@neurcode-ai/cli 0.9.34 → 0.9.36

package/dist/commands/verify.js

@@ -43,6 +43,7 @@ const child_process_1 = require("child_process");
 const git_1 = require("../utils/git");
 const diff_parser_1 = require("@neurcode-ai/diff-parser");
 const policy_engine_1 = require("@neurcode-ai/policy-engine");
+const governance_runtime_1 = require("@neurcode-ai/governance-runtime");
 const config_1 = require("../config");
 const api_client_1 = require("../api-client");
 const path_1 = require("path");
@@ -53,12 +54,15 @@ const box_1 = require("../utils/box");
 const ignore_1 = require("../utils/ignore");
 const project_root_1 = require("../utils/project-root");
 const brain_context_1 = require("../utils/brain-context");
+const scope_telemetry_1 = require("../utils/scope-telemetry");
 const policy_packs_1 = require("../utils/policy-packs");
 const custom_policy_rules_1 = require("../utils/custom-policy-rules");
 const policy_exceptions_1 = require("../utils/policy-exceptions");
 const policy_governance_1 = require("../utils/policy-governance");
 const policy_audit_1 = require("../utils/policy-audit");
 const governance_1 = require("../utils/governance");
+const policy_compiler_1 = require("../utils/policy-compiler");
+const change_contract_1 = require("../utils/change-contract");
 const policy_1 = require("@neurcode-ai/policy");
 // Import chalk with fallback
 let chalk;
@@ -80,6 +84,7 @@ catch {
         white: (str) => str,
     };
 }
+;
 /**
  * Check if a file path should be excluded from verification analysis
  * Excludes internal/system files that should not count towards plan adherence
@@ -234,6 +239,43 @@ async function buildEffectivePolicyRules(client, projectRoot, useDashboardPolici
         includeDashboardPolicies: useDashboardPolicies,
     };
 }
+function resolveCompiledPolicyMetadata(artifact, path) {
+    if (!artifact || !path) {
+        return null;
+    }
+    return {
+        fingerprint: artifact.fingerprint,
+        deterministicRuleCount: artifact.compilation.deterministicRuleCount,
+        unmatchedStatements: artifact.compilation.unmatchedStatements.length,
+        sourcePath: path,
+        policyLockFingerprint: artifact.source.policyLockFingerprint,
+    };
+}
+function buildCompiledPolicyFromEffectiveRules(input) {
+    const policyStatements = [
+        ...input.effectiveRules.customPolicies.map((policy) => policy.rule_text),
+    ];
+    return (0, policy_compiler_1.buildCompiledPolicyArtifact)({
+        includeDashboardPolicies: input.effectiveRules.includeDashboardPolicies,
+        policyLockPath: input.policyLockEvaluation.lockPath,
+        policyLockFingerprint: input.policyLockEvaluation.lockPresent
+            ? (0, policy_packs_1.readPolicyLockFile)(input.projectRoot).lock?.effective.fingerprint || null
+            : null,
+        policyPack: input.effectiveRules.policyPack
+            ? {
+                id: input.effectiveRules.policyPack.packId,
+                name: input.effectiveRules.policyPack.packName,
+                version: input.effectiveRules.policyPack.version,
+            }
+            : null,
+        defaultRuleCount: (0, policy_engine_1.createDefaultPolicy)().rules.length,
+        policyPackRuleCount: input.effectiveRules.policyPackRules.length,
+        customRuleCount: input.effectiveRules.customRules.length,
+        effectiveRuleCount: input.effectiveRules.allRules.length,
+        intentConstraints: input.intentConstraints,
+        policyRules: policyStatements,
+    });
+}
 const POLICY_AUDIT_FILE = 'neurcode.policy.audit.log.jsonl';
 function isEnabledFlag(value) {
     if (!value)
@@ -321,8 +363,14 @@ function resolvePolicyDecisionFromViolations(violations) {
 }
 function explainExceptionEligibilityReason(reason) {
     switch (reason) {
+        case 'reason_required':
+            return 'exception reason does not meet governance minimum length';
+        case 'duration_exceeds_max':
+            return 'exception expiry window exceeds governance maximum duration';
         case 'approval_required':
             return 'exception exists but approvals are required';
+        case 'critical_approvals_required':
+            return 'critical rule exception requires additional independent approvals';
         case 'insufficient_approvals':
             return 'exception exists but approval threshold is not met';
         case 'self_approval_only':
@@ -354,13 +402,30 @@ async function recordVerificationIfRequested(options, config, payload) {
         }
         return;
     }
-    await reportVerification(payload.grade, payload.violations, payload.verifyResult, config.apiKey, config.apiUrl || 'https://api.neurcode.com', payload.projectId, payload.jsonMode, payload.governance);
+    await reportVerification(payload.grade, payload.violations, payload.verifyResult, config.apiKey, config.apiUrl || 'https://api.neurcode.com', payload.projectId, payload.jsonMode, payload.governance, payload.verificationSource);
 }
 /**
  * Execute policy-only verification (General Governance mode)
  * Returns the exit code to use
  */
-async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRoot, config, client, source, projectId, orgGovernanceSettings, aiLogSigningKey, aiLogSigningKeyId, aiLogSigningKeys, aiLogSigner) {
+async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRoot, config, client, source, scopeTelemetry, projectId, orgGovernanceSettings, aiLogSigningKey, aiLogSigningKeyId, aiLogSigningKeys, aiLogSigner, compiledPolicyMetadata, changeContractSummary) {
+    const emitPolicyOnlyJson = (payload) => {
+        console.log(JSON.stringify({
+            ...payload,
+            ...(compiledPolicyMetadata ? { policyCompilation: compiledPolicyMetadata } : {}),
+            changeContract: changeContractSummary,
+            scope: scopeTelemetry,
+        }, null, 2));
+    };
+    const policyOnlyVerificationSource = 'policy_only';
+    const recordPolicyOnlyVerification = async (payload) => recordVerificationIfRequested(options, config, {
+        ...payload,
+        verificationSource: policyOnlyVerificationSource,
+        verifyResult: {
+            ...payload.verifyResult,
+            verificationSource: policyOnlyVerificationSource,
+        },
+    });
     if (!options.json) {
         console.log(chalk.cyan('🛡️  General Governance mode (policy only, no plan linked)\n'));
     }
@@ -376,13 +441,16 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
         signingKeys: aiLogSigningKeys,
         signer: aiLogSigner,
     });
-    const governancePayload = buildGovernancePayload(governanceAnalysis, orgGovernanceSettings);
+    const governancePayload = buildGovernancePayload(governanceAnalysis, orgGovernanceSettings, {
+        compiledPolicy: compiledPolicyMetadata,
+        changeContract: changeContractSummary,
+    });
     const contextPolicyViolations = governanceAnalysis.contextPolicy.violations.filter((item) => !ignoreFilter(item.file));
     const signedLogsRequired = isSignedAiLogsRequired(orgGovernanceSettings);
     if (signedLogsRequired && !governanceAnalysis.aiChangeLogIntegrity.valid) {
         const message = `AI change-log integrity check failed: ${governanceAnalysis.aiChangeLogIntegrity.issues.join('; ') || 'unknown issue'}`;
         if (options.json) {
-            console.log(JSON.stringify({
+            emitPolicyOnlyJson({
                 grade: 'F',
                 score: 0,
                 verdict: 'FAIL',
@@ -405,13 +473,13 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
                 policyOnly: true,
                 policyOnlySource: source,
                 ...governancePayload,
-            }, null, 2));
+            });
         }
         else {
             console.log(chalk.red('❌ AI change-log integrity validation failed (policy-only mode).'));
             console.log(chalk.red(`   ${message}`));
         }
-        await recordVerificationIfRequested(options, config, {
+        await recordPolicyOnlyVerification({
             grade: 'F',
             violations: [
                 {
@@ -439,7 +507,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
             || 'Governance decision matrix returned BLOCK.';
         const reasonCodes = governanceAnalysis.governanceDecision.reasonCodes || [];
         if (options.json) {
-            console.log(JSON.stringify({
+            emitPolicyOnlyJson({
                 grade: 'F',
                 score: 0,
                 verdict: 'FAIL',
@@ -462,7 +530,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
                 policyOnly: true,
                 policyOnlySource: source,
                 ...governancePayload,
-            }, null, 2));
+            });
         }
         else {
             console.log(chalk.red('❌ Governance decision blocked this change set (policy-only mode).'));
@@ -471,7 +539,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
             }
             console.log(chalk.red(`   ${message}`));
         }
-        await recordVerificationIfRequested(options, config, {
+        await recordPolicyOnlyVerification({
             grade: 'F',
             violations: [
                 {
@@ -503,7 +571,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
             message: item.reason,
         }));
         if (options.json) {
-            console.log(JSON.stringify({
+            emitPolicyOnlyJson({
                 grade: 'F',
                 score: 0,
                 verdict: 'FAIL',
@@ -519,7 +587,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
                 policyOnly: true,
                 policyOnlySource: source,
                 ...governancePayload,
-            }, null, 2));
+            });
         }
         else {
             console.log(chalk.red('❌ Context policy violation detected (policy-only mode).'));
@@ -528,7 +596,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
             });
             console.log(chalk.dim(`\n${message}`));
         }
-        await recordVerificationIfRequested(options, config, {
+        await recordPolicyOnlyVerification({
             grade: 'F',
             violations: contextPolicyViolationItems,
             verifyResult: {
@@ -617,7 +685,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
         const message = policyLockMismatchMessage(policyLockEvaluation.mismatches);
         const lockViolationItems = toPolicyLockViolations(policyLockEvaluation.mismatches);
         if (options.json) {
-            console.log(JSON.stringify({
+            emitPolicyOnlyJson({
                 grade: 'F',
                 score: 0,
                 verdict: 'FAIL',
@@ -639,7 +707,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
                     path: policyLockEvaluation.lockPath,
                     mismatches: policyLockEvaluation.mismatches,
                 },
-            }, null, 2));
+            });
         }
         else {
             console.log(chalk.red('❌ Policy lock baseline mismatch.'));
@@ -649,7 +717,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
             });
             console.log(chalk.dim('\n   If drift is intentional, regenerate baseline with `neurcode policy lock`.\n'));
         }
-        await recordVerificationIfRequested(options, config, {
+        await recordPolicyOnlyVerification({
             grade: 'F',
             violations: lockViolationItems,
             verifyResult: {
@@ -687,6 +755,11 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
         minApprovals: governance.exceptionApprovals.minApprovals,
         disallowSelfApproval: governance.exceptionApprovals.disallowSelfApproval,
         allowedApprovers: governance.exceptionApprovals.allowedApprovers,
+        requireReason: governance.exceptionApprovals.requireReason,
+        minReasonLength: governance.exceptionApprovals.minReasonLength,
+        maxExpiryDays: governance.exceptionApprovals.maxExpiryDays,
+        criticalRulePatterns: governance.exceptionApprovals.criticalRulePatterns,
+        criticalMinApprovals: governance.exceptionApprovals.criticalMinApprovals,
     });
     const suppressedViolations = exceptionDecision.suppressedViolations.filter((item) => !ignoreFilter(item.file));
     const blockedViolations = exceptionDecision.blockedViolations
@@ -695,7 +768,10 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
         file: item.file,
         rule: item.rule,
         severity: 'block',
-        message: `Exception ${item.exceptionId} cannot be applied: ${explainExceptionEligibilityReason(item.eligibilityReason)}`,
+        message: `Exception ${item.exceptionId} cannot be applied: ${explainExceptionEligibilityReason(item.eligibilityReason)}` +
+            (item.requiredApprovals > 0
+                ? ` (approvals ${item.effectiveApprovals}/${item.requiredApprovals}${item.critical ? ', critical rule gate' : ''})`
+                : ''),
         ...(item.line != null ? { line: item.line } : {}),
     }));
     policyViolations = [
@@ -763,7 +839,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
         },
     };
     if (options.json) {
-        console.log(JSON.stringify({
+        emitPolicyOnlyJson({
             grade,
             score,
             verdict: effectiveVerdict,
@@ -797,7 +873,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
                     },
                 }
                 : {}),
-        }, null, 2));
+        });
     }
     else {
         if (effectiveVerdict === 'PASS') {
@@ -821,7 +897,7 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
         displayGovernanceInsights(governanceAnalysis, { explain: options.explain });
         console.log(chalk.dim(`\n${message}`));
     }
-    await recordVerificationIfRequested(options, config, {
+    await recordPolicyOnlyVerification({
         grade,
         violations: violationsOutput,
         verifyResult: {
@@ -839,7 +915,108 @@ async function executePolicyOnlyMode(options, diffFiles, ignoreFilter, projectRo
 }
 async function verifyCommand(options) {
     try {
-        const projectRoot = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
+        const rootResolution = (0, project_root_1.resolveNeurcodeProjectRootWithTrace)(process.cwd());
+        const projectRoot = rootResolution.projectRoot;
+        const scopeTelemetry = (0, scope_telemetry_1.buildScopeTelemetryPayload)(rootResolution);
+        const emitVerifyJson = (payload) => {
+            const jsonPayload = {
+                ...payload,
+                scope: scopeTelemetry,
+            };
+            console.log(JSON.stringify(jsonPayload, null, 2));
+        };
+        const enforceChangeContract = options.enforceChangeContract === true ||
+            isEnabledFlag(process.env.NEURCODE_VERIFY_ENFORCE_CHANGE_CONTRACT);
+        const strictArtifactMode = options.strictArtifacts === true ||
+            isEnabledFlag(process.env.NEURCODE_VERIFY_STRICT_ARTIFACTS) ||
+            isEnabledFlag(process.env.NEURCODE_ENTERPRISE_MODE);
+        const changeContractRead = (0, change_contract_1.readChangeContract)(projectRoot, options.changeContract);
+        const compiledPolicyRead = (0, policy_compiler_1.readCompiledPolicyArtifact)(projectRoot, options.compiledPolicy);
+        let compiledPolicyMetadata = resolveCompiledPolicyMetadata(compiledPolicyRead.artifact, compiledPolicyRead.exists ? compiledPolicyRead.path : null);
+        let changeContractSummary = {
+            path: changeContractRead.path,
+            exists: changeContractRead.exists,
+            enforced: enforceChangeContract,
+            valid: changeContractRead.contract ? null : changeContractRead.exists ? false : null,
+            planId: changeContractRead.contract?.planId || null,
+            contractId: changeContractRead.contract?.contractId || null,
+            violations: changeContractRead.error
+                ? [
+                    {
+                        code: 'CHANGE_CONTRACT_PARSE_ERROR',
+                        message: changeContractRead.error,
+                    },
+                ]
+                : [],
+        };
+        if (strictArtifactMode) {
+            const strictErrors = [];
+            if (!compiledPolicyRead.artifact) {
+                strictErrors.push(compiledPolicyRead.error
+                    ? `Compiled policy artifact invalid (${compiledPolicyRead.error})`
+                    : `Compiled policy artifact missing (${compiledPolicyRead.path})`);
+            }
+            if (!changeContractRead.contract) {
+                strictErrors.push(changeContractRead.error
+                    ? `Change contract artifact invalid (${changeContractRead.error})`
+                    : `Change contract artifact missing (${changeContractRead.path})`);
+            }
+            if (strictErrors.length > 0) {
+                const message = `Strict artifact mode requires deterministic compiled-policy + change-contract artifacts.\n- ${strictErrors.join('\n- ')}`;
+                if (options.json) {
+                    emitVerifyJson({
+                        grade: 'F',
+                        score: 0,
+                        verdict: 'FAIL',
+                        violations: strictErrors.map((entry) => ({
+                            file: entry.toLowerCase().includes('compiled policy') ? compiledPolicyRead.path : changeContractRead.path,
+                            rule: 'deterministic_artifacts_required',
+                            severity: 'block',
+                            message: entry,
+                        })),
+                        adherenceScore: 0,
+                        bloatCount: 0,
+                        bloatFiles: [],
+                        plannedFilesModified: 0,
+                        totalPlannedFiles: 0,
+                        message,
+                        scopeGuardPassed: false,
+                        mode: 'strict_artifacts_required',
+                        policyOnly: options.policyOnly === true,
+                        changeContract: changeContractSummary,
+                        ...(compiledPolicyMetadata ? { policyCompilation: compiledPolicyMetadata } : {}),
+                    });
+                }
+                else {
+                    (0, scope_telemetry_1.printScopeTelemetry)(chalk, scopeTelemetry, {
+                        includeBlockedWarning: true,
+                    });
+                    console.log(chalk.red('\n⛔ Deterministic Artifact Requirements Failed'));
+                    strictErrors.forEach((entry) => {
+                        console.log(chalk.red(`   • ${entry}`));
+                    });
+                    console.log(chalk.dim('\nSet --compiled-policy and --change-contract with valid artifacts before verify.\n'));
+                }
+                process.exit(2);
+            }
+        }
+        if (!options.json) {
+            (0, scope_telemetry_1.printScopeTelemetry)(chalk, scopeTelemetry, {
+                includeBlockedWarning: true,
+            });
+            if (compiledPolicyRead.error) {
+                console.log(chalk.yellow(`   Compiled policy artifact unavailable (${compiledPolicyRead.error}); falling back to runtime compilation`));
+            }
+            else if (compiledPolicyRead.artifact) {
+                console.log(chalk.dim(`   Compiled policy loaded: ${compiledPolicyRead.path} (${compiledPolicyRead.artifact.compilation.deterministicRuleCount} deterministic rules)`));
+            }
+            if (changeContractRead.error) {
+                console.log(chalk.yellow(`   Change contract unavailable (${changeContractRead.error})`));
+            }
+            else if (changeContractRead.contract) {
+                console.log(chalk.dim(`   Change contract loaded: ${changeContractRead.path}`));
+            }
+        }
         // Load configuration
         const config = (0, config_1.loadConfig)();
         // 🛑 FORCE PRIORITY: Env Var > Config
@@ -903,6 +1080,9 @@ async function verifyCommand(options) {
                         requireSignedAiLogs: remoteSettings.requireSignedAiLogs === true,
                         requireManualApproval: remoteSettings.requireManualApproval !== false,
                         minimumManualApprovals: Math.max(1, Math.min(5, Math.floor(remoteSettings.minimumManualApprovals || 1))),
+                        ...(remoteSettings.policyGovernance && typeof remoteSettings.policyGovernance === 'object'
+                            ? { policyGovernance: remoteSettings.policyGovernance }
+                            : {}),
                         updatedAt: remoteSettings.updatedAt,
                     };
                 }
@@ -941,7 +1121,7 @@ async function verifyCommand(options) {
             const message = 'Signed AI change-logs are required but no signing key is configured. Set NEURCODE_GOVERNANCE_SIGNING_KEY or NEURCODE_GOVERNANCE_SIGNING_KEYS.';
             recordVerifyEvent('FAIL', 'missing_signing_key_material');
             if (options.json) {
-                console.log(JSON.stringify({
+                emitVerifyJson({
                     grade: 'F',
                     score: 0,
                     verdict: 'FAIL',
@@ -962,7 +1142,7 @@ async function verifyCommand(options) {
                     scopeGuardPassed: false,
                     mode: 'plan_enforced',
                     policyOnly: false,
-                }, null, 2));
+                });
             }
             else {
                 console.log(chalk.red('\n⛔ Governance Signing Key Missing'));
@@ -1021,7 +1201,7 @@ async function verifyCommand(options) {
                 console.log(chalk.dim('   Make sure you have staged or unstaged changes to verify'));
             }
             else {
-                console.log(JSON.stringify({
+                emitVerifyJson({
                     grade: 'F',
                     score: 0,
                     verdict: 'FAIL',
@@ -1033,7 +1213,7 @@ async function verifyCommand(options) {
                     totalPlannedFiles: 0,
                     message: 'No changes detected',
                     scopeGuardPassed: false,
-                }, null, 2));
+                });
             }
             recordVerifyEvent('NO_CHANGES', 'diff=empty');
             process.exit(0);
@@ -1064,7 +1244,7 @@ async function verifyCommand(options) {
                 console.log(chalk.yellow('⚠️  No file changes detected in diff'));
             }
             else {
-                console.log(JSON.stringify({
+                emitVerifyJson({
                     grade: 'F',
                     score: 0,
                     verdict: 'FAIL',
@@ -1076,7 +1256,7 @@ async function verifyCommand(options) {
                     totalPlannedFiles: 0,
                     message: 'No file changes detected in diff',
                     scopeGuardPassed: false,
-                }, null, 2));
+                });
             }
             recordVerifyEvent('NO_CHANGES', 'diff_files=0');
             process.exit(0);
@@ -1106,7 +1286,10 @@ async function verifyCommand(options) {
                 signingKeys: aiLogSigningKeys,
                 signer: aiLogSigner,
             });
-            const baselineGovernancePayload = buildGovernancePayload(baselineGovernance, orgGovernanceSettings);
+            const baselineGovernancePayload = buildGovernancePayload(baselineGovernance, orgGovernanceSettings, {
+                changeContract: changeContractSummary,
+                compiledPolicy: compiledPolicyMetadata,
+            });
             const message = `Context access policy violation: ${baselineContextViolations.map((item) => item.file).join(', ')}`;
             const baselineContextViolationItems = baselineContextViolations.map((item) => ({
                 file: item.file,
@@ -1116,7 +1299,7 @@ async function verifyCommand(options) {
             }));
             recordVerifyEvent('FAIL', `context_policy_violations=${baselineContextViolations.length}`, diffFiles.map((f) => f.path));
             if (options.json) {
-                console.log(JSON.stringify({
+                emitVerifyJson({
                     grade: 'F',
                     score: 0,
                     verdict: 'FAIL',
@@ -1131,7 +1314,7 @@ async function verifyCommand(options) {
                     ...baselineGovernancePayload,
                     mode: 'policy_violation',
                     policyOnly: false,
-                }, null, 2));
+                });
             }
             else {
                 console.log(chalk.red('\n⛔ Context Policy Violation'));
@@ -1163,7 +1346,7 @@ async function verifyCommand(options) {
             console.log(chalk.dim(`   ${summary.totalAdded} lines added, ${summary.totalRemoved} lines removed\n`));
         }
         const runPolicyOnlyModeAndExit = async (source) => {
-            const exitCode = await executePolicyOnlyMode(options, diffFiles, shouldIgnore, projectRoot, config, client, source, projectId || undefined, orgGovernanceSettings, aiLogSigningKey, aiLogSigningKeyId, aiLogSigningKeys, aiLogSigner);
+            const exitCode = await executePolicyOnlyMode(options, diffFiles, shouldIgnore, projectRoot, config, client, source, scopeTelemetry, projectId || undefined, orgGovernanceSettings, aiLogSigningKey, aiLogSigningKeyId, aiLogSigningKeys, aiLogSigner, compiledPolicyMetadata, changeContractSummary);
             const changedFiles = diffFiles.map((f) => f.path);
             const verdict = exitCode === 2 ? 'FAIL' : exitCode === 1 ? 'WARN' : 'PASS';
             recordVerifyEvent(verdict, `policy_only_source=${source};exit=${exitCode}`, changedFiles);
@@ -1215,7 +1398,7 @@ async function verifyCommand(options) {
                 const message = 'Plan ID is required in strict mode. Run "neurcode plan" first or pass --plan-id.';
                 recordVerifyEvent('FAIL', 'missing_plan_id;require_plan=true', changedFiles);
                 if (options.json) {
-                    console.log(JSON.stringify({
+                    emitVerifyJson({
                         grade: 'F',
                         score: 0,
                         verdict: 'FAIL',
@@ -1229,7 +1412,7 @@ async function verifyCommand(options) {
                         scopeGuardPassed: false,
                         mode: 'plan_required',
                         policyOnly: false,
-                    }, null, 2));
+                    });
                 }
                 else {
                     console.log(chalk.red('❌ Plan ID is required in strict mode.'));
@@ -1269,6 +1452,8 @@ async function verifyCommand(options) {
         // Track if scope guard passed - this takes priority over AI grading
         let scopeGuardPassed = false;
         let governanceResult = null;
+        let planFilesForVerification = [];
+        let intentConstraintsForVerification;
         try {
             // Step A: Get Modified Files (already have from diffFiles)
             const modifiedFiles = diffFiles.map(f => f.path);
@@ -1285,6 +1470,8 @@ async function verifyCommand(options) {
             const planFiles = planData.content.files
                 .filter(f => f.action === 'CREATE' || f.action === 'MODIFY')
                 .map(f => f.path);
+            planFilesForVerification = [...planFiles];
+            intentConstraintsForVerification = originalIntent || undefined;
             const planDependencies = Array.isArray(planData.content.dependencies)
                 ? planData.content.dependencies.filter((item) => typeof item === 'string')
                 : [];
@@ -1371,11 +1558,14 @@ async function verifyCommand(options) {
                         mode: 'plan_enforced',
                         policyOnly: false,
                         ...(governanceResult
-                            ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                            ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
+                                changeContract: changeContractSummary,
+                                compiledPolicy: compiledPolicyMetadata,
+                            })
                             : {}),
                     };
                     // CRITICAL: Print JSON first, then exit
-                    console.log(JSON.stringify(jsonOutput, null, 2));
+                    emitVerifyJson(jsonOutput);
                     await recordVerificationIfRequested(options, config, {
                         grade: 'F',
                         violations: scopeViolationItems,
@@ -1389,7 +1579,10 @@ async function verifyCommand(options) {
                         projectId: projectId || undefined,
                         jsonMode: true,
                         governance: governanceResult
-                            ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                            ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
+                                changeContract: changeContractSummary,
+                                compiledPolicy: compiledPolicyMetadata,
+                            })
                             : undefined,
                     });
                     process.exit(1);
@@ -1425,7 +1618,10 @@ async function verifyCommand(options) {
                         projectId: projectId || undefined,
                         jsonMode: false,
                         governance: governanceResult
-                            ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                            ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
+                                changeContract: changeContractSummary,
+                                compiledPolicy: compiledPolicyMetadata,
+                            })
                             : undefined,
                     });
                     process.exit(1);
@@ -1532,8 +1728,13 @@ async function verifyCommand(options) {
                         scopeGuardPassed,
                         mode: 'plan_enforced',
                         policyOnly: false,
+                        changeContract: changeContractSummary,
+                        ...(compiledPolicyMetadata ? { policyCompilation: compiledPolicyMetadata } : {}),
                         ...(governanceResult
-                            ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                            ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
+                                changeContract: changeContractSummary,
+                                compiledPolicy: compiledPolicyMetadata,
+                            })
                             : {}),
                         policyLock: {
                             enforced: true,
@@ -1564,14 +1765,41 @@ async function verifyCommand(options) {
                     projectId: projectId || undefined,
                     jsonMode: Boolean(options.json),
                     governance: governanceResult
-                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
+                            changeContract: changeContractSummary,
+                            compiledPolicy: compiledPolicyMetadata,
+                        })
                         : undefined,
                 });
                 process.exit(2);
             }
         }
+        let effectiveCompiledPolicy = compiledPolicyRead.artifact;
+        if (!effectiveCompiledPolicy) {
+            effectiveCompiledPolicy = buildCompiledPolicyFromEffectiveRules({
+                projectRoot,
+                policyLockEvaluation,
+                effectiveRules,
+                intentConstraints: intentConstraintsForVerification,
+            });
+            compiledPolicyMetadata = resolveCompiledPolicyMetadata(effectiveCompiledPolicy, (0, policy_compiler_1.resolveCompiledPolicyPath)(projectRoot, options.compiledPolicy));
+        }
+        const hydratedCompiledPolicyRules = effectiveCompiledPolicy
+            ? (0, policy_compiler_1.hydrateCompiledPolicyRules)(effectiveCompiledPolicy)
+            : [];
+        if (effectiveCompiledPolicy?.source.policyLockFingerprint &&
+            policyLockEvaluation.lockPresent &&
+            effectiveCompiledPolicy.source.policyLockFingerprint !== (0, policy_packs_1.readPolicyLockFile)(projectRoot).lock?.effective.fingerprint) {
+            if (!options.json) {
+                console.log(chalk.yellow('   Compiled policy lock fingerprint differs from current lock; runtime checks will continue with latest lock state'));
+            }
+        }
         // Check user tier - Policy Compliance and A-F Grading are PRO features
-        const governance = (0, policy_governance_1.readPolicyGovernanceConfig)(projectRoot);
+        const localPolicyGovernance = (0, policy_governance_1.readPolicyGovernanceConfig)(projectRoot);
+        const governance = (0, policy_governance_1.mergePolicyGovernanceWithOrgOverrides)(localPolicyGovernance, orgGovernanceSettings?.policyGovernance);
+        if (!options.json && orgGovernanceSettings?.policyGovernance) {
+            console.log(chalk.dim('   Org policy governance controls active: local config merged with org-level enforcement floor'));
+        }
         const auditIntegrity = (0, policy_audit_1.verifyPolicyAuditIntegrity)(projectRoot);
         const auditIntegrityStatus = resolveAuditIntegrityStatus(governance.audit.requireIntegrity, auditIntegrity);
         const { getUserTier } = await Promise.resolve().then(() => __importStar(require('../utils/tier')));
@@ -1589,7 +1817,7 @@ async function verifyCommand(options) {
                 console.log(chalk.dim('   Upgrade at: https://www.neurcode.com/dashboard/purchase-plan\n'));
             }
             else {
-                console.log(JSON.stringify({
+                emitVerifyJson({
                     grade: 'N/A',
                     score: 0,
                     verdict: 'INFO',
@@ -1604,8 +1832,13 @@ async function verifyCommand(options) {
                     mode: 'plan_enforced',
                     policyOnly: false,
                     tier: 'FREE',
+                    changeContract: changeContractSummary,
+                    ...(compiledPolicyMetadata ? { policyCompilation: compiledPolicyMetadata } : {}),
                     ...(governanceResult
-                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
+                            changeContract: changeContractSummary,
+                            compiledPolicy: compiledPolicyMetadata,
+                        })
                         : {}),
                     policyLock: {
                         enforced: policyLockEvaluation.enforced,
@@ -1623,7 +1856,7 @@ async function verifyCommand(options) {
                             eventCount: auditIntegrity.count,
                         },
                     },
-                }, null, 2));
+                });
             }
             process.exit(0);
         }
@@ -1638,6 +1871,11 @@ async function verifyCommand(options) {
             minApprovals: governance.exceptionApprovals.minApprovals,
             disallowSelfApproval: governance.exceptionApprovals.disallowSelfApproval,
             allowedApprovers: governance.exceptionApprovals.allowedApprovers,
+            requireReason: governance.exceptionApprovals.requireReason,
+            minReasonLength: governance.exceptionApprovals.minReasonLength,
+            maxExpiryDays: governance.exceptionApprovals.maxExpiryDays,
+            criticalRulePatterns: governance.exceptionApprovals.criticalRulePatterns,
+            criticalMinApprovals: governance.exceptionApprovals.criticalMinApprovals,
         });
         const suppressedPolicyViolations = exceptionDecision.suppressedViolations.filter((item) => !shouldIgnore(item.file));
         const blockedPolicyViolations = exceptionDecision.blockedViolations
@@ -1646,7 +1884,10 @@ async function verifyCommand(options) {
             file: item.file,
             rule: item.rule,
             severity: 'block',
-            message: `Exception ${item.exceptionId} cannot be applied: ${explainExceptionEligibilityReason(item.eligibilityReason)}`,
+            message: `Exception ${item.exceptionId} cannot be applied: ${explainExceptionEligibilityReason(item.eligibilityReason)}` +
+                (item.requiredApprovals > 0
+                    ? ` (approvals ${item.effectiveApprovals}/${item.requiredApprovals}${item.critical ? ', critical rule gate' : ''})`
+                    : ''),
             ...(item.line != null ? { line: item.line } : {}),
         }));
         policyViolations = [
@@ -1729,22 +1970,146 @@ async function verifyCommand(options) {
                 })),
             })),
         }));
+        const changeContractEvaluation = changeContractRead.contract
+            ? (0, change_contract_1.evaluateChangeContract)(changeContractRead.contract, {
+                planId: finalPlanId,
+                changedFiles: changedFiles.map((file) => file.path),
+                policyLockFingerprint: (0, policy_packs_1.readPolicyLockFile)(projectRoot).lock?.effective.fingerprint || null,
+                compiledPolicyFingerprint: effectiveCompiledPolicy?.fingerprint || null,
+            })
+            : null;
+        if (changeContractEvaluation) {
+            changeContractSummary = {
+                path: changeContractRead.path,
+                exists: true,
+                enforced: enforceChangeContract,
+                valid: changeContractEvaluation.valid,
+                planId: changeContractRead.contract?.planId || null,
+                contractId: changeContractRead.contract?.contractId || null,
+                coverage: changeContractEvaluation.coverage,
+                violations: changeContractEvaluation.violations.map((item) => ({
+                    code: item.code,
+                    message: item.message,
+                    file: item.file,
+                    expected: item.expected,
+                    actual: item.actual,
+                })),
+            };
+            if (!changeContractEvaluation.valid && enforceChangeContract) {
+                const violations = changeContractEvaluation.violations.map((item) => ({
+                    file: item.file || '.neurcode/change-contract.json',
+                    rule: `change_contract:${item.code.toLowerCase()}`,
+                    severity: 'block',
+                    message: item.message,
+                }));
+                const message = `Change contract enforcement failed: ${changeContractEvaluation.violations
+                    .map((item) => item.message)
+                    .join('; ')}`;
+                if (options.json) {
+                    emitVerifyJson({
+                        grade: 'F',
+                        score: 0,
+                        verdict: 'FAIL',
+                        violations,
+                        adherenceScore: 0,
+                        bloatCount: 0,
+                        bloatFiles: [],
+                        plannedFilesModified: 0,
+                        totalPlannedFiles: 0,
+                        message,
+                        scopeGuardPassed: false,
+                        mode: 'plan_enforced',
+                        policyOnly: false,
+                        changeContract: changeContractSummary,
+                        ...(compiledPolicyMetadata ? { policyCompilation: compiledPolicyMetadata } : {}),
+                    });
+                }
+                else {
+                    console.log(chalk.red('\n⛔ Change contract enforcement failed'));
+                    changeContractEvaluation.violations.forEach((item) => {
+                        console.log(chalk.red(`   • ${item.message}`));
+                    });
+                    console.log(chalk.dim(`   Contract path: ${changeContractRead.path}`));
+                }
+                await recordVerificationIfRequested(options, config, {
+                    grade: 'F',
+                    violations,
+                    verifyResult: {
+                        adherenceScore: 0,
+                        verdict: 'FAIL',
+                        bloatCount: 0,
+                        bloatFiles: [],
+                        message,
+                    },
+                    projectId: projectId || undefined,
+                    jsonMode: Boolean(options.json),
+                    governance: governanceResult
+                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
+                            changeContract: changeContractSummary,
+                            compiledPolicy: compiledPolicyMetadata,
+                        })
+                        : undefined,
+                });
+                process.exit(2);
+            }
+            else if (!changeContractEvaluation.valid && !options.json) {
+                console.log(chalk.yellow('\n⚠️  Change contract drift detected (advisory mode)'));
+                changeContractEvaluation.violations.slice(0, 5).forEach((item) => {
+                    console.log(chalk.yellow(`   • ${item.message}`));
+                });
+                if (changeContractEvaluation.violations.length > 5) {
+                    console.log(chalk.dim(`   ... ${changeContractEvaluation.violations.length - 5} more violation(s)`));
+                }
+            }
+        }
         // Call verify API
         if (!options.json) {
             console.log(chalk.dim('   Sending to Neurcode API...\n'));
         }
         try {
-            // Extract original intent from plan for constraint checking
-            let intentConstraints;
+            let verifySource = 'api';
+            let verifyResult;
+            const deterministicPolicyRules = effectiveCompiledPolicy
+                ? [...effectiveCompiledPolicy.statements.policyRules]
+                : effectiveRules.customPolicies
+                    .map((policy) => policy.rule_text)
+                    .filter((ruleText) => typeof ruleText === 'string' && ruleText.trim().length > 0);
             try {
-                const planData = await client.getPlan(finalPlanId);
-                intentConstraints = planData.intent || undefined;
+                verifyResult = await client.verifyPlan(finalPlanId, diffStats, changedFiles, projectId, intentConstraintsForVerification, deterministicPolicyRules, 'api', compiledPolicyMetadata);
             }
-            catch {
-                // If we can't get plan, continue without constraints
+            catch (verifyApiError) {
+                if (planFilesForVerification.length === 0) {
+                    throw verifyApiError;
+                }
+                verifySource = 'local_fallback';
+                if (!options.json) {
+                    const fallbackReason = verifyApiError instanceof Error ? verifyApiError.message : String(verifyApiError);
+                    console.log(chalk.yellow('⚠️  Verify API unavailable, using local deterministic fallback.'));
+                    console.log(chalk.dim(`   Reason: ${fallbackReason}`));
+                }
+                const localEvaluation = (0, governance_runtime_1.evaluatePlanVerification)({
+                    planFiles: planFilesForVerification.map((path) => ({
+                        path,
+                        action: 'MODIFY',
+                    })),
+                    changedFiles,
+                    diffStats,
+                    intentConstraints: intentConstraintsForVerification,
+                    policyRules: deterministicPolicyRules,
+                    extraConstraintRules: hydratedCompiledPolicyRules.length > 0 ? hydratedCompiledPolicyRules : undefined,
+                });
+                verifyResult = {
+                    verificationId: `local-fallback-${Date.now()}`,
+                    adherenceScore: localEvaluation.adherenceScore,
+                    bloatCount: localEvaluation.bloatCount,
+                    bloatFiles: localEvaluation.bloatFiles,
+                    plannedFilesModified: localEvaluation.plannedFilesModified,
+                    totalPlannedFiles: localEvaluation.totalPlannedFiles,
+                    verdict: localEvaluation.verdict,
+                    diffSummary: localEvaluation.diffSummary,
+                    message: localEvaluation.message,
+                };
             }
-            // Call verifyPlan with intentConstraints
-            const verifyResult = await client.verifyPlan(finalPlanId, diffStats, changedFiles, projectId, intentConstraints);
             // Apply custom policy verdict: block from dashboard overrides API verdict
             const policyBlock = policyDecision === 'block' && policyViolations.length > 0;
             const governanceDecisionBlock = governanceResult?.governanceDecision?.decision === 'block';
@@ -1846,10 +2211,16 @@ async function verifyCommand(options) {
                     bloatFiles: filteredBloatFiles,
                     plannedFilesModified: verifyResult.plannedFilesModified,
                     totalPlannedFiles: verifyResult.totalPlannedFiles,
+                    verificationSource: verifySource,
                     mode: 'plan_enforced',
                     policyOnly: false,
+                    changeContract: changeContractSummary,
+                    ...(compiledPolicyMetadata ? { policyCompilation: compiledPolicyMetadata } : {}),
                     ...(governanceResult
-                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
+                            changeContract: changeContractSummary,
+                            compiledPolicy: compiledPolicyMetadata,
+                        })
                         : {}),
                     policyLock: {
                         enforced: policyLockEvaluation.enforced,
@@ -1871,7 +2242,7 @@ async function verifyCommand(options) {
                         }
                         : {}),
                 };
-                console.log(JSON.stringify(jsonOutput, null, 2));
+                emitVerifyJson(jsonOutput);
                 await recordVerificationIfRequested(options, config, {
                     grade,
                     violations: violations,
@@ -1881,11 +2252,16 @@ async function verifyCommand(options) {
                         bloatCount: filteredBloatFiles.length,
                         bloatFiles: filteredBloatFiles,
                         message: effectiveMessage,
+                        verificationSource: verifySource,
                     },
                     projectId: projectId || undefined,
                     jsonMode: true,
+                    verificationSource: verifySource,
                     governance: governanceResult
-                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                        ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
+                            changeContract: changeContractSummary,
+                            compiledPolicy: compiledPolicyMetadata,
+                        })
                         : undefined,
                 });
                 // Exit based on effective verdict (same logic as below)
@@ -1960,11 +2336,16 @@ async function verifyCommand(options) {
                     bloatCount: filteredBloatForReport.length,
                     bloatFiles: filteredBloatForReport,
                     message: effectiveMessage,
+                    verificationSource: verifySource,
                 },
                 projectId: projectId || undefined,
                 jsonMode: false,
+                verificationSource: verifySource,
                 governance: governanceResult
-                    ? buildGovernancePayload(governanceResult, orgGovernanceSettings)
+                    ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
+                        changeContract: changeContractSummary,
+                        compiledPolicy: compiledPolicyMetadata,
+                    })
                     : undefined,
             });
             // Governance override: keep PASS only when scope guard passes and failure is due
@@ -2001,7 +2382,7 @@ async function verifyCommand(options) {
             recordVerifyEvent('FAIL', `verify_api_error=${error instanceof Error ? error.message : 'unknown'}`, changedFiles, finalPlanId);
             if (options.json) {
                 const errorMessage = error instanceof Error ? error.message : 'Unknown error';
-                console.log(JSON.stringify({
+                emitVerifyJson({
                     grade: 'F',
                     score: 0,
                     verdict: 'FAIL',
@@ -2013,7 +2394,7 @@ async function verifyCommand(options) {
                     totalPlannedFiles: 0,
                     message: `Error: ${errorMessage}`,
                     scopeGuardPassed: false,
-                }, null, 2));
+                });
             }
             else {
                 if (error instanceof Error) {
@@ -2048,6 +2429,14 @@ async function verifyCommand(options) {
                 totalPlannedFiles: 0,
                 message: `Unexpected error: ${errorMessage}`,
                 scopeGuardPassed: false,
+                scope: {
+                    scanRoot: process.cwd(),
+                    startDir: process.cwd(),
+                    gitRoot: null,
+                    linkedRepoOverrideUsed: false,
+                    linkedRepos: [],
+                    blockedOverride: null,
+                },
             }, null, 2));
         }
         else {
@@ -2212,7 +2601,7 @@ function buildCompactVerificationPayload(payload) {
 /**
  * Report verification results to Neurcode Cloud
  */
-async function reportVerification(grade, violations, verifyResult, apiKey, apiUrl, projectId, jsonMode, governance) {
+async function reportVerification(grade, violations, verifyResult, apiKey, apiUrl, projectId, jsonMode, governance, verificationSource) {
     try {
         const ciContext = collectCIContext();
         const payload = {
@@ -2229,6 +2618,7 @@ async function reportVerification(grade, violations, verifyResult, apiKey, apiUr
             workflowRunId: ciContext.workflowRunId,
             projectId,
             governance,
+            verificationSource: verificationSource || verifyResult.verificationSource || 'api',
         };
         const postPayload = async (requestPayload) => fetch(`${apiUrl}/api/v1/action/verifications`, {
             method: 'POST',
@@ -2271,7 +2661,7 @@ async function reportVerification(grade, violations, verifyResult, apiKey, apiUr
         }
     }
 }
-function buildGovernancePayload(governance, orgGovernanceSettings) {
+function buildGovernancePayload(governance, orgGovernanceSettings, options) {
     return {
         contextPolicy: governance.contextPolicy,
         blastRadius: governance.blastRadius,
@@ -2289,9 +2679,14 @@ function buildGovernancePayload(governance, orgGovernanceSettings) {
                 requireSignedAiLogs: orgGovernanceSettings.requireSignedAiLogs,
                 requireManualApproval: orgGovernanceSettings.requireManualApproval,
                 minimumManualApprovals: orgGovernanceSettings.minimumManualApprovals,
+                ...(orgGovernanceSettings.policyGovernance
+                    ? { policyGovernance: orgGovernanceSettings.policyGovernance }
+                    : {}),
                 updatedAt: orgGovernanceSettings.updatedAt || null,
             }
             : null,
+        ...(options?.compiledPolicy ? { policyCompilation: options.compiledPolicy } : {}),
+        ...(options?.changeContract ? { changeContract: options.changeContract } : {}),
     };
 }
 function displayGovernanceInsights(governance, options = {}) {