId, intentConstraints);
             // Apply custom policy verdict: block from dashboard overrides API verdict
             const policyBlock = policyDecision === 'block' && policyViolations.length > 0;
-            const effectiveVerdict = policyBlock ? 'FAIL' : verifyResult.verdict;
+            const governanceDecisionBlock = governanceResult?.governanceDecision?.decision === 'block';
+            const governanceIntegrityBlock = signedLogsRequired && governanceResult ? governanceResult.aiChangeLogIntegrity.valid !== true : false;
+            const governanceHardBlock = governanceDecisionBlock || governanceIntegrityBlock;
+            const effectiveVerdict = policyBlock || governanceHardBlock
+                ? 'FAIL'
+                : verifyResult.verdict;
             const policyMessageBase = policyBlock
                 ? `Custom policy violations: ${policyViolations.map(v => `${v.file}: ${v.message || v.rule}`).join('; ')}. ${verifyResult.message}`
                 : verifyResult.message;
-            const effectiveMessage = policyExceptionsSummary.suppressed > 0
+            const governanceBlockReason = governanceIntegrityBlock
+                ? `AI change-log integrity failed: ${governanceResult?.aiChangeLogIntegrity?.issues?.join('; ') || 'unknown issue'}`
+                : governanceDecisionBlock
+                    ? governanceResult?.governanceDecision?.summary || 'Governance decision matrix returned BLOCK.'
+                    : null;
+            const effectiveMessage = (policyExceptionsSummary.suppressed > 0
                 ? `${policyMessageBase} Policy exceptions suppressed ${policyExceptionsSummary.suppressed} violation(s).`
-                : policyMessageBase;
+                : policyMessageBase) + (governanceBlockReason ? ` ${governanceBlockReason}` : '');
             // Calculate grade from effective verdict and score
             // CRITICAL: 0/0 planned files = 'F' (Incomplete), not 'B'
             // Bloat automatically drops grade by at least one letter
@@ -1434,6 +1812,7 @@ async function verifyCommand(options) {
             recordVerifyEvent(effectiveVerdict, `adherence=${verifyResult.adherenceScore};bloat=${verifyResult.bloatCount};scopeGuard=${scopeGuardPassed ? 1 : 0};policy=${policyDecision};policyExceptions=${policyExceptionsSummary.suppressed}`, changedPathsForBrain, finalPlanId);
             const shouldForceGovernancePass = scopeGuardPassed &&
                 !policyBlock &&
+                !governanceHardBlock &&
                 (effectiveVerdict === 'PASS' ||
                     ((verifyResult.verdict === 'FAIL' || verifyResult.verdict === 'WARN') &&
                         policyViolations.length === 0 &&
@@ -1493,30 +1872,22 @@ async function verifyCommand(options) {
                         : {}),
                 };
                 console.log(JSON.stringify(jsonOutput, null, 2));
-                // Report to Neurcode Cloud if --record flag is set (after JSON output)
-                if (options.record && config.apiKey) {
-                    const violations = [
-                        ...filteredBloatFiles.map((file) => ({
-                            rule: 'scope_guard',
-                            file: file,
-                            severity: 'block',
-                            message: 'File modified outside the plan',
-                        })),
-                        ...policyViolations.map(v => ({
-                            rule: v.rule,
-                            file: v.file,
-                            severity: v.severity,
-                            message: v.message,
-                        })),
-                    ];
-                    // Report in background (don't await to avoid blocking JSON output)
-                    reportVerification(grade, violations, verifyResult, config.apiKey, config.apiUrl, projectId || undefined, true, // jsonMode = true
-                    governanceResult
+                await recordVerificationIfRequested(options, config, {
+                    grade,
+                    violations: violations,
+                    verifyResult: {
+                        adherenceScore: verifyResult.adherenceScore,
+                        verdict: effectiveVerdict,
+                        bloatCount: filteredBloatFiles.length,
+                        bloatFiles: filteredBloatFiles,
+                        message: effectiveMessage,
+                    },
+                    projectId: projectId || undefined,
+                    jsonMode: true,
+                    governance: governanceResult
                         ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
-                        : undefined).catch(() => {
-                        // Error already logged in reportVerification
-                    });
-                }
+                        : undefined,
+                });
                 // Exit based on effective verdict (same logic as below)
                 if (shouldForceGovernancePass) {
                     process.exit(0);
@@ -1565,36 +1936,37 @@ async function verifyCommand(options) {
                 }
             }
             // Report to Neurcode Cloud if --record flag is set
-            if (options.record) {
-                if (!config.apiKey) {
-                    if (!options.json) {
-                        console.log(chalk.yellow('\n⚠️  --record flag requires API key'));
-                        console.log(chalk.dim('   Set NEURCODE_API_KEY environment variable or use --api-key flag'));
-                    }
-                }
-                else {
-                    // Include scope bloat and custom policy violations in the report (excluding .neurcodeignore'd paths)
-                    const filteredBloatForReport = (verifyResult.bloatFiles || []).filter((f) => !shouldIgnore(f));
-                    const violations = [
-                        ...filteredBloatForReport.map((file) => ({
-                            rule: 'scope_guard',
-                            file: file,
-                            severity: 'block',
-                            message: 'File modified outside the plan',
-                        })),
-                        ...policyViolations.map(v => ({
-                            rule: v.rule,
-                            file: v.file,
-                            severity: v.severity,
-                            message: v.message,
-                        })),
-                    ];
-                    await reportVerification(grade, violations, verifyResult, config.apiKey, config.apiUrl, projectId || undefined, false, // jsonMode = false
-                    governanceResult
-                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
-                        : undefined);
-                }
-            }
+            const filteredBloatForReport = (verifyResult.bloatFiles || []).filter((f) => !shouldIgnore(f));
+            const reportViolations = [
+                ...filteredBloatForReport.map((file) => ({
+                    rule: 'scope_guard',
+                    file: file,
+                    severity: 'block',
+                    message: 'File modified outside the plan',
+                })),
+                ...policyViolations.map((v) => ({
+                    rule: v.rule,
+                    file: v.file,
+                    severity: v.severity,
+                    message: v.message,
+                })),
+            ];
+            await recordVerificationIfRequested(options, config, {
+                grade,
+                violations: reportViolations,
+                verifyResult: {
+                    adherenceScore: verifyResult.adherenceScore,
+                    verdict: effectiveVerdict,
+                    bloatCount: filteredBloatForReport.length,
+                    bloatFiles: filteredBloatForReport,
+                    message: effectiveMessage,
+                },
+                projectId: projectId || undefined,
+                jsonMode: false,
+                governance: governanceResult
+                    ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                    : undefined,
+            });
             // Governance override: keep PASS only when scope guard passes and failure is due
             // to server-side bloat mismatch (allowed files unknown to verify API).
             if (shouldForceGovernancePass) {
@@ -1780,6 +2152,63 @@ function collectCIContext() {
     }
     return context;
 }
+const REPORT_MAX_ARRAY_ITEMS = 120;
+const REPORT_MAX_STRING_LENGTH = 4000;
+const REPORT_MAX_OBJECT_DEPTH = 6;
+function compactReportValue(value, depth = 0, seen = new WeakSet()) {
+    if (value == null) {
+        return value;
+    }
+    if (typeof value === 'string') {
+        return value.length > REPORT_MAX_STRING_LENGTH
+            ? `${value.slice(0, REPORT_MAX_STRING_LENGTH)}...[truncated]`
+            : value;
+    }
+    if (typeof value !== 'object') {
+        return value;
+    }
+    if (depth >= REPORT_MAX_OBJECT_DEPTH) {
+        return '[truncated]';
+    }
+    if (Array.isArray(value)) {
+        const items = value.slice(0, REPORT_MAX_ARRAY_ITEMS).map((item) => compactReportValue(item, depth + 1, seen));
+        if (value.length > REPORT_MAX_ARRAY_ITEMS) {
+            items.push(`[truncated ${value.length - REPORT_MAX_ARRAY_ITEMS} item(s)]`);
+        }
+        return items;
+    }
+    if (seen.has(value)) {
+        return '[circular]';
+    }
+    seen.add(value);
+    const compacted = {};
+    for (const [key, nestedValue] of Object.entries(value)) {
+        compacted[key] = compactReportValue(nestedValue, depth + 1, seen);
+    }
+    return compacted;
+}
+function buildCompactVerificationPayload(payload) {
+    const compactViolations = payload.violations.slice(0, REPORT_MAX_ARRAY_ITEMS);
+    if (payload.violations.length > REPORT_MAX_ARRAY_ITEMS) {
+        compactViolations.push({
+            rule: 'report_payload_compaction',
+            file: '__meta__',
+            severity: 'warn',
+            message: `Truncated ${payload.violations.length - REPORT_MAX_ARRAY_ITEMS} additional violation(s) for upload`,
+        });
+    }
+    return {
+        ...payload,
+        violations: compactViolations,
+        bloatFiles: payload.bloatFiles.slice(0, REPORT_MAX_ARRAY_ITEMS),
+        message: payload.message.length > REPORT_MAX_STRING_LENGTH
+            ? `${payload.message.slice(0, REPORT_MAX_STRING_LENGTH)}...[truncated]`
+            : payload.message,
+        governance: payload.governance
+            ? compactReportValue(payload.governance)
+            : undefined,
+    };
+}
 /**
  * Report verification results to Neurcode Cloud
  */
@@ -1801,22 +2230,36 @@ async function reportVerification(grade, violations, verifyResult, apiKey, apiUr
             projectId,
             governance,
         };
-        const response = await fetch(`${apiUrl}/api/v1/action/verifications`, {
+        const postPayload = async (requestPayload) => fetch(`${apiUrl}/api/v1/action/verifications`, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
                 'Authorization': `Bearer ${apiKey}`,
             },
-            body: JSON.stringify(payload),
+            body: JSON.stringify(requestPayload),
         });
+        let response = await postPayload(payload);
+        let compactedUpload = false;
+        if (response.status === 413) {
+            response = await postPayload(buildCompactVerificationPayload(payload));
+            compactedUpload = true;
+        }
         if (!response.ok) {
             const errorText = await response.text();
-            throw new Error(`HTTP ${response.status}: ${errorText}`);
+            const compactError = errorText.replace(/\s+/g, ' ').trim().slice(0, 400);
+            throw new Error(`HTTP ${response.status}: ${compactError}`);
+        }
+        let result = {};
+        try {
+            result = (await response.json());
+        }
+        catch {
+            // Some proxies may return empty success bodies; treat as recorded.
         }
-        const result = await response.json();
         // Only log if not in json mode to avoid polluting stdout
         if (!jsonMode) {
-            console.log(chalk.dim(`\n✅ Verification result reported to Neurcode Cloud (ID: ${result.id})`));
+            const suffix = compactedUpload ? ' (compact payload)' : '';
+            console.log(chalk.dim(`\n✅ Verification result reported to Neurcode Cloud (ID: ${result.id || 'ok'})${suffix}`));
         }
     }
     catch (error) {
@@ -1867,6 +2310,17 @@ function displayGovernanceInsights(governance, options = {}) {
     console.log(governance.aiChangeLogIntegrity.valid
         ? chalk.dim(`   AI change-log integrity: valid (${governance.aiChangeLogIntegrity.signed ? 'signed' : 'unsigned'})`)
         : chalk.red(`   AI change-log integrity: invalid (${governance.aiChangeLogIntegrity.issues.join('; ') || 'unknown'})`));
+    if (governance.aiChangeLogIntegrity.signed) {
+        const keyId = typeof governance.aiChangeLogIntegrity.keyId === 'string'
+            ? governance.aiChangeLogIntegrity.keyId
+            : null;
+        const verifiedWithKeyId = typeof governance.aiChangeLogIntegrity.verifiedWithKeyId === 'string'
+            ? governance.aiChangeLogIntegrity.verifiedWithKeyId
+            : null;
+        if (keyId || verifiedWithKeyId) {
+            console.log(chalk.dim(`   Signing key: ${keyId || 'n/a'}${verifiedWithKeyId ? ` (verified via ${verifiedWithKeyId})` : ''}`));
+        }
+    }
     if (governance.suspiciousChange.flagged) {
         console.log(chalk.red('\nSuspicious Change Detected'));
         console.log(chalk.red(`   Plan expected files: ${governance.suspiciousChange.expectedFiles} | AI modified files: ${governance.suspiciousChange.actualFiles}`));