@neurcode-ai/cli 0.9.34 → 0.9.35

package/dist/commands/verify.js

@@ -43,6 +43,7 @@ const child_process_1 = require("child_process");
 const git_1 = require("../utils/git");
 const diff_parser_1 = require("@neurcode-ai/diff-parser");
 const policy_engine_1 = require("@neurcode-ai/policy-engine");
+const governance_runtime_1 = require("@neurcode-ai/governance-runtime");
 const config_1 = require("../config");
 const api_client_1 = require("../api-client");
 const path_1 = require("path");
@@ -53,12 +54,15 @@ const box_1 = require("../utils/box");
 const ignore_1 = require("../utils/ignore");
 const project_root_1 = require("../utils/project-root");
 const brain_context_1 = require("../utils/brain-context");
+const scope_telemetry_1 = require("../utils/scope-telemetry");
 const policy_packs_1 = require("../utils/policy-packs");
 const custom_policy_rules_1 = require("../utils/custom-policy-rules");
 const policy_exceptions_1 = require("../utils/policy-exceptions");
 const policy_governance_1 = require("../utils/policy-governance");
 const policy_audit_1 = require("../utils/policy-audit");
 const governance_1 = require("../utils/governance");
+const policy_compiler_1 = require("../utils/policy-compiler");
+const change_contract_1 = require("../utils/change-contract");
 const policy_1 = require("@neurcode-ai/policy");
 // Import chalk with fallback
 let chalk;
@@ -80,6 +84,7 @@ catch {
         white: (str) => str,
     };
 }
+;
 /**
  * Check if a file path should be excluded from verification analysis
  * Excludes internal/system files that should not count towards plan adherence
@@ -234,6 +239,43 @@ async function buildEffectivePolicyRules(client, projectRoot, useDashboardPolici
         includeDashboardPolicies: useDashboardPolicies,
     };
 }
+function resolveCompiledPolicyMetadata(artifact, path) {
+    if (!artifact || !path) {
+        return null;
+    }
+    return {
+        fingerprint: artifact.fingerprint,
+        deterministicRuleCount: artifact.compilation.deterministicRuleCount,
+        unmatchedStatements: artifact.compilation.unmatchedStatements.length,
+        sourcePath: path,
+        policyLockFingerprint: artifact.source.policyLockFingerprint,
+    };
+}
+function buildCompiledPolicyFromEffectiveRules(input) {
+    const policyStatements = [
+        ...input.effectiveRules.customPolicies.map((policy) => policy.rule_text),
+    ];
+    return (0, policy_compiler_1.buildCompiledPolicyArtifact)({
+        includeDashboardPolicies: input.effectiveRules.includeDashboardPolicies,
+        policyLockPath: input.policyLockEvaluation.lockPath,
+        policyLockFingerprint: input.policyLockEvaluation.lockPresent
+            ? (0, policy_packs_1.readPolicyLockFile)(input.projectRoot).lock?.effective.fingerprint || null
+            : null,
+        policyPack: input.effectiveRules.policyPack
+            ? {
+                id: input.effectiveRules.policyPack.packId,
+                name: input.effectiveRules.policyPack.packName,
+                version: input.effectiveRules.policyPack.version,
+            }
+            : null,
+        defaultRuleCount: (0, policy_engine_1.createDefaultPolicy)().rules.length,
+        policyPackRuleCount: input.effectiveRules.policyPackRules.length,
+        customRuleCount: input.effectiveRules.customRules.length,
+        effectiveRuleCount: input.effectiveRules.allRules.length,
+        intentConstraints: input.intentConstraints,
+        policyRules: policyStatements,
+    });
+}
 const POLICY_AUDIT_FILE = 'neurcode.policy.audit.log.jsonl';
 function isEnabledFlag(value) {
     if (!value)
@@ -354,13 +396,30 @@ async function recordVerificationIfRequested(options, config, payload) {
         }
         return;
     }
-    await reportVerification(payload.grade, payload.violations, payload.verifyResult, config.apiKey, config.apiUrl || 'https://api.neurcode.com', payload.projectId, payload.jsonMode, payload.governance);
+    await reportVerification(payload.grade, payload.violations, payload.verifyResult, config.apiKey, config.apiUrl || 'https://api.neurcode.com', payload.projectId, payload.jsonMode, payload.governance, payload.verificationSource);
 }
 /**
  * Execute policy-only verification (General Governance mode)
  * Returns the exit code to use
  */
-async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRoot, config, client, source, projectId, orgGovernanceSettings, aiLogSigningKey, aiLogSigningKeyId, aiLogSigningKeys, aiLogSigner) {
+async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRoot, config, client, source, scopeTelemetry, projectId, orgGovernanceSettings, aiLogSigningKey, aiLogSigningKeyId, aiLogSigningKeys, aiLogSigner, compiledPolicyMetadata, changeContractSummary) {
+    const emitPolicyOnlyJson = (payload) => {
+        console.log(JSON.stringify({
+            ...payload,
+            ...(compiledPolicyMetadata ? { policyCompilation: compiledPolicyMetadata } : {}),
+            changeContract: changeContractSummary,
+            scope: scopeTelemetry,
+        }, null, 2));
+    };
+    const policyOnlyVerificationSource = 'policy_only';
+    const recordPolicyOnlyVerification = async (payload) => recordVerificationIfRequested(options, config, {
+        ...payload,
+        verificationSource: policyOnlyVerificationSource,
+        verifyResult: {
+            ...payload.verifyResult,
+            verificationSource: policyOnlyVerificationSource,
+        },
+    });
     if (!options.json) {
         console.log(chalk.cyan('🛡️  General Governance mode (policy only, no plan linked)\n'));
     }
@@ -376,13 +435,16 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
         signingKeys: aiLogSigningKeys,
         signer: aiLogSigner,
     });
-    const governancePayload = buildGovernancePayload(governanceAnalysis, orgGovernanceSettings);
+    const governancePayload = buildGovernancePayload(governanceAnalysis, orgGovernanceSettings, {
+        compiledPolicy: compiledPolicyMetadata,
+        changeContract: changeContractSummary,
+    });
     const contextPolicyViolations = governanceAnalysis.contextPolicy.violations.filter((item) => !ignoreFilter(item.file));
     const signedLogsRequired = isSignedAiLogsRequired(orgGovernanceSettings);
     if (signedLogsRequired && !governanceAnalysis.aiChangeLogIntegrity.valid) {
         const message = `AI change-log integrity check failed: ${governanceAnalysis.aiChangeLogIntegrity.issues.join('; ') || 'unknown issue'}`;
         if (options.json) {
-            console.log(JSON.stringify({
+            emitPolicyOnlyJson({
                 grade: 'F',
                 score: 0,
                 verdict: 'FAIL',
@@ -405,13 +467,13 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
                 policyOnly: true,
                 policyOnlySource: source,
                 ...governancePayload,
-            }, null, 2));
+            });
         }
         else {
             console.log(chalk.red('❌ AI change-log integrity validation failed (policy-only mode).'));
             console.log(chalk.red(`   ${message}`));
         }
-        await recordVerificationIfRequested(options, config, {
+        await recordPolicyOnlyVerification({
             grade: 'F',
             violations: [
                 {
@@ -439,7 +501,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
             || 'Governance decision matrix returned BLOCK.';
         const reasonCodes = governanceAnalysis.governanceDecision.reasonCodes || [];
         if (options.json) {
-            console.log(JSON.stringify({
+            emitPolicyOnlyJson({
                 grade: 'F',
                 score: 0,
                 verdict: 'FAIL',
@@ -462,7 +524,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
                 policyOnly: true,
                 policyOnlySource: source,
                 ...governancePayload,
-            }, null, 2));
+            });
         }
         else {
             console.log(chalk.red('❌ Governance decision blocked this change set (policy-only mode).'));
@@ -471,7 +533,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
             }
             console.log(chalk.red(`   ${message}`));
         }
-        await recordVerificationIfRequested(options, config, {
+        await recordPolicyOnlyVerification({
             grade: 'F',
             violations: [
                 {
@@ -503,7 +565,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
             message: item.reason,
         }));
         if (options.json) {
-            console.log(JSON.stringify({
+            emitPolicyOnlyJson({
                 grade: 'F',
                 score: 0,
                 verdict: 'FAIL',
@@ -519,7 +581,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
                 policyOnly: true,
                 policyOnlySource: source,
                 ...governancePayload,
-            }, null, 2));
+            });
         }
         else {
             console.log(chalk.red('❌ Context policy violation detected (policy-only mode).'));
@@ -528,7 +590,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
             });
             console.log(chalk.dim(`\n${message}`));
         }
-        await recordVerificationIfRequested(options, config, {
+        await recordPolicyOnlyVerification({
             grade: 'F',
             violations: contextPolicyViolationItems,
             verifyResult: {
@@ -617,7 +679,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
         const message = policyLockMismatchMessage(policyLockEvaluation.mismatches);
         const lockViolationItems = toPolicyLockViolations(policyLockEvaluation.mismatches);
         if (options.json) {
-            console.log(JSON.stringify({
+            emitPolicyOnlyJson({
                 grade: 'F',
                 score: 0,
                 verdict: 'FAIL',
@@ -639,7 +701,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
                     path: policyLockEvaluation.lockPath,
                     mismatches: policyLockEvaluation.mismatches,
                 },
-            }, null, 2));
+            });
         }
         else {
             console.log(chalk.red('❌ Policy lock baseline mismatch.'));
@@ -649,7 +711,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
             });
             console.log(chalk.dim('\n   If drift is intentional, regenerate baseline with `neurcode policy lock`.\n'));
         }
-        await recordVerificationIfRequested(options, config, {
+        await recordPolicyOnlyVerification({
             grade: 'F',
             violations: lockViolationItems,
             verifyResult: {
@@ -763,7 +825,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
         },
     };
     if (options.json) {
-        console.log(JSON.stringify({
+        emitPolicyOnlyJson({
             grade,
             score,
             verdict: effectiveVerdict,
@@ -797,7 +859,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
                     },
                 }
                 : {}),
-        }, null, 2));
+        });
     }
     else {
         if (effectiveVerdict === 'PASS') {
@@ -821,7 +883,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
         displayGovernanceInsights(governanceAnalysis, { explain: options.explain });
         console.log(chalk.dim(`\n${message}`));
     }
-    await recordVerificationIfRequested(options, config, {
+    await recordPolicyOnlyVerification({
         grade,
         violations: violationsOutput,
         verifyResult: {
@@ -839,7 +901,54 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
 }
 async function verifyCommand(options) {
     try {
-        const projectRoot = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
+        const rootResolution = (0, project_root_1.resolveNeurcodeProjectRootWithTrace)(process.cwd());
+        const projectRoot = rootResolution.projectRoot;
+        const scopeTelemetry = (0, scope_telemetry_1.buildScopeTelemetryPayload)(rootResolution);
+        const emitVerifyJson = (payload) => {
+            const jsonPayload = {
+                ...payload,
+                scope: scopeTelemetry,
+            };
+            console.log(JSON.stringify(jsonPayload, null, 2));
+        };
+        const enforceChangeContract = options.enforceChangeContract === true ||
+            isEnabledFlag(process.env.NEURCODE_VERIFY_ENFORCE_CHANGE_CONTRACT);
+        const changeContractRead = (0, change_contract_1.readChangeContract)(projectRoot, options.changeContract);
+        const compiledPolicyRead = (0, policy_compiler_1.readCompiledPolicyArtifact)(projectRoot, options.compiledPolicy);
+        let compiledPolicyMetadata = resolveCompiledPolicyMetadata(compiledPolicyRead.artifact, compiledPolicyRead.exists ? compiledPolicyRead.path : null);
+        let changeContractSummary = {
+            path: changeContractRead.path,
+            exists: changeContractRead.exists,
+            enforced: enforceChangeContract,
+            valid: changeContractRead.contract ? null : changeContractRead.exists ? false : null,
+            planId: changeContractRead.contract?.planId || null,
+            contractId: changeContractRead.contract?.contractId || null,
+            violations: changeContractRead.error
+                ? [
+                    {
+                        code: 'CHANGE_CONTRACT_PARSE_ERROR',
+                        message: changeContractRead.error,
+                    },
+                ]
+                : [],
+        };
+        if (!options.json) {
+            (0, scope_telemetry_1.printScopeTelemetry)(chalk, scopeTelemetry, {
+                includeBlockedWarning: true,
+            });
+            if (compiledPolicyRead.error) {
+                console.log(chalk.yellow(`   Compiled policy artifact unavailable (${compiledPolicyRead.error}); falling back to runtime compilation`));
+            }
+            else if (compiledPolicyRead.artifact) {
+                console.log(chalk.dim(`   Compiled policy loaded: ${compiledPolicyRead.path} (${compiledPolicyRead.artifact.compilation.deterministicRuleCount} deterministic rules)`));
+            }
+            if (changeContractRead.error) {
+                console.log(chalk.yellow(`   Change contract unavailable (${changeContractRead.error})`));
+            }
+            else if (changeContractRead.contract) {
+                console.log(chalk.dim(`   Change contract loaded: ${changeContractRead.path}`));
+            }
+        }
         // Load configuration
         const config = (0, config_1.loadConfig)();
         // 🛑 FORCE PRIORITY: Env Var > Config
@@ -941,7 +1050,7 @@ async function verifyCommand(options) {
             const message = 'Signed AI change-logs are required but no signing key is configured. Set NEURCODE_GOVERNANCE_SIGNING_KEY or NEURCODE_GOVERNANCE_SIGNING_KEYS.';
             recordVerifyEvent('FAIL', 'missing_signing_key_material');
             if (options.json) {
-                console.log(JSON.stringify({
+                emitVerifyJson({
                     grade: 'F',
                     score: 0,
                     verdict: 'FAIL',
@@ -962,7 +1071,7 @@ async function verifyCommand(options) {
                     scopeGuardPassed: false,
                     mode: 'plan_enforced',
                     policyOnly: false,
-                }, null, 2));
+                });
             }
             else {
                 console.log(chalk.red('\n⛔ Governance Signing Key Missing'));
@@ -1021,7 +1130,7 @@ async function verifyCommand(options) {
                 console.log(chalk.dim('   Make sure you have staged or unstaged changes to verify'));
             }
             else {
-                console.log(JSON.stringify({
+                emitVerifyJson({
                     grade: 'F',
                     score: 0,
                     verdict: 'FAIL',
@@ -1033,7 +1142,7 @@ async function verifyCommand(options) {
                     totalPlannedFiles: 0,
                     message: 'No changes detected',
                     scopeGuardPassed: false,
-                }, null, 2));
+                });
             }
             recordVerifyEvent('NO_CHANGES', 'diff=empty');
             process.exit(0);
@@ -1064,7 +1173,7 @@ async function verifyCommand(options) {
                 console.log(chalk.yellow('⚠️  No file changes detected in diff'));
             }
             else {
-                console.log(JSON.stringify({
+                emitVerifyJson({
                     grade: 'F',
                     score: 0,
                     verdict: 'FAIL',
@@ -1076,7 +1185,7 @@ async function verifyCommand(options) {
                     totalPlannedFiles: 0,
                     message: 'No file changes detected in diff',
                     scopeGuardPassed: false,
-                }, null, 2));
+                });
             }
             recordVerifyEvent('NO_CHANGES', 'diff_files=0');
             process.exit(0);
@@ -1106,7 +1215,10 @@ async function verifyCommand(options) {
                 signingKeys: aiLogSigningKeys,
                 signer: aiLogSigner,
             });
-            const baselineGovernancePayload = buildGovernancePayload(baselineGovernance, orgGovernanceSettings);
+            const baselineGovernancePayload = buildGovernancePayload(baselineGovernance, orgGovernanceSettings, {
+                changeContract: changeContractSummary,
+                compiledPolicy: compiledPolicyMetadata,
+            });
             const message = `Context access policy violation: ${baselineContextViolations.map((item) => item.file).join(', ')}`;
             const baselineContextViolationItems = baselineContextViolations.map((item) => ({
                 file: item.file,
@@ -1116,7 +1228,7 @@ async function verifyCommand(options) {
             }));
             recordVerifyEvent('FAIL', `context_policy_violations=${baselineContextViolations.length}`, diffFiles.map((f) => f.path));
             if (options.json) {
-                console.log(JSON.stringify({
+                emitVerifyJson({
                     grade: 'F',
                     score: 0,
                     verdict: 'FAIL',
@@ -1131,7 +1243,7 @@ async function verifyCommand(options) {
                     ...baselineGovernancePayload,
                     mode: 'policy_violation',
                     policyOnly: false,
-                }, null, 2));
+                });
             }
             else {
                 console.log(chalk.red('\n⛔ Context Policy Violation'));
@@ -1163,7 +1275,7 @@ async function verifyCommand(options) {
             console.log(chalk.dim(`   ${summary.totalAdded} lines added, ${summary.totalRemoved} lines removed\n`));
         }
         const runPolicyOnlyModeAndExit = async (source) => {
-            const exitCode = await executePolicyOnlyMode(options, diffFiles, shouldIgnore, projectRoot, config, client, source, projectId || undefined, orgGovernanceSettings, aiLogSigningKey, aiLogSigningKeyId, aiLogSigningKeys, aiLogSigner);
+            const exitCode = await executePolicyOnlyMode(options, diffFiles, shouldIgnore, projectRoot, config, client, source, scopeTelemetry, projectId || undefined, orgGovernanceSettings, aiLogSigningKey, aiLogSigningKeyId, aiLogSigningKeys, aiLogSigner, compiledPolicyMetadata, changeContractSummary);
             const changedFiles = diffFiles.map((f) => f.path);
             const verdict = exitCode === 2 ? 'FAIL' : exitCode === 1 ? 'WARN' : 'PASS';
             recordVerifyEvent(verdict, `policy_only_source=${source};exit=${exitCode}`, changedFiles);
@@ -1215,7 +1327,7 @@ async function verifyCommand(options) {
                 const message = 'Plan ID is required in strict mode. Run "neurcode plan" first or pass --plan-id.';
                 recordVerifyEvent('FAIL', 'missing_plan_id;require_plan=true', changedFiles);
                 if (options.json) {
-                    console.log(JSON.stringify({
+                    emitVerifyJson({
                         grade: 'F',
                         score: 0,
                         verdict: 'FAIL',
@@ -1229,7 +1341,7 @@ async function verifyCommand(options) {
                         scopeGuardPassed: false,
                         mode: 'plan_required',
                         policyOnly: false,
-                    }, null, 2));
+                    });
                 }
                 else {
                     console.log(chalk.red('❌ Plan ID is required in strict mode.'));
@@ -1269,6 +1381,8 @@ async function verifyCommand(options) {
         // Track if scope guard passed - this takes priority over AI grading
         let scopeGuardPassed = false;
         let governanceResult = null;
+        let planFilesForVerification = [];
+        let intentConstraintsForVerification;
         try {
             // Step A: Get Modified Files (already have from diffFiles)
             const modifiedFiles = diffFiles.map(f => f.path);
@@ -1285,6 +1399,8 @@ async function verifyCommand(options) {
             const planFiles = planData.content.files
                 .filter(f => f.action === 'CREATE' || f.action === 'MODIFY')
                 .map(f => f.path);
+            planFilesForVerification = [...planFiles];
+            intentConstraintsForVerification = originalIntent || undefined;
             const planDependencies = Array.isArray(planData.content.dependencies)
                 ? planData.content.dependencies.filter((item) => typeof item === 'string')
                 : [];
@@ -1371,11 +1487,14 @@ async function verifyCommand(options) {
                         mode: 'plan_enforced',
                         policyOnly: false,
                         ...(governanceResult
-                            ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                            ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
+                                changeContract: changeContractSummary,
+                                compiledPolicy: compiledPolicyMetadata,
+                            })
                             : {}),
                     };
                     // CRITICAL: Print JSON first, then exit
-                    console.log(JSON.stringify(jsonOutput, null, 2));
+                    emitVerifyJson(jsonOutput);
                     await recordVerificationIfRequested(options, config, {
                         grade: 'F',
                         violations: scopeViolationItems,
@@ -1389,7 +1508,10 @@ async function verifyCommand(options) {
                         projectId: projectId || undefined,
                         jsonMode: true,
                         governance: governanceResult
-                            ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                            ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
+                                changeContract: changeContractSummary,
+                                compiledPolicy: compiledPolicyMetadata,
+                            })
                             : undefined,
                     });
                     process.exit(1);
@@ -1425,7 +1547,10 @@ async function verifyCommand(options) {
                         projectId: projectId || undefined,
                         jsonMode: false,
                         governance: governanceResult
-                            ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                            ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
+                                changeContract: changeContractSummary,
+                                compiledPolicy: compiledPolicyMetadata,
+                            })
                             : undefined,
                     });
                     process.exit(1);
@@ -1532,8 +1657,13 @@ async function verifyCommand(options) {
                         scopeGuardPassed,
                         mode: 'plan_enforced',
                         policyOnly: false,
+                        changeContract: changeContractSummary,
+                        ...(compiledPolicyMetadata ? { policyCompilation: compiledPolicyMetadata } : {}),
                         ...(governanceResult
-                            ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                            ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
+                                changeContract: changeContractSummary,
+                                compiledPolicy: compiledPolicyMetadata,
+                            })
                             : {}),
                         policyLock: {
                             enforced: true,
@@ -1564,12 +1694,35 @@ async function verifyCommand(options) {
                     projectId: projectId || undefined,
                     jsonMode: Boolean(options.json),
                     governance: governanceResult
-                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
+                            changeContract: changeContractSummary,
+                            compiledPolicy: compiledPolicyMetadata,
+                        })
                         : undefined,
                 });
                 process.exit(2);
             }
         }
+        let effectiveCompiledPolicy = compiledPolicyRead.artifact;
+        if (!effectiveCompiledPolicy) {
+            effectiveCompiledPolicy = buildCompiledPolicyFromEffectiveRules({
+                projectRoot,
+                policyLockEvaluation,
+                effectiveRules,
+                intentConstraints: intentConstraintsForVerification,
+            });
+            compiledPolicyMetadata = resolveCompiledPolicyMetadata(effectiveCompiledPolicy, (0, policy_compiler_1.resolveCompiledPolicyPath)(projectRoot, options.compiledPolicy));
+        }
+        const hydratedCompiledPolicyRules = effectiveCompiledPolicy
+            ? (0, policy_compiler_1.hydrateCompiledPolicyRules)(effectiveCompiledPolicy)
+            : [];
+        if (effectiveCompiledPolicy?.source.policyLockFingerprint &&
+            policyLockEvaluation.lockPresent &&
+            effectiveCompiledPolicy.source.policyLockFingerprint !== (0, policy_packs_1.readPolicyLockFile)(projectRoot).lock?.effective.fingerprint) {
+            if (!options.json) {
+                console.log(chalk.yellow('   Compiled policy lock fingerprint differs from current lock; runtime checks will continue with latest lock state'));
+            }
+        }
         // Check user tier - Policy Compliance and A-F Grading are PRO features
         const governance = (0, policy_governance_1.readPolicyGovernanceConfig)(projectRoot);
         const auditIntegrity = (0, policy_audit_1.verifyPolicyAuditIntegrity)(projectRoot);
@@ -1589,7 +1742,7 @@ async function verifyCommand(options) {
                 console.log(chalk.dim('   Upgrade at: https://www.neurcode.com/dashboard/purchase-plan\n'));
             }
             else {
-                console.log(JSON.stringify({
+                emitVerifyJson({
                     grade: 'N/A',
                     score: 0,
                     verdict: 'INFO',
@@ -1604,8 +1757,13 @@ async function verifyCommand(options) {
                     mode: 'plan_enforced',
                     policyOnly: false,
                     tier: 'FREE',
+                    changeContract: changeContractSummary,
+                    ...(compiledPolicyMetadata ? { policyCompilation: compiledPolicyMetadata } : {}),
                     ...(governanceResult
-                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
+                            changeContract: changeContractSummary,
+                            compiledPolicy: compiledPolicyMetadata,
+                        })
                         : {}),
                     policyLock: {
                         enforced: policyLockEvaluation.enforced,
@@ -1623,7 +1781,7 @@ async function verifyCommand(options) {
                             eventCount: auditIntegrity.count,
                         },
                     },
-                }, null, 2));
+                });
             }
             process.exit(0);
         }
@@ -1729,22 +1887,146 @@ async function verifyCommand(options) {
                 })),
             })),
         }));
+        const changeContractEvaluation = changeContractRead.contract
+            ? (0, change_contract_1.evaluateChangeContract)(changeContractRead.contract, {
+                planId: finalPlanId,
+                changedFiles: changedFiles.map((file) => file.path),
+                policyLockFingerprint: (0, policy_packs_1.readPolicyLockFile)(projectRoot).lock?.effective.fingerprint || null,
+                compiledPolicyFingerprint: effectiveCompiledPolicy?.fingerprint || null,
+            })
+            : null;
+        if (changeContractEvaluation) {
+            changeContractSummary = {
+                path: changeContractRead.path,
+                exists: true,
+                enforced: enforceChangeContract,
+                valid: changeContractEvaluation.valid,
+                planId: changeContractRead.contract?.planId || null,
+                contractId: changeContractRead.contract?.contractId || null,
+                coverage: changeContractEvaluation.coverage,
+                violations: changeContractEvaluation.violations.map((item) => ({
+                    code: item.code,
+                    message: item.message,
+                    file: item.file,
+                    expected: item.expected,
+                    actual: item.actual,
+                })),
+            };
+            if (!changeContractEvaluation.valid && enforceChangeContract) {
+                const violations = changeContractEvaluation.violations.map((item) => ({
+                    file: item.file || '.neurcode/change-contract.json',
+                    rule: `change_contract:${item.code.toLowerCase()}`,
+                    severity: 'block',
+                    message: item.message,
+                }));
+                const message = `Change contract enforcement failed: ${changeContractEvaluation.violations
+                    .map((item) => item.message)
+                    .join('; ')}`;
+                if (options.json) {
+                    emitVerifyJson({
+                        grade: 'F',
+                        score: 0,
+                        verdict: 'FAIL',
+                        violations,
+                        adherenceScore: 0,
+                        bloatCount: 0,
+                        bloatFiles: [],
+                        plannedFilesModified: 0,
+                        totalPlannedFiles: 0,
+                        message,
+                        scopeGuardPassed: false,
+                        mode: 'plan_enforced',
+                        policyOnly: false,
+                        changeContract: changeContractSummary,
+                        ...(compiledPolicyMetadata ? { policyCompilation: compiledPolicyMetadata } : {}),
+                    });
+                }
+                else {
+                    console.log(chalk.red('\n⛔ Change contract enforcement failed'));
+                    changeContractEvaluation.violations.forEach((item) => {
+                        console.log(chalk.red(`   • ${item.message}`));
+                    });
+                    console.log(chalk.dim(`   Contract path: ${changeContractRead.path}`));
+                }
+                await recordVerificationIfRequested(options, config, {
+                    grade: 'F',
+                    violations,
+                    verifyResult: {
+                        adherenceScore: 0,
+                        verdict: 'FAIL',
+                        bloatCount: 0,
+                        bloatFiles: [],
+                        message,
+                    },
+                    projectId: projectId || undefined,
+                    jsonMode: Boolean(options.json),
+                    governance: governanceResult
+                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
+                            changeContract: changeContractSummary,
+                            compiledPolicy: compiledPolicyMetadata,
+                        })
+                        : undefined,
+                });
+                process.exit(2);
+            }
+            else if (!changeContractEvaluation.valid && !options.json) {
+                console.log(chalk.yellow('\n⚠️  Change contract drift detected (advisory mode)'));
+                changeContractEvaluation.violations.slice(0, 5).forEach((item) => {
+                    console.log(chalk.yellow(`   • ${item.message}`));
+                });
+                if (changeContractEvaluation.violations.length > 5) {
+                    console.log(chalk.dim(`   ... ${changeContractEvaluation.violations.length - 5} more violation(s)`));
+                }
+            }
+        }
         // Call verify API
         if (!options.json) {
             console.log(chalk.dim('   Sending to Neurcode API...\n'));
         }
         try {
-            // Extract original intent from plan for constraint checking
-            let intentConstraints;
+            let verifySource = 'api';
+            let verifyResult;
+            const deterministicPolicyRules = effectiveCompiledPolicy
+                ? [...effectiveCompiledPolicy.statements.policyRules]
+                : effectiveRules.customPolicies
+                    .map((policy) => policy.rule_text)
+                    .filter((ruleText) => typeof ruleText === 'string' && ruleText.trim().length > 0);
             try {
-                const planData = await client.getPlan(finalPlanId);
-                intentConstraints = planData.intent || undefined;
+                verifyResult = await client.verifyPlan(finalPlanId, diffStats, changedFiles, projectId, intentConstraintsForVerification, deterministicPolicyRules, 'api', compiledPolicyMetadata);
             }
-            catch {
-                // If we can't get plan, continue without constraints
+            catch (verifyApiError) {
+                if (planFilesForVerification.length === 0) {
+                    throw verifyApiError;
+                }
+                verifySource = 'local_fallback';
+                if (!options.json) {
+                    const fallbackReason = verifyApiError instanceof Error ? verifyApiError.message : String(verifyApiError);
+                    console.log(chalk.yellow('⚠️  Verify API unavailable, using local deterministic fallback.'));
+                    console.log(chalk.dim(`   Reason: ${fallbackReason}`));
+                }
+                const localEvaluation = (0, governance_runtime_1.evaluatePlanVerification)({
+                    planFiles: planFilesForVerification.map((path) => ({
+                        path,
+                        action: 'MODIFY',
+                    })),
+                    changedFiles,
+                    diffStats,
+                    intentConstraints: intentConstraintsForVerification,
+                    policyRules: deterministicPolicyRules,
+                    extraConstraintRules: hydratedCompiledPolicyRules.length > 0 ? hydratedCompiledPolicyRules : undefined,
+                });
+                verifyResult = {
+                    verificationId: `local-fallback-${Date.now()}`,
+                    adherenceScore: localEvaluation.adherenceScore,
+                    bloatCount: localEvaluation.bloatCount,
+                    bloatFiles: localEvaluation.bloatFiles,
+                    plannedFilesModified: localEvaluation.plannedFilesModified,
+                    totalPlannedFiles: localEvaluation.totalPlannedFiles,
+                    verdict: localEvaluation.verdict,
+                    diffSummary: localEvaluation.diffSummary,
+                    message: localEvaluation.message,
+                };
             }
-            // Call verifyPlan with intentConstraints
-            const verifyResult = await client.verifyPlan(finalPlanId, diffStats, changedFiles, projectId, intentConstraints);
             // Apply custom policy verdict: block from dashboard overrides API verdict
             const policyBlock = policyDecision === 'block' && policyViolations.length > 0;
             const governanceDecisionBlock = governanceResult?.governanceDecision?.decision === 'block';
@@ -1846,10 +2128,16 @@ async function verifyCommand(options) {
                     bloatFiles: filteredBloatFiles,
                     plannedFilesModified: verifyResult.plannedFilesModified,
                     totalPlannedFiles: verifyResult.totalPlannedFiles,
+                    verificationSource: verifySource,
                     mode: 'plan_enforced',
                     policyOnly: false,
+                    changeContract: changeContractSummary,
+                    ...(compiledPolicyMetadata ? { policyCompilation: compiledPolicyMetadata } : {}),
                     ...(governanceResult
-                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
+                            changeContract: changeContractSummary,
+                            compiledPolicy: compiledPolicyMetadata,
+                        })
                         : {}),
                     policyLock: {
                         enforced: policyLockEvaluation.enforced,
@@ -1871,7 +2159,7 @@ async function verifyCommand(options) {
                         }
                         : {}),
                 };
-                console.log(JSON.stringify(jsonOutput, null, 2));
+                emitVerifyJson(jsonOutput);
                 await recordVerificationIfRequested(options, config, {
                     grade,
                     violations: violations,
@@ -1881,11 +2169,16 @@ async function verifyCommand(options) {
                         bloatCount: filteredBloatFiles.length,
                         bloatFiles: filteredBloatFiles,
                         message: effectiveMessage,
+                        verificationSource: verifySource,
                     },
                     projectId: projectId || undefined,
                     jsonMode: true,
+                    verificationSource: verifySource,
                     governance: governanceResult
-                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
+                            changeContract: changeContractSummary,
+                            compiledPolicy: compiledPolicyMetadata,
+                        })
                         : undefined,
                 });
                 // Exit based on effective verdict (same logic as below)
@@ -1960,11 +2253,16 @@ async function verifyCommand(options) {
                     bloatCount: filteredBloatForReport.length,
                     bloatFiles: filteredBloatForReport,
                     message: effectiveMessage,
+                    verificationSource: verifySource,
                 },
                 projectId: projectId || undefined,
                 jsonMode: false,
+                verificationSource: verifySource,
                 governance: governanceResult
-                    ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                    ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
+                        changeContract: changeContractSummary,
+                        compiledPolicy: compiledPolicyMetadata,
+                    })
                     : undefined,
             });
             // Governance override: keep PASS only when scope guard passes and failure is due
@@ -2001,7 +2299,7 @@ async function verifyCommand(options) {
             recordVerifyEvent('FAIL', `verify_api_error=${error instanceof Error ? error.message : 'unknown'}`, changedFiles, finalPlanId);
             if (options.json) {
                 const errorMessage = error instanceof Error ? error.message : 'Unknown error';
-                console.log(JSON.stringify({
+                emitVerifyJson({
                     grade: 'F',
                     score: 0,
                     verdict: 'FAIL',
@@ -2013,7 +2311,7 @@ async function verifyCommand(options) {
                     totalPlannedFiles: 0,
                     message: `Error: ${errorMessage}`,
                     scopeGuardPassed: false,
-                }, null, 2));
+                });
             }
             else {
                 if (error instanceof Error) {
@@ -2048,6 +2346,14 @@ async function verifyCommand(options) {
                 totalPlannedFiles: 0,
                 message: `Unexpected error: ${errorMessage}`,
                 scopeGuardPassed: false,
+                scope: {
+                    scanRoot: process.cwd(),
+                    startDir: process.cwd(),
+                    gitRoot: null,
+                    linkedRepoOverrideUsed: false,
+                    linkedRepos: [],
+                    blockedOverride: null,
+                },
             }, null, 2));
         }
         else {
@@ -2212,7 +2518,7 @@ function buildCompactVerificationPayload(payload) {
 /**
  * Report verification results to Neurcode Cloud
  */
-async function reportVerification(grade, violations, verifyResult, apiKey, apiUrl, projectId, jsonMode, governance) {
+async function reportVerification(grade, violations, verifyResult, apiKey, apiUrl, projectId, jsonMode, governance, verificationSource) {
     try {
         const ciContext = collectCIContext();
         const payload = {
@@ -2229,6 +2535,7 @@ async function reportVerification(grade, violations, verifyResult, apiKey, apiUr
             workflowRunId: ciContext.workflowRunId,
             projectId,
             governance,
+            verificationSource: verificationSource || verifyResult.verificationSource || 'api',
         };
         const postPayload = async (requestPayload) => fetch(`${apiUrl}/api/v1/action/verifications`, {
             method: 'POST',
@@ -2271,7 +2578,7 @@ async function reportVerification(grade, violations, verifyResult, apiKey, apiUr
         }
     }
 }
-function buildGovernancePayload(governance, orgGovernanceSettings) {
+function buildGovernancePayload(governance, orgGovernanceSettings, options) {
     return {
         contextPolicy: governance.contextPolicy,
         blastRadius: governance.blastRadius,
@@ -2292,6 +2599,8 @@ function buildGovernancePayload(governance, orgGovernanceSettings) {
                 updatedAt: orgGovernanceSettings.updatedAt || null,
             }
             : null,
+        ...(options?.compiledPolicy ? { policyCompilation: options.compiledPolicy } : {}),
+        ...(options?.changeContract ? { changeContract: options.changeContract } : {}),
     };
 }
 function displayGovernanceInsights(governance, options = {}) {