coderifts 3.3.0 → 4.0.0

package/CHANGELOG.md

@@ -0,0 +1,40 @@
+# Changelog
+
+## 4.0.0
+
+**Breaking** — `coderifts claude-hook` is fail-closed by default. The CLI now
+depends on `@coderifts/agent-guard` ^8.1.1.
+
+### Breaking
+- **`claude-hook` default is fail-closed (P0-3/P0-4).** No API key, API
+  unreachable, disk unreadable, or edit-apply failure on the spec path →
+  **exit 2** (`enforce_indeterminate`), not exit 0. `REQUEST_APPROVAL` →
+  exit 2 (`approval_required`). `CONTINUE_WITH_MONITORING` without a
+  host-asserted monitoring sink → exit 2. Empty verdict is no longer
+  mapped to ALLOW (P0 #5).
+- **Migration:** hosts that ran the hook without a key / without
+  `CODERIFTS_STRICT` will now **block** tool calls. Explicit opt-out:
+  `CODERIFTS_ADVISORY=1` restores the old soft-allow on "governance could
+  not run" sites. `CODERIFTS_STRICT=1` remains fail-closed and cannot be
+  weakened by ADVISORY.
+
+### Changed
+- **`@coderifts/agent-guard` `^6.4.0` → `^8.1.1`.** CLI still calls only
+  `deployGate` / `matchGlob` (not the wrap/TOCTOU path). `inescapable_deploy`
+  on 8.x is `ENFORCING ∧ ¬bypass ∧ expected_fingerprint` rebound.
+- **`deployReportResiduals`:** rebound-missing is `change_set_not_rebound`,
+  never `bypass_open`. Enforcement-axis residuals still named first (same
+  order as guard `residuals[]`). CLI AND on the inescapable flag is kept
+  (never widen).
+- **`MIN_GUARD_MAJOR`:** 6 → 8 (`scripts/assert-guard-major.js`).
+
+### Fixed
+- **Installer copy (P0 #9 / e76e846):** `agent-setup` / `init` teach
+  guard@8 execution-state **DEFAULT ON**, not the old OFF.
+
+## 3.4.0
+
+### Agent-setup
+
+- Rule files now state that receipts are operation-scoped (a merge receipt never authorizes deploy/publish; re-preflight with the new `context.operation` — do not decline) and that a stale receipt on a changed head needs a new preflight (`verify_receipt` cannot re-diff).
+- Hosts with existing agent-setup files: `coderifts agent-setup --force` to pick up the new paragraphs; `--check` will report drift until then.

package/README.md

@@ -236,17 +236,22 @@ git config coderifts.specPath api/openapi.yaml   # default if omitted
 - **User** `~/.claude/settings.json` — personal; applies to all projects on this machine.
 - Matcher is case-sensitive tool names/regex. Exit-2 blocking is **Claude Code** semantics; the same decision discipline at push-time is the git pre-push hook above.
 
-**`CODERIFTS_STRICT` (opt-in, not a package guarantee):** env `1` or `true`
-(case-insensitive) hardens **enforcement-relevant** soft sites into **exit 2
-(BLOCK)** — “governance did not run” must not read as ALLOW. Hardened: missing
-API key; API unreachable (network/timeout/error); disk unreadable on the
-contract path; Edit/MultiEdit apply failure on the contract path. Still soft
-even in strict: non-spec path, identical content, unparseable stdin, missing
-`file_path`, WARN/REQUIRE_APPROVAL (governance ran), real ALLOW. Unset/empty →
-identical to the default soft UX. Hosts choose strict for CI/prod.
+**Fail-closed default:** missing API key, API unreachable, disk unreadable, or
+edit-apply failure on the spec path is **exit 2** (`enforce_indeterminate`) —
+absence of a key is not ALLOW. `REQUEST_APPROVAL` is **exit 2**
+(`approval_required`). `CONTINUE_WITH_MONITORING` is **exit 2**
+(`monitoring_unwired`) unless the host asserts a sink
+(`CODERIFTS_MONITORING_SINK_WIRED=1` or `git config coderifts.monitoringSinkWired true`)
+— a host claim, not delivery proof.
+
+**`CODERIFTS_ADVISORY=1|true`:** explicit opt-out that restores soft-allow on
+“governance could not run” sites. Not implied by a missing key.
+
+**`CODERIFTS_STRICT=1|true`:** same fail-closed as the default; cannot be
+weakened by `CODERIFTS_ADVISORY`.
 
 ```bash
-CODERIFTS_STRICT=1 coderifts claude-hook
+CODERIFTS_ADVISORY=1 coderifts claude-hook
 ```
 
 ### `coderifts status [repo]`
@@ -485,7 +490,9 @@ Two honest modes:
 |----------|-------------|
 | `CODERIFTS_API_KEY` | API key (alternative to `coderifts login`) |
 | `CODERIFTS_OASDIFF_BIN` | Explicit path to the `oasdiff` binary (overrides auto-detect) |
-| `CODERIFTS_STRICT` | `claude-hook` only: `1` or `true` (case-insensitive) turns enforcement-relevant soft sites into exit **2** (BLOCK). Unset/empty → default soft allow. Not a package-level guarantee. |
+| `CODERIFTS_STRICT` | `claude-hook`: `1` or `true` pins fail-closed (cannot be weakened by `CODERIFTS_ADVISORY`). Default is already fail-closed. |
+| `CODERIFTS_ADVISORY` | `claude-hook`: `1` or `true` is the **explicit** soft-allow opt-out on “governance could not run” sites. Absence of a key is not this flag. |
+| `CODERIFTS_MONITORING_SINK_WIRED` | `claude-hook`: `1` or `true` host-asserts a monitoring sink so `CONTINUE_WITH_MONITORING` may exit 0. Not delivery proof. |
 | `CODERIFTS_DEPLOY_ENFORCE` | `deploy-gate`: `true` marks the step enforcing (same as `--enforce`); `unknown` is explicitly unobservable (never assume ENFORCING) |
 | `NO_COLOR` | Disable colored output |
 

package/bin/coderifts.js

@@ -259,8 +259,9 @@ program
 program
   .command('claude-hook')
   .description(
-    'Claude Code PreToolUse gate: block contract-touching Write|Edit|MultiEdit on BLOCK/STOP '
-    + '(exit 2). Soft-allow when unconfigured/unparseable/API down.',
+    'Claude Code PreToolUse gate: block contract-touching Write|Edit|MultiEdit on BLOCK/STOP/'
+    + 'REQUEST_APPROVAL (exit 2). Fail-closed when governance cannot run; '
+    + 'CODERIFTS_ADVISORY=1 is the explicit soft opt-out.',
   )
   .addHelpText('after', () => {
     const { USAGE } = require('../src/commands/claude-hook');

package/dist/cli.js

@@ -3007,7 +3007,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "3.3.0",
+      version: "4.0.0",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -3020,6 +3020,7 @@ var require_package = __commonJS({
         "bin/",
         "scripts/",
         "README.md",
+        "CHANGELOG.md",
         "corpus/"
       ],
       keywords: [
@@ -3051,7 +3052,7 @@ var require_package = __commonJS({
         test: "node --test test/*.test.js"
       },
       dependencies: {
-        "@coderifts/agent-guard": "^6.4.0",
+        "@coderifts/agent-guard": "^8.1.1",
         chalk: "^4.1.2",
         "cli-table3": "^0.6.4",
         commander: "^12.0.0",
@@ -67465,43 +67466,53 @@ var require_guard = __commonJS({
       }
       const enforceable = receiptVerified && (kind === "ALLOW" || sinkWired);
       if (enforceable) {
-        const execStateMode = config.requireExecutionStateMatch;
-        if (execStateMode === true || execStateMode === "warn") {
-          const et = (0, execution_time_fingerprint_js_1.checkExecutionTimeFingerprint)({
-            artifacts: detection.artifacts,
-            // Same context slots the guard sent on preflight (server folds these into crbundle.v1).
-            context: {
-              operation: config.operation ?? "tool_call",
-              environment: config.environment
-            },
-            envelope
+        const execStateMode = config.requireExecutionStateMatch === void 0 ? true : config.requireExecutionStateMatch;
+        if (execStateMode === false) {
+          emit(config, {
+            type: "execution_state_check_disabled",
+            at: iso(),
+            decisionId: envelope.decision_id,
+            cause: "requireExecutionStateMatch_false"
           });
-          if (!et.match) {
-            if (execStateMode === true) {
-              breakerRecord(config);
-              return closedIntegrity(config, "EXECUTION_STATE_DRIFT", failPolicy, fctx, cwctx, redacted, detection.artifacts);
-            }
-            if ((0, execution_time_fingerprint_js_1.isUnmeasurableExecutionStateReason)(et.reason)) {
-              emit(config, {
-                type: "execution_state_unmeasurable",
-                at: iso(),
-                decisionId: envelope.decision_id,
-                current_fingerprint: et.current_fingerprint,
-                authorized_fingerprint: et.authorized_fingerprint,
-                reason: et.reason,
-                note: execution_time_fingerprint_js_1.EXECUTION_STATE_UNMEASURABLE_NOTE
-              });
-            } else {
-              emit(config, {
-                type: "execution_state_drift_observed",
-                at: iso(),
-                decisionId: envelope.decision_id,
-                current_fingerprint: et.current_fingerprint,
-                authorized_fingerprint: et.authorized_fingerprint,
-                reason: et.reason
-              });
-            }
+          const offVerdict = kind === "ALLOW" ? { kind: "ALLOW", action: "CONTINUE", envelope, receiptVerified } : { kind: "MONITOR", action: "CONTINUE_WITH_MONITORING", envelope, receiptVerified };
+          return runUnenforced(config, executeFactory, envelope, offVerdict, true, redacted, freshBasis, cwBasis);
+        }
+        const et = (0, execution_time_fingerprint_js_1.checkExecutionTimeFingerprint)({
+          artifacts: detection.artifacts,
+          context: {
+            operation: config.operation ?? "tool_call",
+            environment: config.environment
+          },
+          envelope
+        });
+        if (!et.match) {
+          const unmeasurable = (0, execution_time_fingerprint_js_1.isUnmeasurableExecutionStateReason)(et.reason);
+          if (execStateMode === true) {
+            breakerRecord(config);
+            return closedIntegrity(config, unmeasurable ? "EXECUTION_STATE_UNMEASURABLE" : "EXECUTION_STATE_DRIFT", failPolicy, fctx, cwctx, redacted, detection.artifacts);
+          }
+          if (unmeasurable) {
+            emit(config, {
+              type: "execution_state_unmeasurable",
+              at: iso(),
+              decisionId: envelope.decision_id,
+              current_fingerprint: et.current_fingerprint,
+              authorized_fingerprint: et.authorized_fingerprint,
+              reason: et.reason,
+              note: execution_time_fingerprint_js_1.EXECUTION_STATE_UNMEASURABLE_NOTE
+            });
+          } else {
+            emit(config, {
+              type: "execution_state_drift_observed",
+              at: iso(),
+              decisionId: envelope.decision_id,
+              current_fingerprint: et.current_fingerprint,
+              authorized_fingerprint: et.authorized_fingerprint,
+              reason: et.reason
+            });
           }
+          const warnVerdict = kind === "ALLOW" ? { kind: "ALLOW", action: "CONTINUE", envelope, receiptVerified } : { kind: "MONITOR", action: "CONTINUE_WITH_MONITORING", envelope, receiptVerified };
+          return runUnenforced(config, executeFactory, envelope, warnVerdict, true, redacted, freshBasis, cwBasis);
         }
         const approved = kind === "ALLOW" ? { kind: "ALLOW", action: "CONTINUE", envelope, receiptVerified: true } : { kind: "MONITOR", action: "CONTINUE_WITH_MONITORING", envelope, receiptVerified: true };
         return runEnforced(config, executeFactory, approved, redacted, freshBasis, cwBasis);
@@ -69861,24 +69872,25 @@ var require_merge_gate = __commonJS({
       if (!isAllowClass(receipt, allowWarnMerge)) {
         return fail("failure", "decision_not_allow");
       }
-      const inescapable_merge = enforcement_state === "ENFORCING" && protection.admin_bypass_possible === false;
+      const protectionOk = enforcement_state === "ENFORCING" && protection.admin_bypass_possible === false;
+      const appBound = protection.required_check_app_bound === true;
+      const rebound = rc.expected_fingerprint != null && String(rc.expected_fingerprint).length > 0;
+      const inescapable_merge = protectionOk && appBound && rebound;
       const residuals = [];
-      if (!inescapable_merge) {
+      if (!protectionOk) {
         if (enforcement_state === "ENFORCING")
           residuals.push("admin_bypass_open");
         else if (enforcement_state === "ADVISORY")
           residuals.push("protection_advisory_only");
         else
           residuals.push("protection_not_configured");
+      } else if (protection.required_check_app_bound === true) {
+      } else if (protection.required_check_app_bound === false) {
+        residuals.push("required_check_app_not_bound");
       } else {
-        if (protection.required_check_app_bound === true) {
-        } else if (protection.required_check_app_bound === false) {
-          residuals.push("required_check_app_not_bound");
-        } else {
-          residuals.push("required_check_app_binding_unknown");
-        }
+        residuals.push("required_check_app_binding_unknown");
       }
-      if (rc.expected_fingerprint == null) {
+      if (!rebound) {
         residuals.push("change_set_not_rebound");
       }
       const residual = residuals.length > 0 ? residuals[0] : void 0;
@@ -70001,15 +70013,17 @@ var require_deploy_gate = __commonJS({
       if (!isAllowClass(receipt, allowWarnDeploy)) {
         return deny("failure", "decision_not_allow");
       }
-      const inescapable_deploy = enforcement_state === "ENFORCING" && enf.bypass_possible === false;
+      const enforcementOk = enforcement_state === "ENFORCING" && enf.bypass_possible === false;
+      const rebound = rc.expected_fingerprint != null && String(rc.expected_fingerprint).length > 0;
+      const inescapable_deploy = enforcementOk && rebound;
       const residuals = [];
-      if (!inescapable_deploy) {
+      if (!enforcementOk) {
         if (enforcement_state === "ENFORCING")
           residuals.push("bypass_open");
         else
           residuals.push("enforcement_not_configured");
       }
-      if (rc.expected_fingerprint == null) {
+      if (!rebound) {
         residuals.push("change_set_not_rebound");
       }
       const residual = residuals.length > 0 ? residuals[0] : void 0;
@@ -70298,6 +70312,7 @@ var require_with_coderifts = __commonJS({
     var COMPOSITION_CALL_POLICY_COMPLETE = false;
     var RESIDUAL_CALL_POLICY_INCOMPLETE = "composition_call_policy_incomplete";
     var RESIDUAL_FRESHNESS_NOT_CONFIGURED = "composition_freshness_not_configured";
+    var RESIDUAL_CALLS_OUTSIDE_GUARDED_PATH = "calls_outside_guarded_path_invisible";
     var RESIDUAL_FORCED_READONLY = "composition_forced_readonly_on_heuristic_mutator";
     var RESIDUAL_UNKNOWN_READONLY = "composition_unknown_treated_as_readonly";
     var COVERAGE_STRENGTH = {
@@ -70309,6 +70324,30 @@ var require_with_coderifts = __commonJS({
     function coverageRank(coverage) {
       return Object.prototype.hasOwnProperty.call(COVERAGE_STRENGTH, coverage) ? COVERAGE_STRENGTH[coverage] : void 0;
     }
+    function isEnforcingStrict(input) {
+      return input.profile === "ENFORCING_STRICT";
+    }
+    function enforcingStrictWeakenFlags(input) {
+      const flags = [];
+      if (input.requireCoverage !== void 0) {
+        const rank = coverageRank(input.requireCoverage);
+        if (rank !== void 0 && rank < COVERAGE_STRENGTH.COMPLETE)
+          flags.push("requireCoverage");
+      }
+      if (input.requireFreshness === false)
+        flags.push("requireFreshness");
+      if (input.requireExecutionStateMatch === false || input.requireExecutionStateMatch === "warn") {
+        flags.push("requireExecutionStateMatch");
+      }
+      if (input.requireConditionalWrite === false)
+        flags.push("requireConditionalWrite");
+      const reg = input.registry ?? {};
+      if (reg.failOnUnguardedMutator === false)
+        flags.push("failOnUnguardedMutator");
+      if (reg.unknownToolPolicy === "readonly")
+        flags.push("unknownToolPolicy");
+      return flags;
+    }
     async function safeOnSettledCall(onSettledCall, payload) {
       try {
         await Promise.resolve(onSettledCall(payload));
@@ -70495,6 +70534,18 @@ var require_with_coderifts = __commonJS({
       if (input.requireCoverage !== void 0 && coverageRank(input.requireCoverage) === void 0) {
         problems.push(`\`requireCoverage\` must be one of COMPLETE | PARTIAL | BYPASSED | UNKNOWN (got ${JSON.stringify(input.requireCoverage)})`);
       }
+      if (input.profile !== void 0 && input.profile !== "ENFORCING_STRICT") {
+        problems.push(`\`profile\` must be 'ENFORCING_STRICT' when set (got ${JSON.stringify(input.profile)})`);
+      }
+      if (isEnforcingStrict(input)) {
+        const weaken = enforcingStrictWeakenFlags(input);
+        if (weaken.length > 0) {
+          problems.push(`ENFORCING_STRICT cannot be weakened: ${weaken.join(", ")} conflicts`);
+        }
+        if (typeof input.resolvePriorContent !== "function") {
+          problems.push("ENFORCING_STRICT cannot be weakened: resolvePriorContent conflicts");
+        }
+      }
       if (problems.length > 0) {
         throw new Error(`withCodeRifts: construction aborted \u2014 ${problems.length} condition(s):
 ` + problems.map((p) => `  - ${p}`).join("\n"));
@@ -70533,20 +70584,27 @@ var require_with_coderifts = __commonJS({
       if (input.requireExecutionStateMatch !== void 0) {
         guard.requireExecutionStateMatch = input.requireExecutionStateMatch;
       }
+      const strict = isEnforcingStrict(input);
+      if (strict) {
+        guard.requireFreshness = true;
+        guard.requireConditionalWrite = true;
+        guard.requireExecutionStateMatch = true;
+      }
       const config = {
         guard,
-        unknownToolPolicy: reg.unknownToolPolicy ?? "mutating",
+        unknownToolPolicy: strict ? reg.unknownToolPolicy === "reject" ? "reject" : "mutating" : reg.unknownToolPolicy ?? "mutating",
         classify: reg.classify,
         binders: reg.binders,
         forceReadonly: reg.forceReadonly,
-        failOnUnguardedMutator: reg.failOnUnguardedMutator
+        failOnUnguardedMutator: strict ? true : reg.failOnUnguardedMutator
       };
+      const requireCoverage = strict ? "COMPLETE" : input.requireCoverage;
       const { tools, report } = (0, tool_registry_js_1.guardToolRegistry)(input.tools, config);
-      if (input.requireCoverage !== void 0) {
-        const requiredRank = coverageRank(input.requireCoverage);
+      if (requireCoverage !== void 0) {
+        const requiredRank = coverageRank(requireCoverage);
         const actualRank = coverageRank(report.coverage) ?? -1;
         if (requiredRank !== void 0 && actualRank < requiredRank) {
-          throw new Error(`withCodeRifts: requireCoverage not met \u2014 registry coverage '${report.coverage}' is weaker than required '${input.requireCoverage}' (strength ordering COMPLETE > PARTIAL > BYPASSED > UNKNOWN). requireCoverage constrains the REGISTRY tool-boundary surface ONLY; a green construction here is NOT a product-level runtime-inescapability guarantee \u2014 composition_assurance.inescapable_runtime stays false until receipt carry-forward and a freshness-safe prior for write-style calls land.`);
+          throw new Error(`withCodeRifts: requireCoverage not met \u2014 registry coverage '${report.coverage}' is weaker than required '${requireCoverage}' (strength ordering COMPLETE > PARTIAL > BYPASSED > UNKNOWN). requireCoverage constrains the REGISTRY tool-boundary surface ONLY; a green construction here is NOT a product-level runtime-inescapability guarantee \u2014 composition_assurance.inescapable_runtime stays false until receipt carry-forward and a freshness-safe prior for write-style calls land.`);
         }
       }
       const compositionInescapableRuntime = report.claim.inescapable_runtime && COMPOSITION_CALL_POLICY_COMPLETE;
@@ -70561,9 +70619,12 @@ var require_with_coderifts = __commonJS({
       if (!freshness_resolver_wired) {
         residuals.push(RESIDUAL_FRESHNESS_NOT_CONFIGURED);
       }
-      if (input.requireConditionalWrite === true) {
+      if (input.requireConditionalWrite === true || strict) {
         residuals.push("composition_unconditional_write_under_policy");
       }
+      if (strict) {
+        residuals.push(RESIDUAL_CALLS_OUTSIDE_GUARDED_PATH);
+      }
       const composition_assurance = {
         coverage: "PARTIAL",
         inescapable_runtime: compositionInescapableRuntime,
@@ -71755,7 +71816,8 @@ var require_deploy_gate2 = __commonJS({
         if (enforcement === "ENFORCING") out.push("bypass_open");
         else if (enforcement === "ADVISORY") out.push("deploy_gate_advisory");
         else if (enforcement === "ABSENT") out.push("deploy_path_ungated");
-      } else if (change_set_rebound !== true) {
+      }
+      if (change_set_rebound !== true) {
         out.push("change_set_not_rebound");
       }
       return out;
@@ -71793,8 +71855,8 @@ var require_deploy_gate2 = __commonJS({
         if (expected_body_hash != null) requiredContext.expected_body_hash = expected_body_hash;
       }
       const gate = deployGate({ deployTarget: { environment, artifact_id }, receipt, requiredContext });
-      const enforcement_inescapable = gate.inescapable_deploy === true;
-      const inescapable_deploy = enforcement_inescapable && change_set_rebound === true;
+      const enforcement_inescapable = attested_enforcement === "ENFORCING" && !!(observed_cd_enforcement && observed_cd_enforcement.bypass_possible === false);
+      const inescapable_deploy = gate.inescapable_deploy === true && change_set_rebound === true;
       return {
         deploy_check_status: gate.state,
         reason: gate.reason,
@@ -73285,9 +73347,9 @@ generator_detection: true
       chalk.dim("    (uses YOUR gh credentials; CodeRifts never takes admin rights)."),
       chalk.dim("  To attest cross-layer ENFORCING after wiring: coderifts enforce --apply"),
       chalk.dim("    (dry-run without --apply; does not auto-flip defaults)."),
-      chalk.dim("  For agent tool-call guarding with execution-state telemetry: set"),
-      chalk.dim("    requireExecutionStateMatch: 'warn' in your guard config"),
-      chalk.dim("    (observes drift, does not block) \u2014 see: coderifts agent-setup"),
+      chalk.dim("  For agent tool-call guarding: @coderifts/agent-guard requireExecutionStateMatch"),
+      chalk.dim("    defaults ON (absent\u2192true) \u2014 observed drift STOPS. Opt-down: 'warn' (emit, proceed)"),
+      chalk.dim("    or false (proceed-on-drift) \u2014 see: coderifts agent-setup"),
       chalk.dim("  Agent-using repo? Run: coderifts agent-setup")
     ]);
     module2.exports = {
@@ -100000,12 +100062,12 @@ var require_agent_host_files_embedded = __commonJS({
       "openai-agent-instructions.md"
     ]);
     var AGENT_HOST_FILES = Object.freeze({
-      "AGENTS.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent rules\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n',
-      "CLAUDE.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n',
-      ".cursor/rules/coderifts.mdc": '---\ndescription: CodeRifts API governance \u2014 when to preflight and how to branch\nglobs:\nalwaysApply: true\n---\n\n<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n',
-      ".github/copilot-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts instructions for GitHub Copilot\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n',
-      "coderifts-langgraph-policy.js": '// GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js\n// System policy string for a LangGraph (or similar) agent. Content is generated;\n// identical rule sentences to AGENTS.md / other formats.\n\'use strict\';\n\nmodule.exports = "Call `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\\n\\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\\n\\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\\n\\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\\n\\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not \\"proceed with caution\\" without monitoring.\\n\\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\\n\\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\\n\\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\\n\\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.";\n',
-      "openai-agent-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent instructions\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n'
+      "AGENTS.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent rules\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nA receipt is operation-scoped: a merge receipt never authorizes a deploy or publish. When the operation changes, you MUST call `preflight_change_set` again with the new `context.operation` \u2014 do not decline, re-preflight.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n',
+      "CLAUDE.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nA receipt is operation-scoped: a merge receipt never authorizes a deploy or publish. When the operation changes, you MUST call `preflight_change_set` again with the new `context.operation` \u2014 do not decline, re-preflight.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n',
+      ".cursor/rules/coderifts.mdc": '---\ndescription: CodeRifts API governance \u2014 when to preflight and how to branch\nglobs:\nalwaysApply: true\n---\n\n<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nA receipt is operation-scoped: a merge receipt never authorizes a deploy or publish. When the operation changes, you MUST call `preflight_change_set` again with the new `context.operation` \u2014 do not decline, re-preflight.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n',
+      ".github/copilot-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts instructions for GitHub Copilot\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nA receipt is operation-scoped: a merge receipt never authorizes a deploy or publish. When the operation changes, you MUST call `preflight_change_set` again with the new `context.operation` \u2014 do not decline, re-preflight.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n',
+      "coderifts-langgraph-policy.js": '// GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js\n// System policy string for a LangGraph (or similar) agent. Content is generated;\n// identical rule sentences to AGENTS.md / other formats.\n\'use strict\';\n\nmodule.exports = "Call `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\\n\\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\\n\\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\\n\\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\\n\\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not \\"proceed with caution\\" without monitoring.\\n\\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\\n\\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\\n\\nA receipt is operation-scoped: a merge receipt never authorizes a deploy or publish. When the operation changes, you MUST call `preflight_change_set` again with the new `context.operation` \u2014 do not decline, re-preflight.\\n\\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\\n\\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\\n\\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.";\n',
+      "openai-agent-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent instructions\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nA receipt is operation-scoped: a merge receipt never authorizes a deploy or publish. When the operation changes, you MUST call `preflight_change_set` again with the new `context.operation` \u2014 do not decline, re-preflight.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n'
     });
     module2.exports = { AGENT_HOST_FILES, AGENT_HOST_PATHS };
   }
@@ -100150,13 +100212,14 @@ ${USAGE}` };
       return { exitCode: 0, code: "OK", outDir, ...summary };
     }
     var AGENT_SETUP_WARN_TELEMETRY_LINES = Object.freeze([
-      chalk.bold("  Opt-in: execution-state warn telemetry (does not block)"),
-      chalk.dim("  Set requireExecutionStateMatch: 'warn' in @coderifts/agent-guard"),
-      chalk.dim("  (or withCodeRifts) config. Default remains OFF \u2014 this is opt-in only."),
-      chalk.dim("  What it emits (then PROCEEDS \u2014 never blocks in warn mode):"),
+      chalk.bold("  Execution-state recheck (guard@8): DEFAULT ON"),
+      chalk.dim("  requireExecutionStateMatch absent/true \u2192 enforce: mismatch \u2192 EXECUTION_STATE_DRIFT"),
+      chalk.dim("  (factory does not run); missing fingerprint/artifacts \u2192 EXECUTION_STATE_UNMEASURABLE (STOP)."),
+      chalk.dim("  Opt-down: requireExecutionStateMatch: 'warn' (emit, then run unenforced on mismatch)"),
+      chalk.dim("  or false (no recheck \u2014 v7 proceed-on-drift). Must be set explicitly."),
+      chalk.dim("  Warn emits (then PROCEEDS \u2014 never blocks in warn mode):"),
       chalk.dim("    \xB7 real drift \u2192 execution_state_drift_observed (loud)"),
       chalk.dim("    \xB7 missing artifacts/fingerprint \u2192 execution_state_unmeasurable (quiet)"),
-      chalk.dim("  Enforce later with requireExecutionStateMatch: true only when ready."),
       chalk.dim("  Merge gate block is separate: coderifts setup-required-check --apply")
     ]);
     module2.exports = {
@@ -101133,21 +101196,23 @@ var require_claude_hook = __commonJS({
       "configured contract spec path. Reads JSON context from STDIN.",
       "",
       "Exit map (Claude Code semantics \u2014 get this exactly right):",
-      "  2  BLOCK \u2014 tool call cancelled (decision BLOCK/STOP or unrecognised execution_action)",
-      "  0  allow \u2014 or soft-skip (see soft contracts)",
+      "  2  BLOCK \u2014 tool call cancelled (BLOCK/STOP, REQUEST_APPROVAL, unrecognised action,",
+      "     governance could not run, CONTINUE_WITH_MONITORING without a wired sink)",
+      "  0  allow \u2014 CONTINUE, or CWM with a host-asserted monitoring sink, or non-contract skip",
       "  1  NEVER used for security deny (Claude treats exit 1 as non-blocking; action proceeds)",
       "",
-      "Soft contracts DEFAULT (exit 0 + one-line stderr \u2014 do not brick the session):",
-      "  no API key (git config coderifts.apiKey / coderifts login / CODERIFTS_API_KEY)",
-      "  unparseable/unknown stdin shape",
-      "  file_path is not the configured spec path",
-      "  Edit/MultiEdit cannot be applied cleanly to disk content",
-      "  API unreachable / network error / disk unreadable",
+      "Fail-closed DEFAULT (exit 2, reason enforce_indeterminate) when governance could not run:",
+      "  no API key / API unreachable / disk unreadable / edit-apply failure on the spec path",
+      "  Absence of a key is not permission. Explicit opt-out: CODERIFTS_ADVISORY=1|true.",
+      "",
+      "Still exit 0 (nothing to govern): unparseable stdin, missing file_path, non-spec path,",
+      "identical content.",
       "",
-      "CODERIFTS_STRICT=1|true (opt-in): enforcement-relevant soft sites \u2192 EXIT 2 (BLOCK).",
-      "  Hardens: no API key, API unreachable, disk unreadable, edit-apply failure on the spec.",
-      "  Still soft: non-spec path, identical content, bad stdin, WARN (governance already ran).",
-      "  Host-side choice for CI/prod \u2014 not a package-level guarantee.",
+      "CONTINUE_WITH_MONITORING: allow only if the host asserts a sink",
+      "  (CODERIFTS_MONITORING_SINK_WIRED=1|true or git config coderifts.monitoringSinkWired).",
+      "  Host claim \u2014 not delivery proof (same class as GuardConfig.monitoringSinkWired).",
+      "",
+      "CODERIFTS_STRICT=1|true: same fail-closed as default; cannot be weakened by ADVISORY.",
       "",
       "Spec path (same source as git pre-push hook):",
       "  git config coderifts.specPath  (default: api/openapi.yaml)",
@@ -101158,21 +101223,56 @@ var require_claude_hook = __commonJS({
       "",
       "Push-time equivalent: coderifts hook install (git exit 1 on BLOCK)."
     ].join("\n");
-    function isStrictMode(env = process.env) {
-      const v = env && env.CODERIFTS_STRICT;
+    function isEnvFlag(env, name) {
+      const v = env && env[name];
       if (v == null || v === "") return false;
       const s = String(v).trim().toLowerCase();
       return s === "1" || s === "true";
     }
-    function softOrStrictBlock({ strict, reason, softMsg, why, errLog }) {
+    function isStrictMode(env = process.env) {
+      return isEnvFlag(env, "CODERIFTS_STRICT");
+    }
+    function isAdvisoryMode(env = process.env) {
+      return isEnvFlag(env, "CODERIFTS_ADVISORY");
+    }
+    function isMonitoringSinkWired({ env = process.env, deps = {}, result = null } = {}) {
+      if (deps && deps.monitoringSinkWired === true) return true;
+      if (isEnvFlag(env, "CODERIFTS_MONITORING_SINK_WIRED")) return true;
+      const git = readGitConfig("coderifts.monitoringSinkWired", deps);
+      if (git) {
+        const s = String(git).trim().toLowerCase();
+        if (s === "1" || s === "true") return true;
+      }
+      if (result && result.monitoringSinkWired === true) return true;
+      const dr = result && result.decision_result;
+      if (dr && typeof dr === "object" && dr.monitoringSinkWired === true) return true;
+      return false;
+    }
+    function failClosedOrAdvisory({ advisory, strict, site, softMsg, why, errLog }) {
+      if (advisory && !strict) {
+        errLog(`${softMsg} (CODERIFTS_ADVISORY)`);
+        return { exitCode: 0, reason: site, site };
+      }
       if (strict) {
         errLog(
           `CodeRifts claude-hook: CODERIFTS_STRICT: governance could not run (${why}) \u2014 blocking. Set a key / restore network, or unset CODERIFTS_STRICT.`
         );
-        return { exitCode: 2, reason, strictBlocked: true };
+        return { exitCode: 2, reason: "enforce_indeterminate", site, strictBlocked: true };
       }
-      errLog(softMsg);
-      return { exitCode: 0, reason };
+      errLog(
+        `CodeRifts claude-hook: governance could not run (${why}) \u2014 blocking. Set CODERIFTS_ADVISORY=1 to allow without governance (explicit opt-out).`
+      );
+      return { exitCode: 2, reason: "enforce_indeterminate", site };
+    }
+    function softOrStrictBlock({ strict, reason, softMsg, why, errLog }) {
+      return failClosedOrAdvisory({
+        advisory: false,
+        strict: !!strict,
+        site: reason,
+        softMsg,
+        why,
+        errLog
+      });
     }
     function readGitConfig(key, deps = {}) {
       const run = deps.execSync || execSync;
@@ -101279,7 +101379,7 @@ var require_claude_hook = __commonJS({
       return { ok: false, reason: `unsupported tool_name for content derive: ${name}` };
     }
     function mapDecisionSeverity(result) {
-      const d = result && typeof result === "object" ? result : {};
+      const d = result && typeof result === "object" && !Array.isArray(result) ? result : {};
       let ea = null;
       const dr = d.decision_result;
       if (dr && typeof dr === "object" && typeof dr.execution_action === "string") {
@@ -101287,20 +101387,33 @@ var require_claude_hook = __commonJS({
       } else if (typeof d.execution_action === "string") {
         ea = d.execution_action;
       }
+      const hasDecision = d.omega_decision != null && d.omega_decision !== "" || d.decision != null && d.decision !== "" || dr && typeof dr === "object" && dr.execution_action;
+      if (d.error && !hasDecision && (ea == null || ea === "")) {
+        return {
+          severity: "INDETERMINATE",
+          decision: null,
+          decisionId: null,
+          executionAction: null
+        };
+      }
       let severity;
       if (ea != null && ea !== "") {
         if (!CLOSED_ACTIONS.has(ea)) {
           severity = "UNKNOWN";
-        } else if (ea === "CONTINUE" || ea === "CONTINUE_WITH_MONITORING") {
+        } else if (ea === "CONTINUE") {
           severity = "ALLOW";
+        } else if (ea === "CONTINUE_WITH_MONITORING") {
+          severity = "MONITOR";
         } else if (ea === "STOP") {
           severity = "BLOCK";
         } else {
           severity = "REQUIRE_APPROVAL";
         }
       } else {
-        const od = d.omega_decision || d.decision || "ALLOW";
-        if (od === "BLOCK") severity = "BLOCK";
+        const od = d.omega_decision || d.decision;
+        if (od == null || od === "") {
+          severity = "INDETERMINATE";
+        } else if (od === "BLOCK") severity = "BLOCK";
         else if (od === "REQUIRE_APPROVAL") severity = "REQUIRE_APPROVAL";
         else if (od === "WARN") severity = "WARN";
         else severity = "ALLOW";
@@ -101309,7 +101422,7 @@ var require_claude_hook = __commonJS({
       const decisionId = dr && dr.decision_id || d.decision_id || null;
       return {
         severity,
-        decision: decision != null ? String(decision) : null,
+        decision: decision != null && decision !== "" ? String(decision) : null,
         decisionId: decisionId != null ? String(decisionId) : null,
         executionAction: ea
       };
@@ -101329,11 +101442,13 @@ var require_claude_hook = __commonJS({
       const cwd = deps.cwd || process.cwd();
       const env = deps.env || process.env;
       const strict = isStrictMode(env);
+      const advisory = isAdvisoryMode(env);
       const apiKey = resolveApiKey({ ...deps, cwd, env });
       if (!apiKey) {
-        return softOrStrictBlock({
+        return failClosedOrAdvisory({
+          advisory,
           strict,
-          reason: "missing_api_key",
+          site: "missing_api_key",
           why: "no API key",
           softMsg: "CodeRifts claude-hook: no API key (coderifts login / CODERIFTS_API_KEY / git config coderifts.apiKey) \u2014 allowing",
           errLog
@@ -101361,9 +101476,10 @@ var require_claude_hook = __commonJS({
         try {
           diskBefore = readFile(absPath, "utf8");
         } catch (e) {
-          return softOrStrictBlock({
+          return failClosedOrAdvisory({
+            advisory,
             strict,
-            reason: "disk_unreadable",
+            site: "disk_unreadable",
             why: `cannot read contract file ${absPath}`,
             softMsg: `CodeRifts claude-hook: cannot read ${absPath} \u2014 allowing (soft)`,
             errLog
@@ -101372,9 +101488,10 @@ var require_claude_hook = __commonJS({
       }
       const derived = deriveAfterContent(toolName, toolInput, diskBefore);
       if (!derived.ok) {
-        return softOrStrictBlock({
+        return failClosedOrAdvisory({
+          advisory,
           strict,
-          reason: "edit_apply_failed",
+          site: "edit_apply_failed",
           why: derived.reason,
           softMsg: `CodeRifts claude-hook: ${derived.reason} \u2014 allowing (soft; never guess edit apply)`,
           errLog
@@ -101391,9 +101508,10 @@ var require_claude_hook = __commonJS({
         });
       } catch (e) {
         const msg = e && e.message ? String(e.message) : "request failed";
-        return softOrStrictBlock({
+        return failClosedOrAdvisory({
+          advisory,
           strict,
-          reason: "api_unreachable",
+          site: "api_unreachable",
           why: `API unreachable: ${msg}`,
           softMsg: `CodeRifts claude-hook: API unreachable (${msg}) \u2014 allowing (soft; availability must not brick the editor)`,
           errLog
@@ -101403,6 +101521,18 @@ var require_claude_hook = __commonJS({
       const idPart = mapped.decisionId ? ` decision_id=${mapped.decisionId}` : "";
       const decPart = mapped.decision ? ` decision=${mapped.decision}` : "";
       const eaPart = mapped.executionAction ? ` execution_action=${mapped.executionAction}` : "";
+      if (mapped.severity === "INDETERMINATE") {
+        errLog(
+          "CodeRifts claude-hook: BLOCKED (indeterminate response \u2014 no execution_action and no decision; not permission)"
+        );
+        return {
+          exitCode: 2,
+          reason: "indeterminate",
+          severity: "INDETERMINATE",
+          decision: mapped.decision,
+          decisionId: mapped.decisionId
+        };
+      }
       if (mapped.severity === "BLOCK" || mapped.severity === "UNKNOWN") {
         errLog(
           `CodeRifts claude-hook: BLOCKED${decPart}${eaPart}${idPart}` + (mapped.severity === "UNKNOWN" ? " (unrecognised execution_action)" : "")
@@ -101415,16 +101545,40 @@ var require_claude_hook = __commonJS({
           decisionId: mapped.decisionId
         };
       }
-      if (mapped.severity === "REQUIRE_APPROVAL" || mapped.severity === "WARN") {
-        errLog(`CodeRifts claude-hook: WARNING ${mapped.severity}${decPart}${eaPart}${idPart}`);
+      if (mapped.severity === "REQUIRE_APPROVAL") {
+        errLog(
+          `CodeRifts claude-hook: BLOCKED approval_required${decPart}${eaPart}${idPart}`
+        );
         return {
-          exitCode: 0,
-          reason: "warn",
+          exitCode: 2,
+          reason: "approval_required",
           severity: mapped.severity,
           decision: mapped.decision,
           decisionId: mapped.decisionId
         };
       }
+      if (mapped.severity === "MONITOR" || mapped.severity === "WARN") {
+        const sinkWired = isMonitoringSinkWired({ env, deps, result });
+        if (!sinkWired) {
+          errLog(
+            `CodeRifts claude-hook: BLOCKED monitoring_unwired${decPart}${eaPart}${idPart} \u2014 CONTINUE_WITH_MONITORING requires CODERIFTS_MONITORING_SINK_WIRED=1 (host assertion; not delivery proof)`
+          );
+          return {
+            exitCode: 2,
+            reason: "monitoring_unwired",
+            severity: mapped.severity === "WARN" ? "MONITOR" : mapped.severity,
+            decision: mapped.decision,
+            decisionId: mapped.decisionId
+          };
+        }
+        return {
+          exitCode: 0,
+          reason: "allow",
+          severity: mapped.severity === "WARN" ? "MONITOR" : mapped.severity,
+          decision: mapped.decision,
+          decisionId: mapped.decisionId
+        };
+      }
       return {
         exitCode: 0,
         reason: "allow",
@@ -101442,7 +101596,11 @@ var require_claude_hook = __commonJS({
       resolveApiKey,
       resolveSpecPath,
       readGitConfig,
+      isEnvFlag,
       isStrictMode,
+      isAdvisoryMode,
+      isMonitoringSinkWired,
+      failClosedOrAdvisory,
       softOrStrictBlock,
       DEFAULT_SPEC_PATH,
       CLOSED_ACTIONS,
@@ -103446,7 +103604,7 @@ ${USAGE}
   }
 });
 program.command("claude-hook").description(
-  "Claude Code PreToolUse gate: block contract-touching Write|Edit|MultiEdit on BLOCK/STOP (exit 2). Soft-allow when unconfigured/unparseable/API down."
+  "Claude Code PreToolUse gate: block contract-touching Write|Edit|MultiEdit on BLOCK/STOP/REQUEST_APPROVAL (exit 2). Fail-closed when governance cannot run; CODERIFTS_ADVISORY=1 is the explicit soft opt-out."
 ).addHelpText("after", () => {
   const { USAGE } = require_claude_hook();
   return `

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coderifts",
-  "version": "3.3.0",
+  "version": "4.0.0",
   "description": "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
   "author": "CodeRifts <hello@coderifts.com>",
   "license": "MIT",
@@ -13,6 +13,7 @@
     "bin/",
     "scripts/",
     "README.md",
+    "CHANGELOG.md",
     "corpus/"
   ],
   "keywords": [
@@ -44,7 +45,7 @@
     "test": "node --test test/*.test.js"
   },
   "dependencies": {
-    "@coderifts/agent-guard": "^6.4.0",
+    "@coderifts/agent-guard": "^8.1.1",
     "chalk": "^4.1.2",
     "cli-table3": "^0.6.4",
     "commander": "^12.0.0",

package/scripts/assert-guard-major.js

@@ -5,18 +5,19 @@
  * CLI release gate (prepublishOnly): refuse to publish if the declared
  * @coderifts/agent-guard range floors below the minimum acceptable major.
  *
- * Honest scope: compares the dependency *range floor* (e.g. ^6.4.0 → 6) to a
+ * Honest scope: compares the dependency *range floor* (e.g. ^8.1.1 → 8) to a
  * pinned constant. Does not call npm registry. Optional: if node_modules has a
  * resolved package, also fail when its major is below the floor (stale install).
  *
  * Why: evening audit 2.4 — CLI sat on ^1.6.0 while published guard is 6.x.
+ * 4.0.0: floor raised to 8 (deployGate inescapable_deploy includes fingerprint rebound).
  */
 
 const fs = require('fs');
 const path = require('path');
 
 /** Minimum acceptable major for @coderifts/agent-guard (published line). */
-const MIN_GUARD_MAJOR = 6;
+const MIN_GUARD_MAJOR = 8;
 const DEP = '@coderifts/agent-guard';
 
 function fail(msg) {