@neurcode/action 0.2.1 → 0.2.2

package/README.md

@@ -30,7 +30,8 @@ jobs:
           base_ref: 'HEAD~1'
           threshold: 'C'
           record: 'true'
-          verify_policy_only: 'true'
+          enterprise_mode: 'true'
+          verify_policy_only: 'false'
           changed_files_only: 'true'
           auto_remediate: 'true'
           remediation_commit: 'false'
@@ -47,9 +48,11 @@ jobs:
 | `base_ref` | Override verify base ref (`origin/main`, `HEAD~1`, etc.) | `''` |
 | `record` | Record verification to Neurcode cloud | `true` |
 | `threshold` | Minimum acceptable grade (`A`/`B`/`C`/`D`/`F`) | `C` |
+| `enterprise_mode` | Auto-enable enterprise-safe verify defaults unless explicitly overridden | `true` |
 | `verify_policy_only` | Run `neurcode verify --policy-only` | `false` |
 | `changed_files_only` | Enforce only violations from changed files in this PR/base diff | `false` |
-| `enforce_strict_verification` | Treat tier-limited `INFO` as failure | `false` |
+| `enforce_change_contract` | Treat contract drift as hard fail; set `true`/`false` to override enterprise auto mode | `''` (auto) |
+| `enforce_strict_verification` | Treat tier-limited `INFO` as failure; set `true`/`false` to override enterprise auto mode | `''` (auto) |
 | `auto_remediate` | Run `neurcode ship` when verify fails | `false` |
 | `remediation_commit` | Create remediation commit on success | `false` |
 | `remediation_push` | Push remediation commit to PR branch | `false` |
@@ -80,7 +83,10 @@ See `action.yml` for full advanced inputs (timeouts, retries, CLI source/version
 
 ## Safety Defaults
 
-- Use `verify_policy_only: true` for stable PR governance checks.
+- Keep `enterprise_mode: true` for deterministic enforcement defaults in CI.
+- In enterprise auto mode, change-contract hard-fail is enabled for plan-aware runs and relaxed for policy-only fallback runs.
+- Use `verify_policy_only: true` only for intentional policy-only governance runs.
+- The action detects `neurcode verify --help` capabilities and gracefully drops unsupported verify flags for older pinned CLI versions.
 - Without explicit `plan_id`, the action runs plan-aware mode first and automatically retries in policy-only mode only when the verify failure is strictly "missing plan context".
 - Use `changed_files_only: true` to avoid blocking on historical repository debt.
 - Use `base_ref: HEAD~1` for incremental adoption on long-lived branches with legacy violations.

package/action.yml

@@ -62,10 +62,26 @@ inputs:
     description: 'Timeout for neurcode verify command in minutes (Linux/macOS runners)'
     required: false
     default: '8'
+  enforce_compatibility_handshake:
+    description: 'Fail fast when CLI/Action/API runtime compatibility contract handshake fails'
+    required: false
+    default: 'true'
+  require_api_compatibility_handshake:
+    description: 'Require API health endpoint to publish compatibility metadata when API URL is configured'
+    required: false
+    default: 'true'
+  compatibility_probe_timeout_minutes:
+    description: 'Timeout for compat probes (CLI compat command and API health) in minutes'
+    required: false
+    default: '2'
   verify_policy_only:
     description: 'Run neurcode verify in policy-only mode (skip plan/scope enforcement)'
     required: false
     default: 'false'
+  enterprise_mode:
+    description: 'Enable enterprise-safe defaults (auto-enable strict verify + change-contract enforcement unless explicitly overridden)'
+    required: false
+    default: 'true'
   compiled_policy_path:
     description: 'Compiled policy artifact path passed to neurcode verify'
     required: false
@@ -75,9 +91,9 @@ inputs:
     required: false
     default: '.neurcode/change-contract.json'
   enforce_change_contract:
-    description: 'Treat change contract drift as hard verification failure'
+    description: 'Treat change contract drift as hard verification failure (set true/false to override enterprise auto behavior)'
     required: false
-    default: 'false'
+    default: ''
   changed_files_only:
     description: 'Only enforce violations detected in files changed by this PR/base diff'
     required: false
@@ -87,9 +103,9 @@ inputs:
     required: false
     default: 'true'
   enforce_strict_verification:
-    description: 'Treat tier-limited INFO verification results as failure (enterprise trust mode)'
+    description: 'Treat tier-limited INFO verification results as failure (set true/false to override enterprise auto behavior)'
     required: false
-    default: 'false'
+    default: ''
   auto_remediate:
     description: 'When verify fails, run neurcode ship auto-remediation flow'
     required: false
@@ -172,12 +188,28 @@ inputs:
     default: 'neurcode-bot@users.noreply.github.com'
 
 outputs:
+  compatibility_handshake:
+    description: 'compatibility handshake status (passed|skipped)'
+  compatibility_contract_version:
+    description: 'runtime compatibility contract version enforced by this action'
+  compatibility_action_version:
+    description: 'resolved action version used in compatibility checks'
+  compatibility_cli_version:
+    description: 'resolved CLI version from neurcode compat handshake'
+  compatibility_api_version:
+    description: 'resolved API version from health compatibility payload'
   verdict:
     description: 'neurcode verify verdict'
   verify_mode:
     description: 'verification mode used by action (plan_aware|plan_enforced_explicit|policy_only|policy_only_fallback)'
   policy_only_fallback_used:
     description: 'true when action retried verify in policy-only mode due to missing plan context'
+  enterprise_mode_active:
+    description: 'true when enterprise_mode was enabled for this run'
+  enterprise_enforced_change_contract:
+    description: 'effective enforce_change_contract value after enterprise defaults were applied'
+  enterprise_enforced_strict_verification:
+    description: 'effective enforce_strict_verification value after enterprise defaults were applied'
   grade:
     description: 'neurcode verify grade'
   score: