@neurcode-ai/cli 0.9.39 → 0.9.41

package/dist/commands/verify.js

@@ -64,8 +64,10 @@ const policy_audit_1 = require("../utils/policy-audit");
 const governance_1 = require("../utils/governance");
 const policy_compiler_1 = require("../utils/policy-compiler");
 const change_contract_1 = require("../utils/change-contract");
+const runtime_guard_1 = require("../utils/runtime-guard");
 const artifact_signature_1 = require("../utils/artifact-signature");
 const policy_1 = require("@neurcode-ai/policy");
+const ai_debt_budget_1 = require("../utils/ai-debt-budget");
 // Import chalk with fallback
 let chalk;
 try {
@@ -434,6 +436,93 @@ function isEnabledFlag(value) {
     const normalized = value.trim().toLowerCase();
     return normalized === '1' || normalized === 'true' || normalized === 'yes' || normalized === 'on';
 }
+function createRuntimeGuardSummary(required, projectRoot, runtimeGuardPath) {
+    return {
+        required,
+        path: (0, runtime_guard_1.resolveRuntimeGuardPath)(projectRoot, runtimeGuardPath),
+        exists: false,
+        valid: false,
+        active: false,
+        pass: !required,
+        changedFiles: 0,
+        outOfScopeFiles: [],
+        constraintViolations: [],
+        violations: [],
+    };
+}
+function runtimeGuardViolationsToReport(summary) {
+    if (!summary.required || summary.pass) {
+        return [];
+    }
+    if (!summary.exists) {
+        return [
+            {
+                file: summary.path,
+                rule: 'runtime_guard_missing',
+                severity: 'block',
+                message: 'Runtime guard artifact is missing. Run `neurcode guard start` before verify.',
+            },
+        ];
+    }
+    if (!summary.valid) {
+        return [
+            {
+                file: summary.path,
+                rule: 'runtime_guard_invalid',
+                severity: 'block',
+                message: 'Runtime guard artifact is invalid. Regenerate with `neurcode guard start`.',
+            },
+        ];
+    }
+    return summary.violations.map((item) => ({
+        file: item.file || summary.path,
+        rule: `runtime_guard:${item.code.toLowerCase()}`,
+        severity: 'block',
+        message: item.message,
+    }));
+}
+function toAiDebtSummary(evaluation) {
+    return {
+        mode: evaluation.mode,
+        pass: evaluation.pass,
+        score: evaluation.score,
+        source: evaluation.source,
+        metrics: {
+            addedTodoFixme: evaluation.metrics.addedTodoFixme,
+            addedConsoleLogs: evaluation.metrics.addedConsoleLogs,
+            addedAnyTypes: evaluation.metrics.addedAnyTypes,
+            largeFilesTouched: evaluation.metrics.largeFilesTouched,
+            bloatFiles: evaluation.metrics.bloatFiles,
+        },
+        thresholds: {
+            maxAddedTodoFixme: evaluation.thresholds.maxAddedTodoFixme,
+            maxAddedConsoleLogs: evaluation.thresholds.maxAddedConsoleLogs,
+            maxAddedAnyTypes: evaluation.thresholds.maxAddedAnyTypes,
+            maxLargeFilesTouched: evaluation.thresholds.maxLargeFilesTouched,
+            largeFileDeltaLines: evaluation.thresholds.largeFileDeltaLines,
+            maxBloatFiles: evaluation.thresholds.maxBloatFiles,
+        },
+        violations: evaluation.violations.map((item) => ({
+            code: item.code,
+            metric: item.metric,
+            observed: item.observed,
+            budget: item.budget,
+            message: item.message,
+        })),
+    };
+}
+function toAiDebtReportViolations(summary) {
+    if (summary.mode === 'off' || summary.violations.length === 0) {
+        return [];
+    }
+    const severity = summary.mode === 'enforce' ? 'block' : 'warn';
+    return summary.violations.map((item) => ({
+        rule: `ai_debt:${item.code}`,
+        file: '.neurcode/ai-debt-budget.json',
+        severity,
+        message: item.message,
+    }));
+}
 function parseSigningKeyRing(raw) {
     if (!raw || !raw.trim()) {
         return {};
@@ -1188,6 +1277,16 @@ async function verifyCommand(options) {
             && !isEnabledFlag(process.env.NEURCODE_VERIFY_ALLOW_NON_STRICT_CI)
             && Boolean(options.apiKey || process.env.NEURCODE_API_KEY);
         const strictArtifactMode = explicitStrictArtifactMode || ciEnterpriseDefaultStrict;
+        const runtimeGuardArtifactPath = (0, runtime_guard_1.resolveRuntimeGuardPath)(projectRoot, options.runtimeGuard);
+        const autoRuntimeGuardInStrict = strictArtifactMode
+            && (0, fs_1.existsSync)(runtimeGuardArtifactPath)
+            && !isEnabledFlag(process.env.NEURCODE_VERIFY_DISABLE_AUTO_RUNTIME_GUARD);
+        const requireRuntimeGuard = options.requireRuntimeGuard === true
+            || isEnabledFlag(process.env.NEURCODE_VERIFY_REQUIRE_RUNTIME_GUARD)
+            || autoRuntimeGuardInStrict;
+        const aiDebtConfig = (0, ai_debt_budget_1.resolveAiDebtBudgetConfig)(projectRoot, {
+            strictDefault: strictArtifactMode || requireRuntimeGuard,
+        });
         const signingConfig = resolveGovernanceSigningConfig();
         const aiLogSigningKey = signingConfig.signingKey;
         const aiLogSigningKeyId = signingConfig.signingKeyId;
@@ -1201,6 +1300,7 @@ async function verifyCommand(options) {
             || (!allowUnsignedArtifacts && strictArtifactMode && hasSigningMaterial);
         const changeContractRead = (0, change_contract_1.readChangeContract)(projectRoot, options.changeContract);
         const compiledPolicyRead = (0, policy_compiler_1.readCompiledPolicyArtifact)(projectRoot, options.compiledPolicy);
+        let runtimeGuardSummary = createRuntimeGuardSummary(requireRuntimeGuard, projectRoot, options.runtimeGuard);
         let compiledPolicyMetadata = resolveCompiledPolicyMetadata(compiledPolicyRead.artifact, compiledPolicyRead.exists ? compiledPolicyRead.path : null);
         const compiledPolicySignatureStatus = compiledPolicyRead.artifact
             ? (0, artifact_signature_1.verifyGovernanceArtifactSignature)({
@@ -1391,6 +1491,9 @@ async function verifyCommand(options) {
             if (ciEnterpriseDefaultStrict && !explicitStrictArtifactMode) {
                 console.log(chalk.dim('   CI enterprise mode detected: strict deterministic artifact enforcement is auto-enabled (set NEURCODE_VERIFY_ALLOW_NON_STRICT_CI=1 to opt out).'));
             }
+            if (autoRuntimeGuardInStrict && !options.requireRuntimeGuard && !isEnabledFlag(process.env.NEURCODE_VERIFY_REQUIRE_RUNTIME_GUARD)) {
+                console.log(chalk.dim(`   Strict mode detected runtime guard artifact: auto-enforcing runtime guard (${runtimeGuardArtifactPath}).`));
+            }
             if (requireSignedArtifacts) {
                 console.log(chalk.dim('   Artifact signature enforcement: enabled (set NEURCODE_VERIFY_ALLOW_UNSIGNED_ARTIFACTS=1 to relax)'));
             }
@@ -1705,6 +1808,140 @@ async function verifyCommand(options) {
             const normalized = toUnixPath(filePath || '');
             return ignoreFilter(normalized) || runtimeIgnoreSet.has(normalized);
         };
+        if (requireRuntimeGuard) {
+            const guardRead = (0, runtime_guard_1.readRuntimeGuardArtifact)(projectRoot, options.runtimeGuard);
+            runtimeGuardSummary = {
+                ...runtimeGuardSummary,
+                path: guardRead.path,
+                exists: guardRead.exists,
+                valid: Boolean(guardRead.artifact),
+            };
+            if (!guardRead.artifact) {
+                const message = guardRead.error
+                    ? `Runtime guard artifact is invalid: ${guardRead.error}`
+                    : 'Runtime guard artifact missing. Run `neurcode guard start` before verify.';
+                runtimeGuardSummary = {
+                    ...runtimeGuardSummary,
+                    active: false,
+                    pass: false,
+                    violations: [
+                        {
+                            code: guardRead.error ? 'RUNTIME_GUARD_INACTIVE' : 'RUNTIME_GUARD_INACTIVE',
+                            message,
+                        },
+                    ],
+                };
+                const runtimeGuardViolationItems = runtimeGuardViolationsToReport(runtimeGuardSummary);
+                recordVerifyEvent('FAIL', 'runtime_guard_missing_or_invalid', diffFiles.map((f) => f.path));
+                if (options.json) {
+                    emitVerifyJson({
+                        grade: 'F',
+                        score: 0,
+                        verdict: 'FAIL',
+                        violations: runtimeGuardViolationItems,
+                        adherenceScore: 0,
+                        bloatCount: 0,
+                        bloatFiles: [],
+                        plannedFilesModified: 0,
+                        totalPlannedFiles: 0,
+                        message,
+                        scopeGuardPassed: false,
+                        mode: 'runtime_guard_required',
+                        policyOnly: Boolean(options.policyOnly),
+                        runtimeGuard: runtimeGuardSummary,
+                    });
+                }
+                else {
+                    console.log(chalk.red('\n⛔ Runtime Guard Required'));
+                    console.log(chalk.red(`   ${message}`));
+                    console.log(chalk.dim(`   Path: ${runtimeGuardSummary.path}`));
+                    console.log(chalk.dim('   Start guard: neurcode guard start --strict\n'));
+                }
+                await recordVerificationIfRequested(options, config, {
+                    grade: 'F',
+                    violations: runtimeGuardViolationItems,
+                    verifyResult: {
+                        adherenceScore: 0,
+                        verdict: 'FAIL',
+                        bloatCount: 0,
+                        bloatFiles: [],
+                        message,
+                    },
+                    projectId: projectId || undefined,
+                    jsonMode: Boolean(options.json),
+                });
+                process.exit(2);
+            }
+            const runtimeGuardEvaluation = (0, runtime_guard_1.evaluateRuntimeGuardArtifact)(guardRead.artifact, diffFiles.filter((file) => !shouldIgnore(file.path)));
+            runtimeGuardSummary = {
+                ...runtimeGuardSummary,
+                active: guardRead.artifact.active,
+                pass: runtimeGuardEvaluation.pass,
+                changedFiles: runtimeGuardEvaluation.changedFiles.length,
+                outOfScopeFiles: runtimeGuardEvaluation.outOfScopeFiles,
+                constraintViolations: runtimeGuardEvaluation.constraintViolations,
+                violations: runtimeGuardEvaluation.violations.map((item) => ({
+                    code: item.code,
+                    message: item.message,
+                    ...(item.file ? { file: item.file } : {}),
+                })),
+            };
+            const runtimeGuardUpdated = (0, runtime_guard_1.withRuntimeGuardCheckStats)(guardRead.artifact, {
+                blocked: !runtimeGuardEvaluation.pass,
+            });
+            (0, runtime_guard_1.writeRuntimeGuardArtifact)(projectRoot, runtimeGuardUpdated, options.runtimeGuard);
+            if (!runtimeGuardEvaluation.pass) {
+                const message = runtimeGuardEvaluation.violations.length > 0
+                    ? `Runtime guard blocked ${runtimeGuardEvaluation.violations.length} violation(s).`
+                    : 'Runtime guard blocked verification.';
+                const runtimeGuardViolationItems = runtimeGuardViolationsToReport(runtimeGuardSummary);
+                recordVerifyEvent('FAIL', `runtime_guard_violations=${runtimeGuardEvaluation.violations.length}`, diffFiles.map((f) => f.path));
+                if (options.json) {
+                    emitVerifyJson({
+                        grade: 'F',
+                        score: 0,
+                        verdict: 'FAIL',
+                        violations: runtimeGuardViolationItems,
+                        adherenceScore: 0,
+                        bloatCount: runtimeGuardEvaluation.outOfScopeFiles.length,
+                        bloatFiles: runtimeGuardEvaluation.outOfScopeFiles,
+                        plannedFilesModified: runtimeGuardEvaluation.plannedFilesModified,
+                        totalPlannedFiles: runtimeGuardEvaluation.totalPlannedFiles,
+                        message,
+                        scopeGuardPassed: false,
+                        mode: 'runtime_guard_blocked',
+                        policyOnly: Boolean(options.policyOnly),
+                        runtimeGuard: runtimeGuardSummary,
+                    });
+                }
+                else {
+                    console.log(chalk.red('\n⛔ Runtime Guard Blocked Verification'));
+                    runtimeGuardEvaluation.violations.forEach((item) => {
+                        const file = item.file ? `${item.file}: ` : '';
+                        console.log(chalk.red(`   • ${file}${item.message}`));
+                    });
+                    console.log(chalk.dim(`\n   Guard artifact: ${runtimeGuardSummary.path}\n`));
+                }
+                await recordVerificationIfRequested(options, config, {
+                    grade: 'F',
+                    violations: runtimeGuardViolationItems,
+                    verifyResult: {
+                        adherenceScore: runtimeGuardEvaluation.adherenceScore,
+                        verdict: 'FAIL',
+                        bloatCount: runtimeGuardEvaluation.outOfScopeFiles.length,
+                        bloatFiles: runtimeGuardEvaluation.outOfScopeFiles,
+                        message,
+                    },
+                    projectId: projectId || undefined,
+                    jsonMode: Boolean(options.json),
+                });
+                process.exit(2);
+            }
+            if (!options.json) {
+                console.log(chalk.dim(`   Runtime guard passed (${runtimeGuardSummary.changedFiles} changed file(s), ` +
+                    `${runtimeGuardSummary.violations.length} violation(s))`));
+            }
+        }
         const baselineContextPolicyLocal = (0, policy_1.loadContextPolicy)(projectRoot);
         const baselineContextPolicy = orgGovernanceSettings?.contextPolicy
             ? (0, policy_1.mergeContextPolicies)(baselineContextPolicyLocal, orgGovernanceSettings.contextPolicy)
@@ -1973,6 +2210,11 @@ async function verifyCommand(options) {
             const filteredViolations = violations.filter((p) => !shouldIgnore(p));
             // Step D: The Block (only report scope violations for non-ignored files)
             if (filteredViolations.length > 0) {
+                const aiDebtSummaryForScope = toAiDebtSummary((0, ai_debt_budget_1.evaluateAiDebtBudget)({
+                    diffFiles,
+                    bloatCount: filteredViolations.length,
+                    config: aiDebtConfig,
+                }));
                 recordVerifyEvent('FAIL', `scope_violation=${filteredViolations.length}`, modifiedFiles, finalPlanId);
                 const scopeViolationItems = filteredViolations.map((file) => ({
                     file,
@@ -1980,6 +2222,11 @@ async function verifyCommand(options) {
                     severity: 'block',
                     message: 'File modified outside the plan',
                 }));
+                const aiDebtViolationItems = toAiDebtReportViolations(aiDebtSummaryForScope);
+                const scopeViolationReportItems = [
+                    ...scopeViolationItems,
+                    ...aiDebtViolationItems,
+                ];
                 const scopeViolationMessage = `Scope violation: ${filteredViolations.length} file(s) modified outside the plan`;
                 if (options.json) {
                     // Output JSON for scope violation BEFORE exit. Must include violations for GitHub Action annotations.
@@ -1987,7 +2234,7 @@ async function verifyCommand(options) {
                         grade: 'F',
                         score: 0,
                         verdict: 'FAIL',
-                        violations: scopeViolationItems,
+                        violations: scopeViolationReportItems,
                         adherenceScore: 0,
                         bloatCount: filteredViolations.length,
                         bloatFiles: filteredViolations,
@@ -1997,10 +2244,12 @@ async function verifyCommand(options) {
                         scopeGuardPassed: false,
                         mode: 'plan_enforced',
                         policyOnly: false,
+                        aiDebt: aiDebtSummaryForScope,
                         ...(governanceResult
                             ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
                                 changeContract: changeContractSummary,
                                 compiledPolicy: compiledPolicyMetadata,
+                                aiDebt: aiDebtSummaryForScope,
                             })
                             : {}),
                     };
@@ -2008,7 +2257,7 @@ async function verifyCommand(options) {
                     emitVerifyJson(jsonOutput);
                     await recordVerificationIfRequested(options, config, {
                         grade: 'F',
-                        violations: scopeViolationItems,
+                        violations: scopeViolationReportItems,
                         verifyResult: {
                             adherenceScore: 0,
                             verdict: 'FAIL',
@@ -2022,6 +2271,7 @@ async function verifyCommand(options) {
                             ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
                                 changeContract: changeContractSummary,
                                 compiledPolicy: compiledPolicyMetadata,
+                                aiDebt: aiDebtSummaryForScope,
                             })
                             : undefined,
                     });
@@ -2041,13 +2291,31 @@ async function verifyCommand(options) {
                     filteredViolations.forEach(file => {
                         console.log(chalk.dim(`   neurcode allow ${file}`));
                     });
+                    if (aiDebtSummaryForScope.mode !== 'off') {
+                        console.log('');
+                        const header = aiDebtSummaryForScope.mode === 'enforce'
+                            ? aiDebtSummaryForScope.pass
+                                ? chalk.green('AI Debt Budget: PASS')
+                                : chalk.red('AI Debt Budget: BLOCK')
+                            : chalk.yellow('AI Debt Budget: ADVISORY');
+                        console.log(header);
+                        console.log(chalk.dim(`   Score: ${aiDebtSummaryForScope.score} | TODO/FIXME +${aiDebtSummaryForScope.metrics.addedTodoFixme} | ` +
+                            `console.log +${aiDebtSummaryForScope.metrics.addedConsoleLogs} | any +${aiDebtSummaryForScope.metrics.addedAnyTypes} | ` +
+                            `large files ${aiDebtSummaryForScope.metrics.largeFilesTouched} | bloat ${aiDebtSummaryForScope.metrics.bloatFiles}`));
+                        if (aiDebtSummaryForScope.violations.length > 0) {
+                            aiDebtSummaryForScope.violations.forEach((item) => {
+                                const color = aiDebtSummaryForScope.mode === 'enforce' ? chalk.red : chalk.yellow;
+                                console.log(color(`   • ${item.message}`));
+                            });
+                        }
+                    }
                     if (governanceResult) {
                         displayGovernanceInsights(governanceResult, { explain: options.explain });
                     }
                     console.log('');
                     await recordVerificationIfRequested(options, config, {
                         grade: 'F',
-                        violations: scopeViolationItems,
+                        violations: scopeViolationReportItems,
                         verifyResult: {
                             adherenceScore: 0,
                             verdict: 'FAIL',
@@ -2061,6 +2329,7 @@ async function verifyCommand(options) {
                             ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
                                 changeContract: changeContractSummary,
                                 compiledPolicy: compiledPolicyMetadata,
+                                aiDebt: aiDebtSummaryForScope,
                             })
                             : undefined,
                     });
@@ -2550,6 +2819,19 @@ async function verifyCommand(options) {
                     console.log(chalk.yellow('⚠️  Verify API unavailable, using local deterministic fallback.'));
                     console.log(chalk.dim(`   Reason: ${fallbackReason}`));
                 }
+                const localFileContents = {};
+                for (const file of changedFiles) {
+                    const absolutePath = (0, path_1.join)(projectRoot, file.path);
+                    if (!(0, fs_1.existsSync)(absolutePath)) {
+                        continue;
+                    }
+                    try {
+                        localFileContents[file.path] = (0, fs_1.readFileSync)(absolutePath, 'utf-8');
+                    }
+                    catch {
+                        // Best effort only; fallback can still run on diff-only context.
+                    }
+                }
                 const localEvaluation = (0, governance_runtime_1.evaluatePlanVerification)({
                     planFiles: planFilesForVerification.map((path) => ({
                         path,
@@ -2560,6 +2842,7 @@ async function verifyCommand(options) {
                     intentConstraints: intentConstraintsForVerification,
                     policyRules: deterministicPolicyRules,
                     extraConstraintRules: hydratedCompiledPolicyRules.length > 0 ? hydratedCompiledPolicyRules : undefined,
+                    fileContents: localFileContents,
                 });
                 verifyResult = {
                     verificationId: `local-fallback-${Date.now()}`,
@@ -2573,12 +2856,19 @@ async function verifyCommand(options) {
                     message: localEvaluation.message,
                 };
             }
+            const aiDebtEvaluation = (0, ai_debt_budget_1.evaluateAiDebtBudget)({
+                diffFiles,
+                bloatCount: verifyResult.bloatCount,
+                config: aiDebtConfig,
+            });
+            const aiDebtSummary = toAiDebtSummary(aiDebtEvaluation);
+            const aiDebtHardBlock = aiDebtSummary.mode === 'enforce' && aiDebtSummary.violations.length > 0;
             // Apply custom policy verdict: block from dashboard overrides API verdict
             const policyBlock = policyDecision === 'block' && policyViolations.length > 0;
             const governanceDecisionBlock = governanceResult?.governanceDecision?.decision === 'block';
             const governanceIntegrityBlock = signedLogsRequired && governanceResult ? governanceResult.aiChangeLogIntegrity.valid !== true : false;
             const governanceHardBlock = governanceDecisionBlock || governanceIntegrityBlock;
-            const effectiveVerdict = policyBlock || governanceHardBlock
+            const effectiveVerdict = policyBlock || governanceHardBlock || aiDebtHardBlock
                 ? 'FAIL'
                 : verifyResult.verdict;
             const policyMessageBase = policyBlock
@@ -2589,9 +2879,12 @@ async function verifyCommand(options) {
                 : governanceDecisionBlock
                     ? governanceResult?.governanceDecision?.summary || 'Governance decision matrix returned BLOCK.'
                     : null;
+            const aiDebtBlockReason = aiDebtHardBlock
+                ? `AI debt budget exceeded: ${aiDebtSummary.violations.map((item) => item.message).join(' ')}`
+                : null;
             const effectiveMessage = (policyExceptionsSummary.suppressed > 0
                 ? `${policyMessageBase} Policy exceptions suppressed ${policyExceptionsSummary.suppressed} violation(s).`
-                : policyMessageBase) + (governanceBlockReason ? ` ${governanceBlockReason}` : '');
+                : policyMessageBase) + (governanceBlockReason ? ` ${governanceBlockReason}` : '') + (aiDebtBlockReason ? ` ${aiDebtBlockReason}` : '');
             // Calculate grade from effective verdict and score
             // CRITICAL: 0/0 planned files = 'F' (Incomplete), not 'B'
             // Bloat automatically drops grade by at least one letter
@@ -2637,10 +2930,11 @@ async function verifyCommand(options) {
             const changedPathsForBrain = diffFiles
                 .flatMap((file) => [file.path, file.oldPath])
                 .filter((value) => Boolean(value));
-            recordVerifyEvent(effectiveVerdict, `adherence=${verifyResult.adherenceScore};bloat=${verifyResult.bloatCount};scopeGuard=${scopeGuardPassed ? 1 : 0};policy=${policyDecision};policyExceptions=${policyExceptionsSummary.suppressed}`, changedPathsForBrain, finalPlanId);
+            recordVerifyEvent(effectiveVerdict, `adherence=${verifyResult.adherenceScore};bloat=${verifyResult.bloatCount};scopeGuard=${scopeGuardPassed ? 1 : 0};policy=${policyDecision};policyExceptions=${policyExceptionsSummary.suppressed};aiDebt=${aiDebtSummary.score}`, changedPathsForBrain, finalPlanId);
             const shouldForceGovernancePass = scopeGuardPassed &&
                 !policyBlock &&
                 !governanceHardBlock &&
+                !aiDebtHardBlock &&
                 (effectiveVerdict === 'PASS' ||
                     ((verifyResult.verdict === 'FAIL' || verifyResult.verdict === 'WARN') &&
                         policyViolations.length === 0 &&
@@ -2661,7 +2955,8 @@ async function verifyCommand(options) {
                     message: v.message,
                     ...(v.line != null ? { startLine: v.line } : {}),
                 }));
-                const violations = [...scopeViolations, ...policyViolationItems];
+                const aiDebtViolationItems = toAiDebtReportViolations(aiDebtSummary);
+                const violations = [...scopeViolations, ...policyViolationItems, ...aiDebtViolationItems];
                 const jsonOutput = {
                     grade,
                     score: verifyResult.adherenceScore,
@@ -2677,12 +2972,14 @@ async function verifyCommand(options) {
                     verificationSource: verifySource,
                     mode: 'plan_enforced',
                     policyOnly: false,
+                    aiDebt: aiDebtSummary,
                     changeContract: changeContractSummary,
                     ...(compiledPolicyMetadata ? { policyCompilation: compiledPolicyMetadata } : {}),
                     ...(governanceResult
                         ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
                             changeContract: changeContractSummary,
                             compiledPolicy: compiledPolicyMetadata,
+                            aiDebt: aiDebtSummary,
                         })
                         : {}),
                     policyLock: {
@@ -2693,6 +2990,7 @@ async function verifyCommand(options) {
                     },
                     policyExceptions: policyExceptionsSummary,
                     policyGovernance: policyGovernanceSummary,
+                    ...(runtimeGuardSummary.required ? { runtimeGuard: runtimeGuardSummary } : {}),
                     ...(policyViolations.length > 0 && { policyDecision }),
                     ...(effectiveRules.policyPack
                         ? {
@@ -2724,6 +3022,7 @@ async function verifyCommand(options) {
                         ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
                             changeContract: changeContractSummary,
                             compiledPolicy: compiledPolicyMetadata,
+                            aiDebt: aiDebtSummary,
                         })
                         : undefined,
                 });
@@ -2754,6 +3053,23 @@ async function verifyCommand(options) {
                 if (governanceResult) {
                     displayGovernanceInsights(governanceResult, { explain: options.explain });
                 }
+                if (aiDebtSummary.mode !== 'off') {
+                    const header = aiDebtSummary.mode === 'enforce'
+                        ? aiDebtSummary.pass
+                            ? chalk.green('\nAI Debt Budget: PASS')
+                            : chalk.red('\nAI Debt Budget: BLOCK')
+                        : chalk.yellow('\nAI Debt Budget: ADVISORY');
+                    console.log(header);
+                    console.log(chalk.dim(`   Score: ${aiDebtSummary.score} | TODO/FIXME +${aiDebtSummary.metrics.addedTodoFixme} | ` +
+                        `console.log +${aiDebtSummary.metrics.addedConsoleLogs} | any +${aiDebtSummary.metrics.addedAnyTypes} | ` +
+                        `large files ${aiDebtSummary.metrics.largeFilesTouched} | bloat ${aiDebtSummary.metrics.bloatFiles}`));
+                    if (aiDebtSummary.violations.length > 0) {
+                        aiDebtSummary.violations.forEach((item) => {
+                            const color = aiDebtSummary.mode === 'enforce' ? chalk.red : chalk.yellow;
+                            console.log(color(`   • ${item.message}`));
+                        });
+                    }
+                }
                 console.log(chalk.dim(`\n   Policy exceptions source: ${describePolicyExceptionSource(policyExceptionsSummary.sourceMode)}`));
                 if (policyExceptionsSummary.suppressed > 0) {
                     console.log(chalk.yellow(`\n⚠️  Policy exceptions applied: ${policyExceptionsSummary.suppressed}`));
@@ -2774,6 +3090,9 @@ async function verifyCommand(options) {
                         console.log(chalk.red(`   • ${issue}`));
                     });
                 }
+                if (runtimeGuardSummary.required) {
+                    console.log(chalk.dim(`\n   Runtime guard: ${runtimeGuardSummary.pass ? 'pass' : 'block'} (${runtimeGuardSummary.path})`));
+                }
             }
             // Report to Neurcode Cloud if --record flag is set
             const filteredBloatForReport = (verifyResult.bloatFiles || []).filter((f) => !shouldIgnore(f));
@@ -2790,6 +3109,7 @@ async function verifyCommand(options) {
                     severity: v.severity,
                     message: v.message,
                 })),
+                ...toAiDebtReportViolations(aiDebtSummary),
             ];
             await recordVerificationIfRequested(options, config, {
                 grade,
@@ -2809,6 +3129,7 @@ async function verifyCommand(options) {
                     ? buildGovernancePayload(governanceResult, orgGovernanceSettings, {
                         changeContract: changeContractSummary,
                         compiledPolicy: compiledPolicyMetadata,
+                        aiDebt: aiDebtSummary,
                     })
                     : undefined,
             });
@@ -3151,6 +3472,7 @@ function buildGovernancePayload(governance, orgGovernanceSettings, options) {
             : null,
         ...(options?.compiledPolicy ? { policyCompilation: options.compiledPolicy } : {}),
         ...(options?.changeContract ? { changeContract: options.changeContract } : {}),
+        ...(options?.aiDebt ? { aiDebt: options.aiDebt } : {}),
     };
 }
 function displayGovernanceInsights(governance, options = {}) {