coderifts 2.0.0 → 3.1.0

package/dist/cli.js

@@ -3007,7 +3007,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "2.0.0",
+      version: "3.1.0",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -13493,33 +13493,39 @@ var require_cloud = __commonJS({
   "src/cloud.js"(exports2, module2) {
     "use strict";
     var https = require("https");
-    var API_BASE = "https://app.coderifts.com";
-    function cloudDiff(oldSpec, newSpec, apiKey) {
+    var API_BASE = process.env.CODERIFTS_API_BASE || "https://app.coderifts.com";
+    function cloudRequest(method, pathname, apiKey, bodyObj = null) {
       return new Promise((resolve, reject) => {
-        const body = JSON.stringify({ old_spec: oldSpec, new_spec: newSpec });
-        const url = new URL("/api/v1/diff", API_BASE);
+        const body = bodyObj != null ? JSON.stringify(bodyObj) : null;
+        const base = API_BASE.replace(/\/$/, "");
+        const url = new URL(pathname.startsWith("http") ? pathname : base + pathname);
         const options = {
           hostname: url.hostname,
-          port: 443,
-          path: url.pathname,
-          method: "POST",
+          port: url.port || (url.protocol === "http:" ? 80 : 443),
+          path: url.pathname + url.search,
+          method,
           headers: {
-            "Content-Type": "application/json",
-            "Content-Length": Buffer.byteLength(body),
-            "Authorization": `Bearer ${apiKey}`,
-            "User-Agent": "@coderifts/cli"
+            Accept: "application/json",
+            Authorization: `Bearer ${apiKey}`,
+            "User-Agent": "@coderifts/cli",
+            ...body ? { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) } : {}
           }
         };
-        const req = https.request(options, (res) => {
+        const transport = url.protocol === "http:" ? require("http") : https;
+        const req = transport.request(options, (res) => {
           let data = "";
           res.on("data", (chunk) => {
             data += chunk;
           });
           res.on("end", () => {
             try {
-              const parsed = JSON.parse(data);
+              const parsed = data ? JSON.parse(data) : {};
               if (res.statusCode >= 400) {
-                reject(new Error(parsed.message || parsed.error || `HTTP ${res.statusCode}`));
+                const err = new Error(parsed.message || parsed.error || `HTTP ${res.statusCode}`);
+                err.statusCode = res.statusCode;
+                err.code = parsed.error || null;
+                err.body = parsed;
+                reject(err);
               } else {
                 resolve(parsed);
               }
@@ -13529,11 +13535,31 @@ var require_cloud = __commonJS({
           });
         });
         req.on("error", reject);
-        req.write(body);
+        if (body) req.write(body);
         req.end();
       });
     }
-    module2.exports = { cloudDiff };
+    function cloudDiff(oldSpec, newSpec, apiKey) {
+      return cloudRequest("POST", "/api/v1/diff", apiKey, {
+        old_spec: oldSpec,
+        new_spec: newSpec
+      });
+    }
+    function cloudGetEnforcementStatus(repo, apiKey) {
+      const q = encodeURIComponent(String(repo || ""));
+      return cloudRequest("GET", `/api/v1/enforcement-status?repo=${q}`, apiKey);
+    }
+    function cloudGetLock(repo, apiKey) {
+      const q = encodeURIComponent(String(repo || ""));
+      return cloudRequest("GET", `/api/v1/lock?repo=${q}`, apiKey);
+    }
+    module2.exports = {
+      cloudDiff,
+      cloudRequest,
+      cloudGetEnforcementStatus,
+      cloudGetLock,
+      API_BASE
+    };
   }
 });
 
@@ -68958,12 +68984,15 @@ var require_deploy_gate2 = __commonJS({
         attestation_source: "cli_flag"
       };
     }
-    function deployReportResiduals(state, inescapable, enforcement) {
+    function deployReportResiduals(state, enforcement_inescapable, enforcement, change_set_rebound) {
       const out = [];
-      if (state === "success" && inescapable !== true) {
+      if (state !== "success") return out;
+      if (enforcement_inescapable !== true) {
         if (enforcement === "ENFORCING") out.push("bypass_open");
         else if (enforcement === "ADVISORY") out.push("deploy_gate_advisory");
         else if (enforcement === "ABSENT") out.push("deploy_path_ungated");
+      } else if (change_set_rebound !== true) {
+        out.push("change_set_not_rebound");
       }
       return out;
     }
@@ -68991,19 +69020,24 @@ var require_deploy_gate2 = __commonJS({
           bypass_possible: !(observed_cd_enforcement && observed_cd_enforcement.bypass_possible === false)
         }
       };
+      let change_set_rebound = false;
       if (attested_enforcement === "ENFORCING") {
-        if (expected_fingerprint != null) requiredContext.expected_fingerprint = expected_fingerprint;
+        if (expected_fingerprint != null) {
+          requiredContext.expected_fingerprint = expected_fingerprint;
+          change_set_rebound = true;
+        }
         if (expected_body_hash != null) requiredContext.expected_body_hash = expected_body_hash;
       }
       const gate = deployGate({ deployTarget: { environment, artifact_id }, receipt, requiredContext });
-      const inescapable_deploy = gate.inescapable_deploy === true;
+      const enforcement_inescapable = gate.inescapable_deploy === true;
+      const inescapable_deploy = enforcement_inescapable && change_set_rebound === true;
       return {
         deploy_check_status: gate.state,
         reason: gate.reason,
         must_re_preflight: REPAIRABLE.has(gate.reason),
         attested_enforcement,
         gate: { deploy_allowed: gate.deploy_allowed, reason: gate.reason, inescapable_deploy },
-        report_residuals: deployReportResiduals(gate.state, inescapable_deploy, attested_enforcement),
+        report_residuals: deployReportResiduals(gate.state, enforcement_inescapable, attested_enforcement, change_set_rebound),
         coverage_deploy_input: deployCoverageInput(attested_enforcement, inescapable_deploy)
       };
     }
@@ -69513,6 +69547,560 @@ var require_publish_gate = __commonJS({
   }
 });
 
+// src/registry-validation-core.js
+var require_registry_validation_core = __commonJS({
+  "src/registry-validation-core.js"(exports2, module2) {
+    "use strict";
+    var yaml = require_js_yaml();
+    function safeParse(content) {
+      if (!content) return null;
+      try {
+        const trimmed = content.trim();
+        if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+          return JSON.parse(trimmed);
+        }
+        return yaml.load(trimmed);
+      } catch (_) {
+        return null;
+      }
+    }
+    function validateOpenApiSpec(parsed) {
+      if (!parsed || typeof parsed !== "object") {
+        return { valid: false, error: "Not a valid YAML or JSON object" };
+      }
+      if (parsed.openapi) {
+        const ver = String(parsed.openapi);
+        if (ver.startsWith("3.")) {
+          return { valid: true, version: ver };
+        }
+        return { valid: false, error: `Unsupported OpenAPI version: ${ver}` };
+      }
+      if (parsed.swagger) {
+        const ver = String(parsed.swagger);
+        if (ver.startsWith("2.")) {
+          return { valid: true, version: ver };
+        }
+        return { valid: false, error: `Unsupported Swagger version: ${ver}` };
+      }
+      return { valid: false, error: "Missing required field: 'openapi' or 'swagger'" };
+    }
+    function extractEndpoints(parsed) {
+      const endpoints = [];
+      const paths = parsed.paths || {};
+      const httpMethods = ["get", "post", "put", "patch", "delete", "head", "options"];
+      for (const [path, pathItem] of Object.entries(paths)) {
+        if (!pathItem || typeof pathItem !== "object") continue;
+        for (const method of httpMethods) {
+          if (pathItem[method]) {
+            endpoints.push({
+              path,
+              method: method.toUpperCase(),
+              operationId: pathItem[method].operationId || ""
+            });
+          }
+        }
+      }
+      return endpoints;
+    }
+    function extractSchemaNames(parsed) {
+      const schemas = [];
+      const components = parsed.components?.schemas || {};
+      for (const [name, schema] of Object.entries(components)) {
+        const hash = JSON.stringify(schema);
+        schemas.push({ name, hash });
+      }
+      return schemas;
+    }
+    function extractDefinedScopes(parsed) {
+      const scopes = /* @__PURE__ */ new Set();
+      const schemes = parsed.components?.securitySchemes || {};
+      for (const scheme of Object.values(schemes)) {
+        if (scheme.type === "oauth2" && scheme.flows) {
+          for (const flow of Object.values(scheme.flows)) {
+            if (flow.scopes) {
+              for (const scope of Object.keys(flow.scopes)) {
+                scopes.add(scope);
+              }
+            }
+          }
+        }
+      }
+      return scopes;
+    }
+    function extractUsedScopes(parsed) {
+      const scopes = /* @__PURE__ */ new Set();
+      if (Array.isArray(parsed.security)) {
+        for (const req of parsed.security) {
+          for (const scopeList of Object.values(req)) {
+            if (Array.isArray(scopeList)) {
+              for (const s of scopeList) scopes.add(s);
+            }
+          }
+        }
+      }
+      const paths = parsed.paths || {};
+      const httpMethods = ["get", "post", "put", "patch", "delete", "head", "options"];
+      for (const pathItem of Object.values(paths)) {
+        if (!pathItem || typeof pathItem !== "object") continue;
+        for (const method of httpMethods) {
+          const op = pathItem[method];
+          if (op?.security && Array.isArray(op.security)) {
+            for (const req of op.security) {
+              for (const scopeList of Object.values(req)) {
+                if (Array.isArray(scopeList)) {
+                  for (const s of scopeList) scopes.add(s);
+                }
+              }
+            }
+          }
+        }
+      }
+      return scopes;
+    }
+    function extractRefs(obj, refs = /* @__PURE__ */ new Set()) {
+      if (!obj || typeof obj !== "object") return refs;
+      if (Array.isArray(obj)) {
+        for (const item of obj) extractRefs(item, refs);
+        return refs;
+      }
+      for (const [key, value] of Object.entries(obj)) {
+        if (key === "$ref" && typeof value === "string") {
+          refs.add(value);
+        } else {
+          extractRefs(value, refs);
+        }
+      }
+      return refs;
+    }
+    function refResolves(parsed, ref) {
+      if (!ref.startsWith("#/")) return true;
+      const parts = ref.replace("#/", "").split("/");
+      let current = parsed;
+      for (const part of parts) {
+        if (!current || typeof current !== "object") return false;
+        current = current[part];
+      }
+      return current !== void 0;
+    }
+    function validateRegistry(specs) {
+      if (!Array.isArray(specs) || specs.length === 0) {
+        return { valid: true, issues: [], stats: { specs_count: 0, endpoints_count: 0, schemas_count: 0 } };
+      }
+      const issues = [];
+      const parsedSpecs = [];
+      for (const { name, spec } of specs) {
+        const parsed = safeParse(spec);
+        if (!parsed) {
+          issues.push({
+            severity: "error",
+            type: "parse_error",
+            message: `Could not parse spec '${name}' as valid YAML or JSON`,
+            specs: [name]
+          });
+          continue;
+        }
+        const validation = validateOpenApiSpec(parsed);
+        if (!validation.valid) {
+          issues.push({
+            severity: "error",
+            type: "invalid_spec",
+            message: `Spec '${name}' is not a valid OpenAPI document: ${validation.error}`,
+            specs: [name]
+          });
+          continue;
+        }
+        parsedSpecs.push({ name, parsed });
+      }
+      const endpointMap = /* @__PURE__ */ new Map();
+      for (const { name, parsed } of parsedSpecs) {
+        const endpoints = extractEndpoints(parsed);
+        for (const ep of endpoints) {
+          const key = `${ep.method} ${ep.path}`;
+          if (!endpointMap.has(key)) endpointMap.set(key, []);
+          endpointMap.get(key).push({ spec: name, operationId: ep.operationId });
+        }
+      }
+      for (const [endpoint, owners] of endpointMap) {
+        if (owners.length > 1) {
+          const specNames = owners.map((o) => o.spec);
+          issues.push({
+            severity: "warning",
+            type: "endpoint_collision",
+            message: `Endpoint '${endpoint}' is defined in multiple specs: ${specNames.join(", ")}`,
+            specs: specNames
+          });
+        }
+      }
+      const schemaMap = /* @__PURE__ */ new Map();
+      for (const { name, parsed } of parsedSpecs) {
+        const schemas = extractSchemaNames(parsed);
+        for (const s of schemas) {
+          if (!schemaMap.has(s.name)) schemaMap.set(s.name, []);
+          schemaMap.get(s.name).push({ spec: name, hash: s.hash });
+        }
+      }
+      for (const [schemaName, definitions] of schemaMap) {
+        if (definitions.length > 1) {
+          const uniqueHashes = new Set(definitions.map((d) => d.hash));
+          if (uniqueHashes.size > 1) {
+            const specNames = definitions.map((d) => d.spec);
+            issues.push({
+              severity: "warning",
+              type: "schema_conflict",
+              message: `Schema '${schemaName}' has conflicting definitions across specs: ${specNames.join(", ")}`,
+              specs: specNames
+            });
+          }
+        }
+      }
+      for (const { name, parsed } of parsedSpecs) {
+        const defined = extractDefinedScopes(parsed);
+        const used = extractUsedScopes(parsed);
+        for (const scope of used) {
+          if (!defined.has(scope)) {
+            issues.push({
+              severity: "warning",
+              type: "undefined_scope",
+              message: `Scope '${scope}' is used in '${name}' but not defined in securitySchemes`,
+              specs: [name]
+            });
+          }
+        }
+        for (const scope of defined) {
+          if (!used.has(scope)) {
+            issues.push({
+              severity: "info",
+              type: "unused_scope",
+              message: `Scope '${scope}' is defined in '${name}' but never used in any operation`,
+              specs: [name]
+            });
+          }
+        }
+      }
+      for (const { name, parsed } of parsedSpecs) {
+        const refs = extractRefs(parsed);
+        for (const ref of refs) {
+          if (!refResolves(parsed, ref)) {
+            issues.push({
+              severity: "error",
+              type: "unresolved_ref",
+              message: `$ref '${ref}' in '${name}' does not resolve`,
+              specs: [name]
+            });
+          }
+        }
+      }
+      let totalEndpoints = 0;
+      let totalSchemas = 0;
+      for (const { parsed } of parsedSpecs) {
+        totalEndpoints += extractEndpoints(parsed).length;
+        totalSchemas += extractSchemaNames(parsed).length;
+      }
+      const hasErrors = issues.some((i) => i.severity === "error");
+      return {
+        valid: !hasErrors,
+        issues,
+        stats: {
+          specs_count: parsedSpecs.length,
+          endpoints_count: totalEndpoints,
+          schemas_count: totalSchemas
+        }
+      };
+    }
+    module2.exports = {
+      validateRegistry,
+      safeParse,
+      validateOpenApiSpec,
+      // Exported for testing
+      extractEndpoints,
+      extractSchemaNames,
+      extractDefinedScopes,
+      extractUsedScopes,
+      extractRefs,
+      refResolves
+    };
+  }
+});
+
+// src/commands/registry-gate.js
+var require_registry_gate = __commonJS({
+  "src/commands/registry-gate.js"(exports2, module2) {
+    "use strict";
+    var fs = require("fs");
+    var path = require("path");
+    var chalk = require_source();
+    var { matchGlob } = require_cjs4();
+    var {
+      validateRegistry,
+      safeParse,
+      validateOpenApiSpec
+    } = require_registry_validation_core();
+    if (process.env.NO_COLOR) chalk.level = 0;
+    var SPEC_EXT = /* @__PURE__ */ new Set([".yaml", ".yml", ".json"]);
+    function walkSpecCandidates(rootDir, {
+      readdirSync = fs.readdirSync.bind(fs),
+      statSync = fs.statSync.bind(fs)
+    } = {}) {
+      const out = [];
+      function walk(absDir) {
+        let entries;
+        try {
+          entries = readdirSync(absDir, { withFileTypes: true });
+        } catch (err) {
+          const e = new Error(`Cannot read directory ${absDir}: ${err && err.message}`);
+          e.code = "GATE_ERROR";
+          e.path = absDir;
+          throw e;
+        }
+        for (const ent of entries) {
+          const name = ent.name;
+          if (name === "node_modules" || name.startsWith(".")) continue;
+          const abs = path.join(absDir, name);
+          let isDir = ent.isDirectory && ent.isDirectory();
+          let isFile = ent.isFile && ent.isFile();
+          if (!isDir && !isFile) {
+            try {
+              const st = statSync(abs);
+              isDir = st.isDirectory();
+              isFile = st.isFile();
+            } catch (err) {
+              const e = new Error(`Cannot stat ${abs}: ${err && err.message}`);
+              e.code = "GATE_ERROR";
+              e.path = abs;
+              throw e;
+            }
+          }
+          if (isDir) {
+            walk(abs);
+            continue;
+          }
+          if (isFile) {
+            const ext = path.extname(name).toLowerCase();
+            if (SPEC_EXT.has(ext)) out.push(abs);
+          }
+        }
+      }
+      walk(rootDir);
+      return out.sort();
+    }
+    function relPosix(rootDir, absPath) {
+      let rel = path.relative(rootDir, absPath);
+      if (path.sep !== "/") rel = rel.split(path.sep).join("/");
+      return rel;
+    }
+    function readFileThreeState(absPath, readFileSync = fs.readFileSync.bind(fs)) {
+      try {
+        const content = readFileSync(absPath, "utf8");
+        return { ok: true, content: content == null ? "" : String(content) };
+      } catch (err) {
+        const msg = err && err.message ? String(err.message) : String(err);
+        return {
+          ok: false,
+          code: "GATE_ERROR",
+          message: `unreadable file: ${absPath} (${msg.slice(0, 200)})`,
+          path: absPath
+        };
+      }
+    }
+    function discoverRegistrySpecs(dir, {
+      glob = null,
+      readdirSync = fs.readdirSync.bind(fs),
+      readFileSync = fs.readFileSync.bind(fs),
+      statSync = fs.statSync.bind(fs)
+    } = {}) {
+      const rootDir = path.resolve(dir);
+      let candidates;
+      try {
+        candidates = walkSpecCandidates(rootDir, { readdirSync, statSync });
+      } catch (err) {
+        return {
+          ok: false,
+          code: err.code || "GATE_ERROR",
+          message: err.message || String(err),
+          path: err.path
+        };
+      }
+      if (glob) {
+        candidates = candidates.filter((abs) => matchGlob(glob, relPosix(rootDir, abs)));
+      }
+      const specs = [];
+      let skippedNonSpec = 0;
+      for (const abs of candidates) {
+        const read = readFileThreeState(abs, readFileSync);
+        if (!read.ok) {
+          return {
+            ok: false,
+            code: "GATE_ERROR",
+            message: read.message,
+            path: read.path || abs
+          };
+        }
+        const name = relPosix(rootDir, abs);
+        const parsed = safeParse(read.content);
+        if (!parsed || typeof parsed !== "object") {
+          specs.push({ name, spec: read.content });
+          continue;
+        }
+        const shape = validateOpenApiSpec(parsed);
+        if (!shape.valid) {
+          if (shape.error && shape.error.includes("Missing required field: 'openapi' or 'swagger'")) {
+            skippedNonSpec += 1;
+            continue;
+          }
+          specs.push({ name, spec: read.content });
+          continue;
+        }
+        specs.push({ name, spec: read.content });
+      }
+      return {
+        ok: true,
+        specs,
+        skippedNonSpec,
+        candidates: candidates.length,
+        rootDir
+      };
+    }
+    function findingsFailGate(issues, { warnOnly = false, errorsOnly = false } = {}) {
+      if (warnOnly) return false;
+      for (const i of issues || []) {
+        if (i.severity === "error") return true;
+        if (i.severity === "warning" && !errorsOnly) return true;
+      }
+      return false;
+    }
+    function countBySeverity(issues) {
+      const c = { error: 0, warning: 0, info: 0 };
+      for (const i of issues || []) {
+        if (i.severity === "error") c.error += 1;
+        else if (i.severity === "warning") c.warning += 1;
+        else if (i.severity === "info") c.info += 1;
+      }
+      return c;
+    }
+    function severityColor(sev) {
+      if (sev === "error") return chalk.red;
+      if (sev === "warning") return chalk.yellow;
+      return chalk.cyan;
+    }
+    function printFindings(issues, log) {
+      for (const i of issues || []) {
+        const color = severityColor(i.severity);
+        const files = Array.isArray(i.specs) ? i.specs.join(", ") : "";
+        log(color(`[${i.severity}] ${i.type}`) + (files ? chalk.dim(`  ${files}`) : ""));
+        log(`  ${i.message}`);
+      }
+    }
+    function runRegistryGate(options = {}, deps = {}) {
+      const log = deps.log || console.log.bind(console);
+      const logErr = deps.logErr || console.error.bind(console);
+      const cwd = deps.cwd || process.cwd();
+      const dirArg = options.dir != null && options.dir !== "" ? options.dir : ".";
+      const rootDir = path.isAbsolute(dirArg) ? dirArg : path.resolve(cwd, dirArg);
+      const readdirSync = deps.readdirSync || fs.readdirSync.bind(fs);
+      const readFileSync = deps.readFileSync || fs.readFileSync.bind(fs);
+      const statSync = deps.statSync || fs.statSync.bind(fs);
+      const existsSync = deps.existsSync || fs.existsSync.bind(fs);
+      if (!existsSync(rootDir)) {
+        const msg = `CodeRifts registry-gate: GATE_ERROR \u2014 directory not found: ${rootDir}`;
+        logErr(chalk.red(msg));
+        return { ok: false, exitCode: 1, code: "GATE_ERROR", message: msg };
+      }
+      let st;
+      try {
+        st = statSync(rootDir);
+      } catch (err) {
+        const msg = `CodeRifts registry-gate: GATE_ERROR \u2014 cannot access ${rootDir}: ${err && err.message}`;
+        logErr(chalk.red(msg));
+        return { ok: false, exitCode: 1, code: "GATE_ERROR", message: msg };
+      }
+      if (!st.isDirectory()) {
+        const msg = `CodeRifts registry-gate: GATE_ERROR \u2014 not a directory: ${rootDir}`;
+        logErr(chalk.red(msg));
+        return { ok: false, exitCode: 1, code: "GATE_ERROR", message: msg };
+      }
+      const discovered = discoverRegistrySpecs(rootDir, {
+        glob: options.glob || null,
+        readdirSync,
+        readFileSync,
+        statSync
+      });
+      if (!discovered.ok) {
+        const msg = `CodeRifts registry-gate: ${discovered.code} \u2014 ${discovered.message}`;
+        logErr(chalk.red(msg));
+        return {
+          ok: false,
+          exitCode: 1,
+          code: discovered.code || "GATE_ERROR",
+          message: discovered.message,
+          path: discovered.path
+        };
+      }
+      if (discovered.specs.length === 0) {
+        const msg = `CodeRifts registry-gate: REGISTRY_EMPTY \u2014 no OpenAPI/Swagger specs discovered (scanned ${discovered.candidates} yaml/json file(s), skipped non-spec: ${discovered.skippedNonSpec}). An admission gate guarding nothing must fail, not pass.`;
+        logErr(chalk.red(msg));
+        return {
+          ok: false,
+          exitCode: 1,
+          code: "REGISTRY_EMPTY",
+          message: msg,
+          skippedNonSpec: discovered.skippedNonSpec,
+          candidates: discovered.candidates
+        };
+      }
+      const result = validateRegistry(discovered.specs);
+      const counts = countBySeverity(result.issues);
+      const mode = {
+        warnOnly: !!options.warnOnly,
+        errorsOnly: !!options.errorsOnly
+      };
+      const fail = findingsFailGate(result.issues, mode);
+      if (result.issues.length > 0) {
+        printFindings(result.issues, log);
+      }
+      const summary = [
+        `specs=${result.stats.specs_count}`,
+        `endpoints=${result.stats.endpoints_count}`,
+        `schemas=${result.stats.schemas_count}`,
+        `errors=${counts.error}`,
+        `warnings=${counts.warning}`,
+        `info=${counts.info}`,
+        discovered.skippedNonSpec ? `skipped_non_spec=${discovered.skippedNonSpec}` : null,
+        mode.warnOnly ? "mode=warn-only" : mode.errorsOnly ? "mode=errors-only" : "mode=default",
+        fail ? "FAIL" : "PASS"
+      ].filter(Boolean).join("  ");
+      if (fail) {
+        log(chalk.red(`CodeRifts registry-gate: ${summary}`));
+      } else {
+        log(chalk.green(`CodeRifts registry-gate: ${summary}`));
+      }
+      if (counts.error === 0 && counts.warning === 0 && counts.info === 0) {
+        log(chalk.dim("  checks: endpoint_collision, schema_conflict, scopes, unresolved_ref \u2014 no findings"));
+      }
+      return {
+        ok: !fail,
+        exitCode: fail ? 1 : 0,
+        code: fail ? "REGISTRY_FINDINGS" : "REGISTRY_OK",
+        issues: result.issues,
+        stats: result.stats,
+        counts,
+        skippedNonSpec: discovered.skippedNonSpec,
+        candidates: discovered.candidates,
+        warnOnly: mode.warnOnly,
+        errorsOnly: mode.errorsOnly
+      };
+    }
+    module2.exports = {
+      runRegistryGate,
+      discoverRegistrySpecs,
+      walkSpecCandidates,
+      findingsFailGate,
+      countBySeverity,
+      readFileThreeState,
+      relPosix
+    };
+  }
+});
+
 // src/commands/init.js
 var require_init = __commonJS({
   "src/commands/init.js"(exports2, module2) {
@@ -69772,6 +70360,63 @@ notifications:
     on_breaking: true
     on_risk_above: 60
 
+overlap_detection: true
+generator_detection: true
+`
+      },
+      "ai-agent-platform": {
+        aliases: ["ai-agent-platform", "ai-agent", "agent", "mcp"],
+        label: "AI Agent Platform",
+        description: "Zero-tolerance removals for agent/MCP-consumed APIs",
+        yaml: `# CodeRifts Policy: AI Agent Platform
+# For APIs consumed by AI agents and MCP tool surfaces.
+# Agent consumers cannot renegotiate contracts at runtime \u2014 a removed field
+# or endpoint is a hard break for automated callers (no human can "adapt").
+# Portable policy vocabulary only (same keys as other templates).
+
+failOnBreaking: true
+
+policy:
+  # Zero tolerance: any breaking change blocks the check.
+  max_breaking_changes: 0
+  # Removals that break tool schemas / agent bindings are never silent.
+  no_delete_endpoints: true
+  no_delete_required_fields: true
+  require_deprecation_before_removal: true
+  require_version_bump_on_breaking: true
+  # Freeze merges when risk is elevated (agents amplify blast radius).
+  freeze_on_risk_score: 55
+
+# Who must approve high-impact contract changes for agent-facing surfaces.
+approval_matrix:
+  endpoint_removal:
+    - agent-platform-owners
+    - api-governance
+  field_removal:
+    - agent-platform-owners
+  auth_change:
+    - security-team
+    - agent-platform-owners
+  type_change:
+    - agent-platform-owners
+
+freeze_periods: []
+
+risk_scoring:
+  # dimension_weights is the key the engine reads (0-100 scale, relative weights)
+  dimension_weights:
+    revenue_impact: 20
+    blast_radius: 35
+    app_compatibility: 30
+    security: 15
+
+linting:
+  enabled: true
+  rules:
+    naming_convention: true
+    consistent_errors: true
+    pagination_pattern: true
+
 overlap_detection: true
 generator_detection: true
 `
@@ -69793,7 +70438,8 @@ generator_detection: true
         ["growth", "Balanced between speed and safety"],
         ["fintech", "Maximum governance for regulated industries"],
         ["public-api", "Backward compatibility for external consumers"],
-        ["microservices", "Internal service-to-service with blast radius focus"]
+        ["microservices", "Internal service-to-service with blast radius focus"],
+        ["ai-agent", "Zero-tolerance removals for agent/MCP-consumed APIs"]
       ];
       for (const [name, desc] of entries) {
         console.log(`    ${chalk.cyan(name.padEnd(16))}${chalk.dim(desc)}`);
@@ -69829,9 +70475,10 @@ generator_detection: true
       console.log("");
       console.log(chalk.green(`  Created .coderifts.yml with ${tmpl.label} policy template.`));
       console.log(chalk.dim(`  Edit the file to customize approval teams, freeze periods, and domain mappings.`));
+      console.log(chalk.dim(`  Agent-using repo? Run: coderifts agent-setup`));
       console.log("");
     }
-    module2.exports = { init, TEMPLATES };
+    module2.exports = { init, TEMPLATES, resolveTemplate };
   }
 });
 
@@ -95188,6 +95835,679 @@ var require_login = __commonJS({
   }
 });
 
+// src/commands/setup-required-check.js
+var require_setup_required_check = __commonJS({
+  "src/commands/setup-required-check.js"(exports2, module2) {
+    "use strict";
+    var { execFileSync } = require("child_process");
+    var chalk = require_source();
+    if (process.env.NO_COLOR) chalk.level = 0;
+    var CHECK_NAME = "CodeRifts / contract-gate";
+    var EXIT = {
+      OK: 0,
+      /** Target already required or dry-run printed successfully. */
+      NEEDS_APPLY: 0,
+      /** Unknown / permission / gh missing / verify failed. */
+      ERROR: 1,
+      PERMISSION: 2
+    };
+    function extractRequiredContexts(protection) {
+      if (!protection || typeof protection !== "object") return [];
+      const rsc = protection.required_status_checks;
+      if (!rsc || typeof rsc !== "object") return [];
+      if (Array.isArray(rsc.contexts) && rsc.contexts.length) {
+        return rsc.contexts.map((c) => String(c));
+      }
+      if (Array.isArray(rsc.checks)) {
+        return rsc.checks.map((c) => c && c.context != null ? String(c.context) : "").filter(Boolean);
+      }
+      return [];
+    }
+    function classifyObservation(read, contextName = CHECK_NAME) {
+      const status = read && read.status != null ? Number(read.status) : null;
+      if (status === 404) {
+        return {
+          state: "ABSENT",
+          context_is_required: false,
+          required_contexts: [],
+          protection: null,
+          observation_error: null
+        };
+      }
+      if (status === 403) {
+        return {
+          state: "UNKNOWN",
+          context_is_required: false,
+          required_contexts: [],
+          protection: null,
+          observation_error: "403",
+          permission_hint: "administration:read (or repo admin) required to read branch protection"
+        };
+      }
+      if (status != null && status >= 400) {
+        return {
+          state: "UNKNOWN",
+          context_is_required: false,
+          required_contexts: [],
+          protection: null,
+          observation_error: String(status),
+          permission_hint: read.errorMessage || `GitHub API returned HTTP ${status}`
+        };
+      }
+      const protection = read && read.body && typeof read.body === "object" ? read.body : null;
+      if (!protection) {
+        return {
+          state: "ABSENT",
+          context_is_required: false,
+          required_contexts: [],
+          protection: null,
+          observation_error: null
+        };
+      }
+      const required_contexts = extractRequiredContexts(protection);
+      const context_is_required = required_contexts.some((c) => c === contextName);
+      if (context_is_required) {
+        return {
+          state: "REQUIRED",
+          context_is_required: true,
+          required_contexts,
+          protection,
+          observation_error: null
+        };
+      }
+      return {
+        state: "PRESENT_NOT_REQUIRED",
+        context_is_required: false,
+        required_contexts,
+        protection,
+        observation_error: null
+      };
+    }
+    function buildProtectionUpdatePayload(protection, contextName = CHECK_NAME) {
+      const p = protection && typeof protection === "object" ? protection : {};
+      const prev = p.required_status_checks && typeof p.required_status_checks === "object" ? p.required_status_checks : {};
+      const contexts = extractRequiredContexts(p);
+      const nextContexts = contexts.includes(contextName) ? contexts.slice() : contexts.concat([contextName]);
+      const body = {
+        required_status_checks: {
+          strict: prev.strict === true,
+          contexts: nextContexts,
+          // Prefer also sending checks[] when the API used that shape so app ids survive when present.
+          ...Array.isArray(prev.checks) && prev.checks.length ? {
+            checks: nextContexts.map((ctx) => {
+              const existing = prev.checks.find((c) => c && c.context === ctx);
+              return existing && existing.app_id != null ? { context: ctx, app_id: existing.app_id } : { context: ctx };
+            })
+          } : {}
+        },
+        enforce_admins: !!(p.enforce_admins && p.enforce_admins.enabled),
+        required_pull_request_reviews: p.required_pull_request_reviews ? serializePrReviews(p.required_pull_request_reviews) : null,
+        restrictions: p.restrictions ? {
+          users: (p.restrictions.users || []).map((u) => u.login || u).filter(Boolean),
+          teams: (p.restrictions.teams || []).map((t) => t.slug || t).filter(Boolean),
+          apps: (p.restrictions.apps || []).map((a) => a.slug || a).filter(Boolean)
+        } : null
+      };
+      if (typeof p.required_linear_history === "boolean") {
+        body.required_linear_history = p.required_linear_history;
+      } else if (p.required_linear_history && typeof p.required_linear_history.enabled === "boolean") {
+        body.required_linear_history = p.required_linear_history.enabled;
+      }
+      if (typeof p.allow_force_pushes === "boolean") {
+        body.allow_force_pushes = p.allow_force_pushes;
+      } else if (p.allow_force_pushes && typeof p.allow_force_pushes.enabled === "boolean") {
+        body.allow_force_pushes = p.allow_force_pushes.enabled;
+      }
+      if (typeof p.allow_deletions === "boolean") {
+        body.allow_deletions = p.allow_deletions;
+      } else if (p.allow_deletions && typeof p.allow_deletions.enabled === "boolean") {
+        body.allow_deletions = p.allow_deletions.enabled;
+      }
+      if (typeof p.block_creations === "boolean") {
+        body.block_creations = p.block_creations;
+      } else if (p.block_creations && typeof p.block_creations.enabled === "boolean") {
+        body.block_creations = p.block_creations.enabled;
+      }
+      if (typeof p.required_conversation_resolution === "boolean") {
+        body.required_conversation_resolution = p.required_conversation_resolution;
+      } else if (p.required_conversation_resolution && typeof p.required_conversation_resolution.enabled === "boolean") {
+        body.required_conversation_resolution = p.required_conversation_resolution.enabled;
+      }
+      return body;
+    }
+    function serializePrReviews(rpr) {
+      if (!rpr || typeof rpr !== "object") return null;
+      return {
+        dismiss_stale_reviews: !!rpr.dismiss_stale_reviews,
+        require_code_owner_reviews: !!rpr.require_code_owner_reviews,
+        required_approving_review_count: Number(rpr.required_approving_review_count) || 0,
+        require_last_push_approval: !!rpr.require_last_push_approval,
+        ...Array.isArray(rpr.bypass_pull_request_allowances?.users) ? {
+          bypass_pull_request_allowances: {
+            users: (rpr.bypass_pull_request_allowances.users || []).map((u) => u.login || u).filter(Boolean),
+            teams: (rpr.bypass_pull_request_allowances.teams || []).map((t) => t.slug || t).filter(Boolean),
+            apps: (rpr.bypass_pull_request_allowances.apps || []).map((a) => a.slug || a).filter(Boolean)
+          }
+        } : {}
+      };
+    }
+    function detectRulesetRequiredCheck(rulesets, contextName = CHECK_NAME) {
+      const names = [];
+      const list = Array.isArray(rulesets) ? rulesets : [];
+      for (const rs of list) {
+        if (!rs || typeof rs !== "object") continue;
+        const rules = Array.isArray(rs.rules) ? rs.rules : [];
+        for (const rule of rules) {
+          if (!rule || rule.type !== "required_status_checks") continue;
+          const params = rule.parameters || {};
+          const checks = Array.isArray(params.required_status_checks) ? params.required_status_checks : Array.isArray(params.contexts) ? params.contexts.map((c) => ({ context: c })) : [];
+          for (const c of checks) {
+            const ctx = typeof c === "string" ? c : c && c.context;
+            if (ctx === contextName) {
+              names.push(String(rs.name || rs.id || "ruleset"));
+            }
+          }
+        }
+      }
+      return { enforced: names.length > 0, ruleset_names: [...new Set(names)] };
+    }
+    function defaultGit(args, cwd) {
+      return execFileSync("git", args, {
+        cwd: cwd || process.cwd(),
+        encoding: "utf8",
+        maxBuffer: 4 * 1024 * 1024,
+        stdio: ["ignore", "pipe", "pipe"]
+      }).trim();
+    }
+    function parseGitHubRemote(remoteUrl) {
+      const s = String(remoteUrl || "").trim();
+      let m = s.match(/^git@github\.com:([^/]+)\/([^/]+?)(?:\.git)?$/i);
+      if (m) return { owner: m[1], repo: m[2].replace(/\.git$/i, "") };
+      m = s.match(/^https?:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/i);
+      if (m) return { owner: m[1], repo: m[2].replace(/\.git$/i, "") };
+      m = s.match(/^ssh:\/\/git@github\.com\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/i);
+      if (m) return { owner: m[1], repo: m[2].replace(/\.git$/i, "") };
+      return null;
+    }
+    function resolveOwnerRepo(cwd, gitImpl = defaultGit) {
+      let url;
+      try {
+        url = gitImpl(["remote", "get-url", "origin"], cwd);
+      } catch {
+        try {
+          url = gitImpl(["config", "--get", "remote.origin.url"], cwd);
+        } catch {
+          return null;
+        }
+      }
+      return parseGitHubRemote(url);
+    }
+    function resolveDefaultBranch(cwd, gitImpl = defaultGit) {
+      try {
+        const ref = gitImpl(["symbolic-ref", "refs/remotes/origin/HEAD"], cwd);
+        const m = ref.match(/refs\/remotes\/origin\/(.+)$/);
+        if (m) return m[1];
+      } catch {
+      }
+      for (const b of ["main", "master"]) {
+        try {
+          gitImpl(["rev-parse", "--verify", `origin/${b}`], cwd);
+          return b;
+        } catch {
+        }
+      }
+      try {
+        return gitImpl(["branch", "--show-current"], cwd) || "main";
+      } catch {
+        return "main";
+      }
+    }
+    function defaultGhAvailable() {
+      try {
+        execFileSync("gh", ["--version"], { stdio: ["ignore", "pipe", "pipe"], encoding: "utf8" });
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    function runGhApi(args, { cwd, ghRunner } = {}) {
+      const runner = ghRunner || ((a, c) => execFileSync("gh", a, {
+        cwd: c || process.cwd(),
+        encoding: "utf8",
+        maxBuffer: 8 * 1024 * 1024,
+        stdio: ["ignore", "pipe", "pipe"]
+      }));
+      try {
+        const raw = runner(["api", ...args], cwd);
+        let body = null;
+        try {
+          body = JSON.parse(raw);
+        } catch {
+          body = raw;
+        }
+        return { ok: true, status: 200, body, raw: String(raw) };
+      } catch (err) {
+        const stderr = err && err.stderr ? String(err.stderr) : "";
+        const stdout = err && err.stdout ? String(err.stdout) : "";
+        const msg = stderr || err && err.message || String(err);
+        const m = msg.match(/HTTP\s+(\d{3})/i) || stdout.match(/"status"\s*:\s*"(\d{3})"/);
+        const status = m ? Number(m[1]) : err && err.status === 1 ? null : null;
+        let body = null;
+        try {
+          body = JSON.parse(stdout);
+        } catch {
+        }
+        let httpStatus = status;
+        if (httpStatus == null) {
+          if (/403|Forbidden|Resource not accessible/i.test(msg)) httpStatus = 403;
+          else if (/404|Not Found/i.test(msg)) httpStatus = 404;
+          else httpStatus = 500;
+        }
+        return {
+          ok: false,
+          status: httpStatus,
+          body,
+          raw: stdout || msg,
+          errorMessage: msg.slice(0, 400)
+        };
+      }
+    }
+    function protectionGetPath(owner, repo, branch) {
+      return `repos/${owner}/${repo}/branches/${encodeURIComponent(branch)}/protection`;
+    }
+    function protectionPutArgs(owner, repo, branch, payload) {
+      return {
+        args: [
+          "--method",
+          "PUT",
+          protectionGetPath(owner, repo, branch),
+          "--input",
+          "-"
+        ],
+        input: JSON.stringify(payload)
+      };
+    }
+    function printApplyCommand(owner, repo, branch, payload) {
+      const path = protectionGetPath(owner, repo, branch);
+      const json = JSON.stringify(payload, null, 2);
+      return [
+        `# Read-modify-write: add '${CHECK_NAME}' to required status checks (preserves other settings)`,
+        `gh api --method PUT ${path} --input - <<'EOF'`,
+        json,
+        "EOF"
+      ].join("\n");
+    }
+    async function runSetupRequiredCheck(options = {}, deps = {}) {
+      const cwd = deps.cwd || process.cwd();
+      const gitImpl = deps.gitImpl || defaultGit;
+      const log = deps.log || console.log.bind(console);
+      const logErr = deps.logErr || console.error.bind(console);
+      const ghAvailable = deps.ghAvailable != null ? deps.ghAvailable : defaultGhAvailable;
+      const ghRunner = deps.ghRunner;
+      const runApi = deps.runGhApi || ((args, o) => runGhApi(args, { ...o, ghRunner }));
+      const doExit = deps.exit !== false;
+      const finish = (code, payload2) => {
+        if (options.json) log(JSON.stringify(payload2, null, 2));
+        if (doExit) process.exit(code);
+        return { exitCode: code, ...payload2 };
+      };
+      const ownerRepo = options.repo ? (() => {
+        const m = String(options.repo).match(/^([^/]+)\/([^/]+)$/);
+        return m ? { owner: m[1], repo: m[2] } : null;
+      })() : resolveOwnerRepo(cwd, gitImpl);
+      if (!ownerRepo) {
+        logErr(chalk.red("Could not resolve owner/repo from git remote origin (or --repo OWNER/REPO)."));
+        return finish(EXIT.ERROR, { ok: false, code: "REPO_UNRESOLVED" });
+      }
+      const { owner, repo } = ownerRepo;
+      const branch = options.branch || resolveDefaultBranch(cwd, gitImpl);
+      if (!ghAvailable()) {
+        logErr(chalk.yellow("GitHub CLI (`gh`) not found on PATH."));
+        logErr("Install: https://cli.github.com/  then: gh auth login");
+        logErr("");
+        logErr("Manual check (your credentials, not a CodeRifts key):");
+        logErr(`  gh api ${protectionGetPath(owner, repo, branch)}`);
+        logErr("");
+        logErr(`Required check name: ${CHECK_NAME}`);
+        logErr("The CodeRifts App never writes branch protection (needs administration:write).");
+        return finish(EXIT.ERROR, { ok: false, code: "GH_MISSING", owner, repo, branch, check: CHECK_NAME });
+      }
+      const getPath = protectionGetPath(owner, repo, branch);
+      const read = runApi([getPath], { cwd });
+      const obs = classifyObservation(read, CHECK_NAME);
+      let ruleset = { enforced: false, ruleset_names: [] };
+      try {
+        const rsList = runApi([`repos/${owner}/${repo}/rulesets`], { cwd });
+        if (rsList.ok && Array.isArray(rsList.body)) {
+          const detailed = [];
+          for (const rs of rsList.body) {
+            if (!rs || rs.id == null) continue;
+            const one = runApi([`repos/${owner}/${repo}/rulesets/${rs.id}`], { cwd });
+            if (one.ok && one.body) detailed.push(one.body);
+            else detailed.push(rs);
+          }
+          ruleset = detectRulesetRequiredCheck(detailed.length ? detailed : rsList.body, CHECK_NAME);
+        }
+      } catch {
+      }
+      const basePayload = {
+        ok: true,
+        owner,
+        repo,
+        branch,
+        check: CHECK_NAME,
+        classic: obs.state,
+        context_is_required: obs.context_is_required,
+        required_contexts: obs.required_contexts,
+        ruleset_enforced: ruleset.enforced,
+        ruleset_names: ruleset.ruleset_names
+      };
+      if (ruleset.enforced) {
+        if (!options.json) {
+          log(chalk.green(`Required via repository ruleset: ${CHECK_NAME}`));
+          log(`  repo:     ${owner}/${repo}`);
+          log(`  branch:   ${branch}`);
+          log(`  rulesets: ${ruleset.ruleset_names.join(", ") || "(named)"}`);
+          log("  Classic branch protection may still be ABSENT \u2014 rulesets enforce separately.");
+        }
+        return finish(EXIT.OK, { ...basePayload, code: "RULESET_REQUIRED" });
+      }
+      if (obs.state === "REQUIRED") {
+        if (!options.json) {
+          log(chalk.green(`Already required: '${CHECK_NAME}'`));
+          log(`  repo:   ${owner}/${repo}`);
+          log(`  branch: ${branch}`);
+          log("  (classic branch protection \u2014 idempotent; nothing to do)");
+        }
+        return finish(EXIT.OK, { ...basePayload, code: "ALREADY_REQUIRED" });
+      }
+      if (obs.state === "UNKNOWN") {
+        if (!options.json) {
+          logErr(chalk.red("Cannot observe branch protection (UNKNOWN)."));
+          logErr(`  HTTP: ${obs.observation_error || "unknown"}`);
+          logErr(`  ${obs.permission_hint || "An admin with administration:read must run this command."}`);
+          logErr("  The CodeRifts App never writes protection; an admin must grant or run this.");
+        }
+        return finish(EXIT.PERMISSION, { ...basePayload, ok: false, code: "PERMISSION", observation_error: obs.observation_error });
+      }
+      let payload;
+      if (obs.state === "ABSENT" || !obs.protection) {
+        payload = {
+          required_status_checks: {
+            strict: false,
+            contexts: [CHECK_NAME]
+          },
+          enforce_admins: false,
+          required_pull_request_reviews: null,
+          restrictions: null
+        };
+      } else {
+        payload = buildProtectionUpdatePayload(obs.protection, CHECK_NAME);
+      }
+      const cmdText = printApplyCommand(owner, repo, branch, payload);
+      if (!options.apply) {
+        if (!options.json) {
+          log(chalk.yellow(`Status: ${obs.state} \u2014 '${CHECK_NAME}' is not a required check.`));
+          log(`  repo:   ${owner}/${repo}`);
+          log(`  branch: ${branch}`);
+          log("");
+          log("Dry-run (default). Exact command to add the required check with your credentials:");
+          log("");
+          log(cmdText);
+          log("");
+          log("Re-run with --apply to execute that PUT and re-verify.");
+          log("Why the App never writes this: administration:write is a trust jump we refuse (audit 3.4/1, 3.5).");
+        }
+        return finish(EXIT.NEEDS_APPLY, {
+          ...basePayload,
+          code: "NEEDS_APPLY",
+          apply_command: cmdText,
+          apply_payload: payload
+        });
+      }
+      const put = protectionPutArgs(owner, repo, branch, payload);
+      let putResult;
+      if (deps.ghApply) {
+        putResult = deps.ghApply(put, { cwd });
+      } else {
+        try {
+          const raw = execFileSync("gh", ["api", ...put.args], {
+            cwd,
+            encoding: "utf8",
+            input: put.input,
+            maxBuffer: 8 * 1024 * 1024,
+            stdio: ["pipe", "pipe", "pipe"]
+          });
+          putResult = { ok: true, status: 200, body: JSON.parse(raw || "{}"), raw };
+        } catch (err) {
+          const msg = err && err.stderr ? String(err.stderr) : err && err.message || String(err);
+          const m = msg.match(/HTTP\s+(\d{3})/i);
+          putResult = {
+            ok: false,
+            status: m ? Number(m[1]) : 500,
+            errorMessage: msg.slice(0, 400),
+            raw: msg
+          };
+        }
+      }
+      if (!putResult.ok) {
+        if (!options.json) {
+          logErr(chalk.red("Apply failed."));
+          logErr(`  ${putResult.errorMessage || putResult.status}`);
+          if (putResult.status === 403) {
+            logErr("  Need administration:write on the repository (admin).");
+          }
+        }
+        return finish(
+          putResult.status === 403 ? EXIT.PERMISSION : EXIT.ERROR,
+          { ...basePayload, ok: false, code: "APPLY_FAILED", apply_status: putResult.status }
+        );
+      }
+      const reRead = runApi([getPath], { cwd });
+      const reObs = classifyObservation(reRead, CHECK_NAME);
+      if (reObs.state !== "REQUIRED") {
+        if (!options.json) {
+          logErr(chalk.red("Apply returned success but re-read did not show the check as required."));
+          logErr(`  classic state after apply: ${reObs.state}`);
+          logErr("  Unverified apply is not success.");
+        }
+        return finish(EXIT.ERROR, {
+          ...basePayload,
+          ok: false,
+          code: "VERIFY_FAILED",
+          classic_after: reObs.state
+        });
+      }
+      if (!options.json) {
+        log(chalk.green(`Success: '${CHECK_NAME}' is now required.`));
+        log(`  repo:   ${owner}/${repo}`);
+        log(`  branch: ${branch}`);
+      }
+      return finish(EXIT.OK, {
+        ...basePayload,
+        code: "APPLIED",
+        classic: "REQUIRED",
+        context_is_required: true
+      });
+    }
+    module2.exports = {
+      runSetupRequiredCheck,
+      CHECK_NAME,
+      EXIT,
+      extractRequiredContexts,
+      classifyObservation,
+      buildProtectionUpdatePayload,
+      detectRulesetRequiredCheck,
+      parseGitHubRemote,
+      resolveOwnerRepo,
+      resolveDefaultBranch,
+      printApplyCommand,
+      protectionGetPath,
+      protectionPutArgs,
+      runGhApi
+    };
+  }
+});
+
+// src/commands/status.js
+var require_status = __commonJS({
+  "src/commands/status.js"(exports2, module2) {
+    "use strict";
+    var chalk = require_source();
+    var { getApiKey } = require_config();
+    var { cloudGetEnforcementStatus } = require_cloud();
+    var { renderJson } = require_json2();
+    if (process.env.NO_COLOR) chalk.level = 0;
+    var USAGE = [
+      "Usage: coderifts status --repo owner/repo",
+      "   or: coderifts status owner/repo",
+      "",
+      "Read-only: prints the cross-layer enforcement report from the CodeRifts API.",
+      "Requires a cloud API key (coderifts login or CODERIFTS_API_KEY)."
+    ].join("\n");
+    function isValidRepo(full) {
+      const parts = String(full || "").split("/");
+      if (parts.length !== 2) return false;
+      const [owner, repo] = parts.map((p) => p.trim());
+      return !!(owner && repo);
+    }
+    function colorStatus(status) {
+      const s = String(status == null ? "" : status);
+      const upper = s.toUpperCase();
+      if (upper === "ENFORCING") return chalk.green(s);
+      if (upper === "ADVISORY" || s === "declared_required" || s === "declared_optional") {
+        return chalk.yellow(s);
+      }
+      if (upper === "ABSENT" || s === "no_config" || s === "not_observable_from_server") {
+        return chalk.dim(s);
+      }
+      if (upper === "UNKNOWN" || s === "unknown") return chalk.red(s);
+      if (upper === "PARTIAL") return chalk.yellow(s);
+      return chalk.white(s);
+    }
+    function residualsFromReport(report) {
+      const residuals = [];
+      const legs = report && report.legs || {};
+      const merge = legs.merge;
+      if (merge) {
+        if (merge.enforcing !== true) {
+          residuals.push(`merge:${merge.status || "UNKNOWN"}`);
+        }
+      } else {
+        residuals.push("merge:missing");
+      }
+      const deploy = legs.deploy;
+      if (deploy) {
+        residuals.push(`deploy:${deploy.status || "unknown"}`);
+      } else {
+        residuals.push("deploy:missing");
+      }
+      const runtime = legs.runtime;
+      if (runtime) {
+        residuals.push(`runtime:${runtime.status || "not_observable_from_server"}`);
+      }
+      const content = legs.content;
+      if (content) {
+        residuals.push(`content:${content.status || "not_observable_from_server"}`);
+      }
+      return residuals;
+    }
+    function renderStatusReport(report) {
+      const lines = [];
+      const repo = report && report.repo || "(unknown repo)";
+      const legs = report && report.legs || {};
+      const summary = report && report.summary || {};
+      lines.push(chalk.bold(`CodeRifts enforcement \u2014 ${repo}`));
+      if (report && report.timestamp) {
+        lines.push(chalk.dim(`  as of ${report.timestamp}`));
+      }
+      lines.push("");
+      const order = [
+        ["Runtime", legs.runtime],
+        ["Merge", legs.merge],
+        ["Deploy", legs.deploy],
+        ["Content", legs.content]
+      ];
+      for (const [label, leg] of order) {
+        if (!leg) {
+          lines.push(`  ${label.padEnd(10)} ${chalk.dim("\u2014")}`);
+          continue;
+        }
+        const statusStr = colorStatus(leg.status);
+        const enforcing = leg.enforcing === true ? chalk.green("enforcing=true") : chalk.dim("enforcing=false");
+        const epi = leg.epistemic_status ? chalk.dim(` [${leg.epistemic_status}]`) : "";
+        lines.push(`  ${label.padEnd(10)} ${statusStr}  ${enforcing}${epi}`);
+        if (leg.note) {
+          lines.push(chalk.dim(`             ${leg.note.slice(0, 100)}${leg.note.length > 100 ? "\u2026" : ""}`));
+        }
+        if (leg.epistemic_note && leg.leg === "deploy") {
+          lines.push(chalk.dim(`             ${leg.epistemic_note.slice(0, 100)}\u2026`));
+        }
+      }
+      const residuals = residualsFromReport(report);
+      lines.push("");
+      lines.push(`  Residuals: ${residuals.length ? residuals.map((r) => chalk.yellow(r)).join(", ") : chalk.green("(none \u2014 merge enforcing; other legs still not server-observable)")}`);
+      if (summary.status) {
+        lines.push("");
+        lines.push(chalk.dim(`  summary.status: ${summary.status}`));
+        if (summary.can_claim_fully_enforced === false) {
+          lines.push(chalk.dim("  can_claim_fully_enforced: false (server ceiling)"));
+        }
+      }
+      lines.push("");
+      lines.push(chalk.dim("  Read-only report. To close gaps:"));
+      lines.push(chalk.dim("    merge  \u2192 coderifts setup-required-check"));
+      lines.push(chalk.dim("    deploy \u2192 coderifts deploy-gate --enforce (CD step)"));
+      lines.push(chalk.dim("    runtime/content \u2192 wire @coderifts/agent-guard in the agent host"));
+      return lines.join("\n");
+    }
+    async function runStatus(options = {}, deps = {}) {
+      const getKey = deps.getApiKey || getApiKey;
+      const fetchStatus = deps.cloudGetEnforcementStatus || cloudGetEnforcementStatus;
+      const log = deps.log || console.log;
+      const errLog = deps.errLog || console.error;
+      const repo = options.repo != null && String(options.repo).trim() ? String(options.repo).trim() : null;
+      if (!repo) {
+        errLog(chalk.red("Error: missing repo"));
+        errLog(USAGE);
+        return { exitCode: 1, error: "missing_repo" };
+      }
+      if (!isValidRepo(repo)) {
+        errLog(chalk.red("Error: repo must be in owner/repo form (e.g. coderifts/app)"));
+        return { exitCode: 1, error: "invalid_repo" };
+      }
+      const apiKey = getKey();
+      if (!apiKey) {
+        errLog(chalk.red("Error: no API key. Run `coderifts login` or set CODERIFTS_API_KEY."));
+        return { exitCode: 1, error: "missing_api_key" };
+      }
+      let report;
+      try {
+        report = await fetchStatus(repo, apiKey);
+      } catch (e) {
+        const msg = e && e.message ? String(e.message) : "request failed";
+        errLog(chalk.red(`Error: ${msg}`));
+        if (e && e.code) errLog(chalk.dim(`  (${e.code})`));
+        return { exitCode: 1, error: msg };
+      }
+      if (options.json) {
+        log(renderJson(report));
+      } else {
+        log(renderStatusReport(report));
+      }
+      return { exitCode: 0, report };
+    }
+    module2.exports = {
+      runStatus,
+      renderStatusReport,
+      residualsFromReport,
+      colorStatus,
+      isValidRepo,
+      USAGE
+    };
+  }
+});
+
 // src/commands/hook.js
 var require_hook = __commonJS({
   "src/commands/hook.js"(exports2, module2) {
@@ -95425,6 +96745,8 @@ exit 0
       console.log("After upgrading the coderifts CLI, re-run this command so the installed");
       console.log("hook matches the package (already-installed hooks are not auto-updated):");
       console.log("  coderifts hook install");
+      console.log("");
+      console.log("Agent-using repo? Run: coderifts agent-setup");
     }
     function uninstall() {
       const gitDir = findGitDir();
@@ -95481,6 +96803,744 @@ exit 0
   }
 });
 
+// src/commands/enforce.js
+var require_enforce = __commonJS({
+  "src/commands/enforce.js"(exports2, module2) {
+    "use strict";
+    var chalk = require_source();
+    var { getApiKey } = require_config();
+    var { cloudGetEnforcementStatus } = require_cloud();
+    var {
+      renderStatusReport,
+      isValidRepo
+    } = require_status();
+    var { runSetupRequiredCheck } = require_setup_required_check();
+    var path = require("path");
+    var hookMod = require_hook();
+    var hookInstall = hookMod.install;
+    var isCodeRiftsHook = hookMod.isCodeRiftsHook;
+    var findGitDir = hookMod.findGitDir;
+    var getHookPath = typeof hookMod.getHookPath === "function" ? hookMod.getHookPath : (gitDir) => path.join(gitDir, "hooks", "pre-push");
+    if (process.env.NO_COLOR) chalk.level = 0;
+    var USAGE = [
+      "Usage: coderifts enforce --repo owner/repo [--apply]",
+      "   or: coderifts enforce owner/repo [--apply]",
+      "",
+      "Cross-layer orchestrator: reads enforcement-status, then closes gaps by calling existing",
+      "setup commands (setup-required-check, hook install, deploy-gate guidance).",
+      "",
+      "DRY-RUN BY DEFAULT \u2014 without --apply, prints what WOULD run and mutates NOTHING.",
+      "With --apply, threads apply into each underlying command (their own safety still applies).",
+      "",
+      "Requires a cloud API key for the status read (coderifts login / CODERIFTS_API_KEY).",
+      "Merge apply uses your local `gh` credentials, not the CodeRifts API key."
+    ].join("\n");
+    var AGENT_GUARD_GUIDANCE = [
+      "Runtime is not_observable_from_server \u2014 wire @coderifts/agent-guard in the agent host:",
+      "  - wrap mutating tools with guardToolCall / withCodeRifts",
+      "  - see: https://coderifts.com/docs (agent-guard) and `coderifts agent-setup`",
+      "  Local pre-push hook is complementary (git path), not a substitute for agent-guard."
+    ].join("\n");
+    var DEPLOY_GUIDANCE = [
+      "Deploy is declared-only on the server (never server-observed ENFORCING).",
+      "Add a CD step that runs: coderifts deploy-gate --env <env> --artifact <id> --receipt <file> --enforce",
+      "  (phase-1 default is advisory; --enforce attests ENFORCING for the pipeline).",
+      "Also set policy.require_source_binding: true in .coderifts.yml for the deploy declaration leg."
+    ].join("\n");
+    var CONTENT_GUIDANCE = [
+      "Content/freshness is not_observable_from_server (registry path at resolve time).",
+      "No server-side enforce action is available \u2014 configure registry/freshness in the agent host."
+    ].join("\n");
+    function isMergeEnforcing(leg) {
+      return !!(leg && leg.enforcing === true && String(leg.status).toUpperCase() === "ENFORCING");
+    }
+    function runHookInstall(installFn) {
+      const prev = process.exitCode;
+      process.exitCode = 0;
+      try {
+        installFn();
+        const code = typeof process.exitCode === "number" ? process.exitCode : 0;
+        return {
+          ok: code === 0,
+          detail: code === 0 ? "hook.install completed" : `hook.install set exitCode=${code}`
+        };
+      } catch (e) {
+        return { ok: false, detail: e && e.message || String(e) };
+      } finally {
+        process.exitCode = prev;
+      }
+    }
+    async function runEnforce(options = {}, deps = {}) {
+      const apply = options.apply === true;
+      const getKey = deps.getApiKey || getApiKey;
+      const fetchStatus = deps.cloudGetEnforcementStatus || cloudGetEnforcementStatus;
+      const setupCheck = deps.runSetupRequiredCheck || runSetupRequiredCheck;
+      const installHook = deps.hookInstall || hookInstall;
+      const isHookInstalled = deps.isCodeRiftsHook || isCodeRiftsHook;
+      const findGit = deps.findGitDir || findGitDir;
+      const hookPathOf = deps.getHookPath || getHookPath;
+      const log = deps.log || console.log.bind(console);
+      const errLog = deps.errLog || console.error.bind(console);
+      const repo = options.repo != null && String(options.repo).trim() ? String(options.repo).trim() : null;
+      if (!repo) {
+        errLog(chalk.red("Error: missing repo"));
+        errLog(USAGE);
+        return { exitCode: 1, error: "missing_repo", outcomes: [] };
+      }
+      if (!isValidRepo(repo)) {
+        errLog(chalk.red("Error: repo must be in owner/repo form (e.g. coderifts/app)"));
+        return { exitCode: 1, error: "invalid_repo", outcomes: [] };
+      }
+      const apiKey = getKey();
+      if (!apiKey) {
+        errLog(chalk.red("Error: no API key. Run `coderifts login` or set CODERIFTS_API_KEY."));
+        return { exitCode: 1, error: "missing_api_key", outcomes: [] };
+      }
+      log(chalk.bold(`CodeRifts enforce \u2014 ${repo}`));
+      log(chalk.dim(apply ? "  Mode: --apply (will mutate via underlying commands where applicable)" : "  Mode: dry-run (default) \u2014 no mutations; showing what WOULD run"));
+      log("");
+      let report;
+      try {
+        report = await fetchStatus(repo, apiKey);
+      } catch (e) {
+        const msg = e && e.message ? String(e.message) : "status request failed";
+        errLog(chalk.red(`Error: ${msg}`));
+        return { exitCode: 1, error: msg, outcomes: [] };
+      }
+      const legs = report && report.legs || {};
+      const outcomes = [];
+      if (isMergeEnforcing(legs.merge)) {
+        outcomes.push({
+          layer: "merge",
+          action: "skip",
+          apply,
+          ok: true,
+          detail: `already ENFORCING (status=${legs.merge.status})`
+        });
+        log(chalk.green("  Merge    skip \u2014 already ENFORCING"));
+      } else {
+        const mergeStatus = legs.merge && legs.merge.status || "UNKNOWN";
+        log(chalk.yellow(`  Merge    ${apply ? "apply" : "dry-run"} \u2014 setup-required-check (current: ${mergeStatus})`));
+        try {
+          const r = await setupCheck(
+            { repo, apply: apply === true },
+            {
+              exit: false,
+              log: deps.setupLog || log,
+              logErr: deps.setupLogErr || errLog,
+              ...deps.setupDeps || {}
+            }
+          );
+          const code = r && typeof r.exitCode === "number" ? r.exitCode : 1;
+          outcomes.push({
+            layer: "merge",
+            action: "setup-required-check",
+            apply,
+            ok: code === 0,
+            exitCode: code,
+            detail: r && r.code ? String(r.code) : `exit ${code}`
+          });
+          if (code !== 0) {
+            errLog(chalk.red(`  Merge    failed (exit ${code}${r && r.code ? `, ${r.code}` : ""})`));
+          }
+        } catch (e) {
+          outcomes.push({
+            layer: "merge",
+            action: "setup-required-check",
+            apply,
+            ok: false,
+            detail: e && e.message || String(e)
+          });
+          errLog(chalk.red(`  Merge    error: ${e && e.message || e}`));
+        }
+      }
+      {
+        const gitDir = findGit && findGit();
+        let alreadyHook = false;
+        try {
+          if (gitDir) {
+            const hp = hookPathOf(gitDir);
+            alreadyHook = !!(isHookInstalled && isHookInstalled(hp));
+          }
+        } catch {
+        }
+        if (alreadyHook && apply) {
+          outcomes.push({
+            layer: "runtime",
+            action: "hook.install",
+            apply: true,
+            ok: true,
+            detail: "hook already installed (idempotent skip); not server-observable ENFORCING",
+            server_enforcing: false
+          });
+          log(chalk.green("  Runtime  skip \u2014 CodeRifts hook already installed (local)"));
+        } else if (apply) {
+          log(chalk.yellow("  Runtime  apply \u2014 hook.install (local; not server ENFORCING)"));
+          const r = runHookInstall(installHook);
+          outcomes.push({
+            layer: "runtime",
+            action: "hook.install",
+            apply: true,
+            ok: r.ok,
+            detail: `${r.detail}; not server-observable ENFORCING`,
+            server_enforcing: false
+          });
+          if (!r.ok) errLog(chalk.red(`  Runtime  hook install failed: ${r.detail}`));
+        } else {
+          outcomes.push({
+            layer: "runtime",
+            action: "hook.install",
+            apply: false,
+            ok: true,
+            detail: alreadyHook ? "dry-run: hook already present; would re-run install (idempotent)" : "dry-run: would run coderifts hook install",
+            server_enforcing: false
+          });
+          log(chalk.dim(`  Runtime  dry-run \u2014 would ${alreadyHook ? "re-run" : "run"} hook install (local)`));
+        }
+        log(chalk.dim(AGENT_GUARD_GUIDANCE.split("\n").map((l) => `             ${l}`).join("\n")));
+      }
+      {
+        const st = legs.deploy && legs.deploy.status || "unknown";
+        outcomes.push({
+          layer: "deploy",
+          action: "guidance",
+          apply: false,
+          // never mutates GitHub here
+          ok: true,
+          detail: `server status=${st} (declared-only); print CD step instruction`,
+          server_enforcing: false
+        });
+        log(chalk.dim(`  Deploy   guidance \u2014 current: ${st} (not server-enforcing)`));
+        log(chalk.dim(DEPLOY_GUIDANCE.split("\n").map((l) => `             ${l}`).join("\n")));
+      }
+      {
+        outcomes.push({
+          layer: "content",
+          action: "guidance",
+          apply: false,
+          ok: true,
+          detail: "not_observable_from_server; guidance only",
+          server_enforcing: false
+        });
+        log(chalk.dim("  Content  guidance \u2014 not_observable_from_server"));
+        log(chalk.dim(CONTENT_GUIDANCE.split("\n").map((l) => `             ${l}`).join("\n")));
+      }
+      log("");
+      log(chalk.bold("  Per-layer outcomes"));
+      for (const o of outcomes) {
+        const mark = o.ok ? chalk.green("ok") : chalk.red("FAIL");
+        const mode = o.apply === true ? "apply" : o.action === "skip" ? "skip" : "dry-run";
+        log(`    ${String(o.layer).padEnd(8)} ${mark}  ${mode.padEnd(7)}  ${o.action}  ${chalk.dim(o.detail || "")}`);
+      }
+      log("");
+      log(chalk.bold("  Cross-layer report" + (apply ? " (after actions)" : " (current / dry-run)")));
+      let finalReport = report;
+      if (apply) {
+        try {
+          finalReport = await fetchStatus(repo, apiKey);
+        } catch (e) {
+          errLog(chalk.yellow(`  Warning: re-fetch status failed: ${e && e.message || e}`));
+        }
+      }
+      if (options.json) {
+        log(JSON.stringify({ command: "enforce", apply, repo, outcomes, report: finalReport }, null, 2));
+      } else {
+        log(renderStatusReport(finalReport));
+      }
+      const anyFail = outcomes.some((o) => o.ok === false);
+      return {
+        exitCode: anyFail ? 1 : 0,
+        apply,
+        outcomes,
+        report: finalReport
+      };
+    }
+    module2.exports = {
+      runEnforce,
+      isMergeEnforcing,
+      USAGE,
+      AGENT_GUARD_GUIDANCE,
+      DEPLOY_GUIDANCE,
+      CONTENT_GUIDANCE
+    };
+  }
+});
+
+// src/agent-host-files.embedded.js
+var require_agent_host_files_embedded = __commonJS({
+  "src/agent-host-files.embedded.js"(exports2, module2) {
+    "use strict";
+    var AGENT_HOST_PATHS = Object.freeze([
+      "AGENTS.md",
+      "CLAUDE.md",
+      ".cursor/rules/coderifts.mdc",
+      ".github/copilot-instructions.md",
+      "coderifts-langgraph-policy.js",
+      "openai-agent-instructions.md"
+    ]);
+    var AGENT_HOST_FILES = Object.freeze({
+      "AGENTS.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent rules\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n',
+      "CLAUDE.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n',
+      ".cursor/rules/coderifts.mdc": '---\ndescription: CodeRifts API governance \u2014 when to preflight and how to branch\nglobs:\nalwaysApply: true\n---\n\n<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n',
+      ".github/copilot-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts instructions for GitHub Copilot\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n',
+      "coderifts-langgraph-policy.js": '// GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js\n// System policy string for a LangGraph (or similar) agent. Content is generated;\n// identical rule sentences to AGENTS.md / other formats.\n\'use strict\';\n\nmodule.exports = "Call `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\\n\\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\\n\\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\\n\\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\\n\\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not \\"proceed with caution\\" without monitoring.\\n\\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\\n\\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\\n\\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\\n\\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.";\n',
+      "openai-agent-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent instructions\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n'
+    });
+    module2.exports = { AGENT_HOST_FILES, AGENT_HOST_PATHS };
+  }
+});
+
+// src/commands/agent-setup.js
+var require_agent_setup = __commonJS({
+  "src/commands/agent-setup.js"(exports2, module2) {
+    "use strict";
+    var fs = require("fs");
+    var path = require("path");
+    var chalk = require_source();
+    var { AGENT_HOST_FILES, AGENT_HOST_PATHS } = require_agent_host_files_embedded();
+    if (process.env.NO_COLOR) chalk.level = 0;
+    var USAGE = `Usage: coderifts agent-setup [--out <dir>] [--check] [--force]
+
+  --out <dir>   Target directory (default: current working directory)
+  --check       Exit 0 if on-disk files match embedded content; exit 1 on drift
+  --force       Overwrite existing files (default: skip collisions)
+  Unknown flags exit 1 (never silently ignored).
+`;
+    function parseAgentSetupArgs(argv) {
+      const args = argv.slice(2);
+      let out = null;
+      let check = false;
+      let force = false;
+      let i = 0;
+      while (i < args.length && !String(args[i]).startsWith("-")) i += 1;
+      while (i < args.length) {
+        const a = args[i];
+        if (a === "--out") {
+          const v = args[i + 1];
+          if (v == null || v.startsWith("-")) {
+            return { out, check, force, error: `agent-setup: --out requires a path
+${USAGE}` };
+          }
+          out = path.resolve(v);
+          i += 2;
+          continue;
+        }
+        if (a === "--check") {
+          check = true;
+          i += 1;
+          continue;
+        }
+        if (a === "--force") {
+          force = true;
+          i += 1;
+          continue;
+        }
+        if (a.startsWith("-")) {
+          return { out, check, force, error: `agent-setup: unrecognized argument: ${a}
+${USAGE}` };
+        }
+        return { out, check, force, error: `agent-setup: unrecognized argument: ${a}
+${USAGE}` };
+      }
+      return { out, check, force };
+    }
+    function runAgentSetup(options = {}, deps = {}) {
+      const log = deps.log || console.log.bind(console);
+      const logErr = deps.logErr || console.error.bind(console);
+      const doExit = deps.exit !== false;
+      const cwd = deps.cwd || process.cwd();
+      const exists = deps.exists || fs.existsSync.bind(fs);
+      const readFile = deps.readFile || ((p) => fs.readFileSync(p, "utf8"));
+      const writeFile = deps.writeFile || ((p, c) => {
+        fs.mkdirSync(path.dirname(p), { recursive: true });
+        fs.writeFileSync(p, c, "utf8");
+      });
+      let outDir = options.out ? path.resolve(String(options.out)) : cwd;
+      let check = !!options.check;
+      let force = !!options.force;
+      if (deps.argv) {
+        const parsed = parseAgentSetupArgs(deps.argv);
+        if (parsed.error) {
+          logErr(parsed.error.trimEnd());
+          if (doExit) process.exit(1);
+          return { exitCode: 1, code: "USAGE", message: parsed.error };
+        }
+        if (parsed.out) outDir = parsed.out;
+        check = parsed.check;
+        force = parsed.force;
+      }
+      const files = deps.files || AGENT_HOST_FILES;
+      const relPaths = deps.paths || AGENT_HOST_PATHS;
+      if (check) {
+        let stale = false;
+        for (const rel of relPaths) {
+          const fp = path.join(outDir, rel);
+          const expected = files[rel];
+          if (!exists(fp)) {
+            logErr(chalk.red(`agent-setup --check: missing ${rel}`));
+            stale = true;
+            continue;
+          }
+          const onDisk = readFile(fp);
+          if (onDisk !== expected) {
+            logErr(chalk.red(`agent-setup --check: drift ${rel}`));
+            stale = true;
+          }
+        }
+        if (stale) {
+          logErr("Run: coderifts agent-setup --out " + outDir + " --force");
+          if (doExit) process.exit(1);
+          return { exitCode: 1, code: "DRIFT", outDir };
+        }
+        log(chalk.green(`agent-setup: up to date (${outDir}, ${relPaths.length} files)`));
+        if (doExit) process.exit(0);
+        return { exitCode: 0, code: "UP_TO_DATE", outDir };
+      }
+      const summary = { written: [], skipped: [], forced: [] };
+      for (const rel of relPaths) {
+        const fp = path.join(outDir, rel);
+        const content = files[rel];
+        if (exists(fp) && !force) {
+          summary.skipped.push(rel);
+          continue;
+        }
+        if (exists(fp) && force) summary.forced.push(rel);
+        writeFile(fp, content);
+        summary.written.push(rel);
+      }
+      if (!options.json) {
+        log(chalk.bold("CodeRifts agent-setup"));
+        log(`  target: ${outDir}`);
+        for (const rel of summary.written) {
+          const tag = summary.forced.includes(rel) ? "overwrote" : "wrote";
+          log(chalk.green(`  ${tag}:   ${rel}`));
+        }
+        for (const rel of summary.skipped) {
+          log(chalk.yellow(`  skipped: ${rel} (exists; use --force to overwrite)`));
+        }
+        log("");
+        log(chalk.dim(`  ${summary.written.length} written, ${summary.skipped.length} skipped`));
+      }
+      if (doExit) process.exit(0);
+      return { exitCode: 0, code: "OK", outDir, ...summary };
+    }
+    module2.exports = {
+      runAgentSetup,
+      parseAgentSetupArgs,
+      AGENT_HOST_FILES,
+      AGENT_HOST_PATHS,
+      USAGE
+    };
+  }
+});
+
+// src/copilot-mcp.embedded.js
+var require_copilot_mcp_embedded = __commonJS({
+  "src/copilot-mcp.embedded.js"(exports2, module2) {
+    "use strict";
+    var COPILOT_MCP_PATHS = Object.freeze([
+      ".vscode/mcp.json",
+      "copilot-cloud-agent-mcp.json",
+      "copilot-custom-agent-mcp.frontmatter.md",
+      "docs/copilot-mcp.md"
+    ]);
+    var COPILOT_MCP_FILES = Object.freeze({
+      ".vscode/mcp.json": '{\n  "$comment": "GENERATED by scripts/generate-copilot-mcp.js from MCP_MANIFEST / CANONICAL_TOOL_NAMES (src/routes/mcp-streamable.js). Do not hand-edit; re-run the generator.",\n  "servers": {\n    "coderifts": {\n      "type": "http",\n      "url": "https://app.coderifts.com/mcp",\n      "headers": {\n        "Authorization": "Bearer ${input:coderifts_api_key}"\n      }\n    }\n  },\n  "inputs": [\n    {\n      "type": "promptString",\n      "id": "coderifts_api_key",\n      "description": "CodeRifts API key (https://coderifts.com) \u2014 Authorization Bearer",\n      "password": true\n    }\n  ]\n}\n',
+      "copilot-cloud-agent-mcp.json": '{\n  "mcpServers": {\n    "coderifts": {\n      "type": "http",\n      "url": "https://app.coderifts.com/mcp",\n      "tools": [\n        "preflight_change_set",\n        "verify_receipt",\n        "get_decision_details"\n      ],\n      "headers": {\n        "Authorization": "Bearer ${COPILOT_MCP_CODERIFTS_API_KEY}"\n      }\n    }\n  }\n}\n',
+      "copilot-custom-agent-mcp.frontmatter.md": "---\n# GENERATED by scripts/generate-copilot-mcp.js from MCP_MANIFEST / CANONICAL_TOOL_NAMES (src/routes/mcp-streamable.js). Do not hand-edit; re-run the generator.\nname: coderifts-governance\ndescription: >\n  CodeRifts API governance \u2014 preflight contract change sets before merge/deploy/publish,\n  verify receipts, look up prior decisions. Branch on execution_action only.\ntools: ['coderifts/preflight_change_set', 'coderifts/verify_receipt', 'coderifts/get_decision_details']\nmcp-servers:\n  coderifts:\n    type: http\n    url: https://app.coderifts.com/mcp\n    tools:\n      - preflight_change_set\n      - verify_receipt\n      - get_decision_details\n    headers:\n      Authorization: Bearer ${{ secrets.COPILOT_MCP_CODERIFTS_API_KEY }}\n---\n\nYou are a CodeRifts-aware agent. Before merge, deploy, publish, or tool registration when\ncontract artifacts changed, call `coderifts/preflight_change_set` with the complete base\u2192head\nchange set. Branch on `execution_action` only (CONTINUE, CONTINUE_WITH_MONITORING,\nREQUEST_APPROVAL, STOP). Do not treat `decision` or `safe_for_agent` as control flow.\nUse `coderifts/verify_receipt` to check an existing receipt; `coderifts/get_decision_details`\nfor a prior decision_id.\n",
+      "docs/copilot-mcp.md": '# CodeRifts + GitHub Copilot MCP\n\n<!-- GENERATED by scripts/generate-copilot-mcp.js from MCP_MANIFEST / CANONICAL_TOOL_NAMES (src/routes/mcp-streamable.js). Do not hand-edit; re-run the generator. -->\n\nWire the **hosted** CodeRifts MCP server (`https://app.coderifts.com/mcp`) into every Copilot surface from **one**\nsource of truth (`CANONICAL_TOOL_NAMES` in `src/routes/mcp-streamable.js`).\n\n## Canonical tools (live tools/list)\n\n- `preflight_change_set`\n- `verify_receipt`\n- `get_decision_details`\n\nDo **not** list hidden/advanced aliases here. Only these 3 tools are the default\nagent-facing surface.\n\n## The servers-vs-mcpServers trap\n\n| Surface | Config location | Root key | Auth |\n|---------|-----------------|----------|------|\n| **VS Code / Copilot Chat** | `.vscode/mcp.json` | **`servers`** | `${input:coderifts_api_key}` + `inputs[]` |\n| **Copilot cloud agent + code review** | Repo **Settings \u2192 Copilot \u2192 MCP servers** (paste JSON) | **`mcpServers`** | Agents secret `COPILOT_MCP_CODERIFTS_API_KEY` in `headers` |\n| **Custom agent** (org/enterprise) | Agent profile `.md` YAML frontmatter | **`mcp-servers`** | `${{ secrets.COPILOT_MCP_CODERIFTS_API_KEY }}` |\n\nCursor / Claude Desktop / Grok use `mcpServers` in their own files \u2014 that is a **different**\necosystem. Do not copy a Cursor config into `.vscode/mcp.json`, and do not paste a VS Code\n`servers` document into GitHub repo Settings.\n\n## 1. VS Code / Copilot Chat (developer surface)\n\n1. Get an API key at https://coderifts.com\n2. Write the generated file to `.vscode/mcp.json` (or run `coderifts copilot-setup`)\n3. Reload VS Code; when prompted, paste the API key for `coderifts_api_key`\n4. In Copilot Chat Agent mode, confirm tools: preflight_change_set, verify_receipt, get_decision_details\n\n```json\n{\n  "$comment": "GENERATED by scripts/generate-copilot-mcp.js from MCP_MANIFEST / CANONICAL_TOOL_NAMES (src/routes/mcp-streamable.js). Do not hand-edit; re-run the generator.",\n  "servers": {\n    "coderifts": {\n      "type": "http",\n      "url": "https://app.coderifts.com/mcp",\n      "headers": {\n        "Authorization": "Bearer ${input:coderifts_api_key}"\n      }\n    }\n  },\n  "inputs": [\n    {\n      "type": "promptString",\n      "id": "coderifts_api_key",\n      "description": "CodeRifts API key (https://coderifts.com) \u2014 Authorization Bearer",\n      "password": true\n    }\n  ]\n}\n```\n\n## 2. Copilot cloud agent (PR / issue governance surface)\n\n1. Repo **Settings \u2192 Copilot \u2192 MCP servers** (or **Cloud agent \u2192 MCP configuration**)\n2. Paste the JSON below (root key **`mcpServers`**, includes required `tools` allowlist)\n3. Add an Agents secret: name `COPILOT_MCP_CODERIFTS_API_KEY`, value = CodeRifts API key\n4. Save. Validate: assign an issue to Copilot \u2192 session logs \u2192 **Start MCP Servers**\n\n```json\n{\n  "mcpServers": {\n    "coderifts": {\n      "type": "http",\n      "url": "https://app.coderifts.com/mcp",\n      "tools": [\n        "preflight_change_set",\n        "verify_receipt",\n        "get_decision_details"\n      ],\n      "headers": {\n        "Authorization": "Bearer ${COPILOT_MCP_CODERIFTS_API_KEY}"\n      }\n    }\n  }\n}\n```\n\nNotes:\n\n- Cloud agent does **not** support OAuth remote MCP; Bearer is correct for CodeRifts.\n- Cloud agent does **not** support interactive `inputs` \u2014 use Agents secrets only.\n- `tools` is required; list the 3 canonical tools (or `["*"]` only if you accept every tool the server exposes).\n\n## 3. Custom agent (optional org/enterprise)\n\nAdd `mcp-servers` to the agent profile frontmatter (see generated\n`copilot-custom-agent-mcp.frontmatter.md`). Tool names may be namespaced as\n`coderifts/<tool>` in the profile `tools` list.\n\n## Regenerate / drift-check\n\n```bash\nnode scripts/generate-copilot-mcp.js\nnode scripts/generate-copilot-mcp.js --check\ncoderifts copilot-setup --out .          # write into a repo\ncoderifts copilot-setup --check          # drift vs embedded\n```\n\nServer URL and tool names always come from the live manifest \u2014 never hand-edit tool lists.\n'
+    });
+    module2.exports = { COPILOT_MCP_FILES, COPILOT_MCP_PATHS };
+  }
+});
+
+// src/commands/copilot-setup.js
+var require_copilot_setup = __commonJS({
+  "src/commands/copilot-setup.js"(exports2, module2) {
+    "use strict";
+    var fs = require("fs");
+    var path = require("path");
+    var chalk = require_source();
+    var { COPILOT_MCP_FILES, COPILOT_MCP_PATHS } = require_copilot_mcp_embedded();
+    if (process.env.NO_COLOR) chalk.level = 0;
+    var USAGE = `Usage: coderifts copilot-setup [--out <dir>] [--check] [--force]
+
+  --out <dir>   Target directory (default: current working directory)
+  --check       Exit 0 if on-disk files match embedded content; exit 1 on drift
+  --force       Overwrite existing files (default: skip collisions)
+  Unknown flags exit 1 (never silently ignored).
+
+Writes:
+  .vscode/mcp.json                         VS Code / Copilot Chat (root key: servers)
+  copilot-cloud-agent-mcp.json             Paste into Settings \u2192 Copilot \u2192 MCP (mcpServers)
+  copilot-custom-agent-mcp.frontmatter.md  Custom agent YAML frontmatter
+  docs/copilot-mcp.md                      Install guide
+`;
+    function parseCopilotSetupArgs(argv) {
+      const args = argv.slice(2);
+      let out = null;
+      let check = false;
+      let force = false;
+      let i = 0;
+      while (i < args.length && !String(args[i]).startsWith("-")) i += 1;
+      while (i < args.length) {
+        const a = args[i];
+        if (a === "--out") {
+          const v = args[i + 1];
+          if (v == null || v.startsWith("-")) {
+            return { out, check, force, error: `copilot-setup: --out requires a path
+${USAGE}` };
+          }
+          out = path.resolve(v);
+          i += 2;
+          continue;
+        }
+        if (a === "--check") {
+          check = true;
+          i += 1;
+          continue;
+        }
+        if (a === "--force") {
+          force = true;
+          i += 1;
+          continue;
+        }
+        if (a.startsWith("-")) {
+          return { out, check, force, error: `copilot-setup: unrecognized argument: ${a}
+${USAGE}` };
+        }
+        return { out, check, force, error: `copilot-setup: unrecognized argument: ${a}
+${USAGE}` };
+      }
+      return { out, check, force };
+    }
+    function runCopilotSetup(options = {}, deps = {}) {
+      const log = deps.log || console.log.bind(console);
+      const logErr = deps.logErr || console.error.bind(console);
+      const doExit = deps.exit !== false;
+      const cwd = deps.cwd || process.cwd();
+      const exists = deps.exists || fs.existsSync.bind(fs);
+      const readFile = deps.readFile || ((p) => fs.readFileSync(p, "utf8"));
+      const writeFile = deps.writeFile || ((p, c) => {
+        fs.mkdirSync(path.dirname(p), { recursive: true });
+        fs.writeFileSync(p, c, "utf8");
+      });
+      let outDir = options.out ? path.resolve(String(options.out)) : cwd;
+      let check = !!options.check;
+      let force = !!options.force;
+      if (deps.argv) {
+        const parsed = parseCopilotSetupArgs(deps.argv);
+        if (parsed.error) {
+          logErr(parsed.error.trimEnd());
+          if (doExit) process.exit(1);
+          return { exitCode: 1, code: "USAGE", message: parsed.error };
+        }
+        if (parsed.out) outDir = parsed.out;
+        check = parsed.check;
+        force = parsed.force;
+      }
+      const files = deps.files || COPILOT_MCP_FILES;
+      const relPaths = deps.paths || COPILOT_MCP_PATHS;
+      if (check) {
+        let stale = false;
+        for (const rel of relPaths) {
+          const fp = path.join(outDir, rel);
+          const expected = files[rel];
+          if (!exists(fp)) {
+            logErr(chalk.red(`copilot-setup --check: missing ${rel}`));
+            stale = true;
+            continue;
+          }
+          const onDisk = readFile(fp);
+          if (onDisk !== expected) {
+            logErr(chalk.red(`copilot-setup --check: drift ${rel}`));
+            stale = true;
+          }
+        }
+        if (stale) {
+          logErr("Run: coderifts copilot-setup --out " + outDir + " --force");
+          if (doExit) process.exit(1);
+          return { exitCode: 1, code: "DRIFT", outDir };
+        }
+        log(chalk.green(`copilot-setup: up to date (${outDir}, ${relPaths.length} files)`));
+        if (doExit) process.exit(0);
+        return { exitCode: 0, code: "UP_TO_DATE", outDir };
+      }
+      const summary = { written: [], skipped: [], forced: [] };
+      for (const rel of relPaths) {
+        const fp = path.join(outDir, rel);
+        const content = files[rel];
+        if (exists(fp) && !force) {
+          summary.skipped.push(rel);
+          continue;
+        }
+        if (exists(fp) && force) summary.forced.push(rel);
+        writeFile(fp, content);
+        summary.written.push(rel);
+      }
+      if (!options.json) {
+        log(chalk.bold("CodeRifts copilot-setup"));
+        log(`  target: ${outDir}`);
+        for (const rel of summary.written) {
+          const tag = summary.forced.includes(rel) ? "overwrote" : "wrote";
+          log(chalk.green(`  ${tag}:   ${rel}`));
+        }
+        for (const rel of summary.skipped) {
+          log(chalk.yellow(`  skipped: ${rel} (exists; use --force to overwrite)`));
+        }
+        log("");
+        log(chalk.dim('  VS Code:  open .vscode/mcp.json \u2014 root key is "servers"'));
+        log(chalk.dim("  Cloud:    paste copilot-cloud-agent-mcp.json into Settings \u2192 Copilot \u2192 MCP"));
+        log(chalk.dim("  Secret:   COPILOT_MCP_CODERIFTS_API_KEY (Agents secret) = CodeRifts API key"));
+        log(chalk.dim(`  ${summary.written.length} written, ${summary.skipped.length} skipped`));
+      }
+      if (doExit) process.exit(0);
+      return { exitCode: 0, code: "OK", outDir, ...summary };
+    }
+    module2.exports = {
+      runCopilotSetup,
+      parseCopilotSetupArgs,
+      COPILOT_MCP_FILES,
+      COPILOT_MCP_PATHS,
+      USAGE
+    };
+  }
+});
+
+// src/commands/lock.js
+var require_lock = __commonJS({
+  "src/commands/lock.js"(exports2, module2) {
+    "use strict";
+    var fs = require("fs");
+    var path = require("path");
+    var chalk = require_source();
+    var { getApiKey } = require_config();
+    var { cloudGetLock } = require_cloud();
+    if (process.env.NO_COLOR) chalk.level = 0;
+    var DEFAULT_OUT = "coderifts.lock";
+    var EPHEMERAL_LOCK_KEYS = Object.freeze([
+      "correlation_id",
+      "generated_at",
+      "request_correlation_id",
+      "meta"
+    ]);
+    var COMMITTED_KEY_ORDER = Object.freeze([
+      "lockfile_version",
+      "repo",
+      "provenance",
+      "agents",
+      "last_accepted_fingerprint",
+      "decision_spec_version",
+      "receipt_kind"
+    ]);
+    var USAGE = [
+      "Usage: coderifts lock --repo owner/repo [--out coderifts.lock]",
+      "   or: coderifts lock owner/repo [--out path]",
+      "",
+      "Fetches the observed agent-contract lockfile (coderifts.lock v1) and writes it to disk.",
+      "Requires a cloud API key (coderifts login or CODERIFTS_API_KEY).",
+      "Observed-only: agents[] come from real usage observations; empty when none recorded.",
+      "Written file is byte-stable for the same state (no correlation_id / generated_at)."
+    ].join("\n");
+    function isValidRepo(full) {
+      const parts = String(full || "").split("/");
+      if (parts.length !== 2) return false;
+      const [owner, repo] = parts.map((p) => p.trim());
+      return !!(owner && repo);
+    }
+    function toCommittedLockfile(doc) {
+      const src = doc && typeof doc === "object" && !Array.isArray(doc) ? doc : {};
+      const out = {};
+      for (const key of COMMITTED_KEY_ORDER) {
+        if (!Object.prototype.hasOwnProperty.call(src, key)) continue;
+        if (EPHEMERAL_LOCK_KEYS.includes(key)) continue;
+        out[key] = src[key];
+      }
+      for (const k of EPHEMERAL_LOCK_KEYS) {
+        if (Object.prototype.hasOwnProperty.call(out, k)) delete out[k];
+      }
+      return out;
+    }
+    function renderLockfileJson(doc) {
+      return `${JSON.stringify(doc, null, 2)}
+`;
+    }
+    async function runLock(options = {}, deps = {}) {
+      const getKey = deps.getApiKey || getApiKey;
+      const fetchLock = deps.cloudGetLock || cloudGetLock;
+      const log = deps.log || console.log;
+      const errLog = deps.errLog || console.error;
+      const writeFile = deps.writeFile || ((p, c) => {
+        fs.mkdirSync(path.dirname(path.resolve(p)), { recursive: true });
+        fs.writeFileSync(p, c, "utf8");
+      });
+      const cwd = deps.cwd || process.cwd();
+      const repo = options.repo != null && String(options.repo).trim() ? String(options.repo).trim() : null;
+      if (!repo) {
+        errLog(chalk.red("Error: missing repo"));
+        errLog(USAGE);
+        return { exitCode: 1, error: "missing_repo" };
+      }
+      if (!isValidRepo(repo)) {
+        errLog(chalk.red("Error: repo must be in owner/repo form (e.g. coderifts/app)"));
+        return { exitCode: 1, error: "invalid_repo" };
+      }
+      const apiKey = getKey();
+      if (!apiKey) {
+        errLog(chalk.red("Error: no API key. Run `coderifts login` or set CODERIFTS_API_KEY."));
+        return { exitCode: 1, error: "missing_api_key" };
+      }
+      let doc;
+      try {
+        doc = await fetchLock(repo, apiKey);
+      } catch (e) {
+        const msg = e && e.message ? String(e.message) : "request failed";
+        errLog(chalk.red(`Error: ${msg}`));
+        if (e && e.code) errLog(chalk.dim(`  (${e.code})`));
+        return { exitCode: 1, error: msg };
+      }
+      if (!doc || typeof doc !== "object" || doc.lockfile_version == null) {
+        errLog(chalk.red("Error: invalid lockfile response from API"));
+        return { exitCode: 1, error: "invalid_response" };
+      }
+      const committed = toCommittedLockfile(doc);
+      const body = renderLockfileJson(committed);
+      const outRel = options.out != null && String(options.out).trim() ? String(options.out).trim() : DEFAULT_OUT;
+      const outPath = path.isAbsolute(outRel) ? outRel : path.join(cwd, outRel);
+      try {
+        writeFile(outPath, body);
+      } catch (e) {
+        const msg = e && e.message ? String(e.message) : "write failed";
+        errLog(chalk.red(`Error: failed to write ${outPath}: ${msg}`));
+        return { exitCode: 1, error: msg };
+      }
+      if (options.json) {
+        log(body.trimEnd());
+      } else {
+        const nAgents = Array.isArray(committed.agents) ? committed.agents.length : 0;
+        const nOps = Array.isArray(committed.agents) ? committed.agents.reduce((n, a) => n + (a.operations && a.operations.length || 0), 0) : 0;
+        log(chalk.bold("CodeRifts lock (observed)"));
+        log(`  repo:     ${committed.repo || repo}`);
+        log(`  wrote:    ${outPath}`);
+        log(`  agents:   ${nAgents}  operations: ${nOps}`);
+        log(`  fingerprint: ${committed.last_accepted_fingerprint || chalk.dim("(none)")}`);
+        log(chalk.dim("  Observed-only; file is byte-stable (no correlation_id / generated_at)."));
+      }
+      return { exitCode: 0, doc, committed, outPath };
+    }
+    module2.exports = {
+      runLock,
+      renderLockfileJson,
+      toCommittedLockfile,
+      isValidRepo,
+      DEFAULT_OUT,
+      EPHEMERAL_LOCK_KEYS,
+      COMMITTED_KEY_ORDER,
+      USAGE
+    };
+  }
+});
+
 // corpus/vectors-mcp-fpfn.json
 var require_vectors_mcp_fpfn = __commonJS({
   "corpus/vectors-mcp-fpfn.json"(exports2, module2) {
@@ -97380,6 +99440,18 @@ program.command("publish-gate").description("Gate npm publish on contract-artifa
   process.exitCode = code;
   process.exit(code);
 });
+program.command("registry-gate [dir]").description("Admit a directory of OpenAPI specs via local registry validation (CI gate, no cloud)").option("--glob <pattern>", "Filter discovered paths with agent-guard matchGlob (relative to dir)").option("--errors-only", "Fail only on ERROR severity (warnings are printed, exit 0)").option("--warn-only", "Advisory: print all findings, always exit 0").action((dir, options) => {
+  const { runRegistryGate } = require_registry_gate();
+  const result = runRegistryGate({
+    dir: dir || ".",
+    glob: options.glob,
+    errorsOnly: !!options.errorsOnly,
+    warnOnly: !!options.warnOnly
+  });
+  const code = result && typeof result.exitCode === "number" ? result.exitCode : 1;
+  process.exitCode = code;
+  process.exit(code);
+});
 program.command("init [template]").description("Generate a .coderifts.yml from a policy template (startup, growth, fintech, public-api, microservices)").action(async (template) => {
   const { init } = require_init();
   await init(template);
@@ -97388,6 +99460,52 @@ program.command("login").description("Save your API key for cloud features").act
   const { login } = require_login();
   await login();
 });
+program.command("setup-required-check").description('Guide setup of required status check "CodeRifts / contract-gate" (uses gh, your credentials)').option("--branch <name>", "Branch to protect (default: repo default branch)").option("--repo <owner/repo>", "Override owner/repo (default: git remote origin)").option("--apply", "Apply the protection change (default: print the exact gh command only)").option("--json", "Machine-readable JSON result").action(async (options) => {
+  const { runSetupRequiredCheck } = require_setup_required_check();
+  const result = await runSetupRequiredCheck(options);
+  if (result && typeof result.exitCode === "number") {
+    process.exitCode = result.exitCode;
+  }
+});
+program.command("status [repo]").description("Show cross-layer enforcement status (Runtime / Merge / Deploy) for a repo \u2014 read-only").option("--repo <owner/repo>", "Repository (owner/repo); also accepted as a positional argument").option("--json", "Machine-readable JSON (raw API body)").action(async (repoPositional, options) => {
+  const { runStatus } = require_status();
+  const result = await runStatus({
+    ...options,
+    repo: options.repo || repoPositional || null
+  });
+  if (result && typeof result.exitCode === "number") {
+    process.exitCode = result.exitCode;
+  }
+});
+program.command("enforce [repo]").description("Close enforcement gaps by chaining setup-required-check / hook / deploy guidance (dry-run default; use --apply to mutate)").option("--repo <owner/repo>", "Repository (owner/repo); also accepted as a positional argument").option("--apply", "Actually run underlying setup commands (default: dry-run only)").option("--json", "Machine-readable JSON result").action(async (repoPositional, options) => {
+  const { runEnforce } = require_enforce();
+  const result = await runEnforce({
+    ...options,
+    repo: options.repo || repoPositional || null,
+    apply: !!options.apply
+  });
+  if (result && typeof result.exitCode === "number") {
+    process.exitCode = result.exitCode;
+  }
+});
+program.command("agent-setup").description("Write AGENTS.md / CLAUDE.md / Cursor / Copilot / LangGraph / OpenAI agent rule files").option("--out <dir>", "Target directory (default: current working directory)").option("--check", "Exit 0 if on-disk files match embedded content; exit 1 on drift").option("--force", "Overwrite existing files (default: skip collisions)").action((options) => {
+  const { runAgentSetup } = require_agent_setup();
+  runAgentSetup(options, { exit: true });
+});
+program.command("copilot-setup").description("Write GitHub Copilot MCP configs (.vscode/mcp.json + cloud-agent paste JSON + docs)").option("--out <dir>", "Target directory (default: current working directory)").option("--check", "Exit 0 if on-disk files match embedded content; exit 1 on drift").option("--force", "Overwrite existing files (default: skip collisions)").action((options) => {
+  const { runCopilotSetup } = require_copilot_setup();
+  runCopilotSetup(options, { exit: true });
+});
+program.command("lock [repo]").description("Fetch the observed agent-contract lockfile (coderifts.lock v1) for a repo").option("--repo <owner/repo>", "Repository (owner/repo); also accepted as a positional argument").option("--out <path>", "Output path (default: coderifts.lock in cwd)").option("--json", "Print the lock document JSON to stdout (still writes --out)").action(async (repoPositional, options) => {
+  const { runLock } = require_lock();
+  const result = await runLock({
+    ...options,
+    repo: options.repo || repoPositional || null
+  });
+  if (result && typeof result.exitCode === "number") {
+    process.exitCode = result.exitCode;
+  }
+});
 var hookCmd = program.command("hook").description("Manage the CodeRifts pre-push Git hook");
 hookCmd.command("install").description("Install the CodeRifts pre-push hook in the current Git repo").action(() => {
   const { install } = require_hook();