coderifts 4.11.0 → 4.12.0

package/dist/cli.js

@@ -3028,7 +3028,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "4.11.0",
+      version: "4.12.0",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -3073,7 +3073,7 @@ var require_package = __commonJS({
         test: "node --test test/*.test.js"
       },
       dependencies: {
-        "@coderifts/agent-guard": "^9.0.0",
+        "@coderifts/agent-guard": "^10.0.0",
         chalk: "^4.1.2",
         "cli-table3": "^0.6.4",
         commander: "^12.0.0",
@@ -66545,6 +66545,133 @@ var require_execution_time_fingerprint = __commonJS({
   }
 });
 
+// node_modules/@coderifts/agent-guard/dist/cjs/coverage-observed.js
+var require_coverage_observed = __commonJS({
+  "node_modules/@coderifts/agent-guard/dist/cjs/coverage-observed.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.createCoverageObserver = createCoverageObserver;
+    exports2.freezeCoverageObserved = freezeCoverageObserved;
+    exports2.formatCoverageObservedLine = formatCoverageObservedLine;
+    function uniqueInOrder(names) {
+      const seen = /* @__PURE__ */ new Set();
+      const out = [];
+      for (const n of names) {
+        if (seen.has(n))
+          continue;
+        seen.add(n);
+        out.push(n);
+      }
+      return out;
+    }
+    function createCoverageObserver() {
+      const table = /* @__PURE__ */ new Set();
+      const governed = [];
+      const host = [];
+      let hostReported = false;
+      function snapshot() {
+        const tools = uniqueInOrder(governed);
+        if (!hostReported) {
+          return freezeCoverageObserved({
+            class: "UNKNOWN_OUTSIDE_SCOPE",
+            governed_calls: governed.length,
+            tools
+          });
+        }
+        const ungovernedList = host.filter((n) => !table.has(n));
+        if (ungovernedList.length > 0) {
+          return freezeCoverageObserved({
+            class: "INCOMPLETE_OBSERVED",
+            governed_calls: governed.length,
+            tools,
+            total_calls: host.length,
+            ungoverned_calls: ungovernedList.length,
+            ungoverned_tools: uniqueInOrder(ungovernedList)
+          });
+        }
+        return freezeCoverageObserved({
+          class: "COMPLETE_OBSERVED",
+          governed_calls: governed.length,
+          tools,
+          total_calls: host.length,
+          ungoverned_calls: 0,
+          ungoverned_tools: []
+        });
+      }
+      function reportOne(ev) {
+        if (!ev || typeof ev.name !== "string")
+          return false;
+        const name = ev.name.trim();
+        if (!name)
+          return false;
+        host.push(name);
+        return true;
+      }
+      const handle = {
+        snapshot,
+        reportToolDispatch(ev) {
+          if (reportOne(ev))
+            hostReported = true;
+        },
+        reportToolDispatchBatch(evs) {
+          if (!Array.isArray(evs))
+            return;
+          hostReported = true;
+          for (const ev of evs)
+            reportOne(ev);
+        }
+      };
+      return {
+        setTableNames(names) {
+          table.clear();
+          if (!Array.isArray(names) && !names)
+            return;
+          for (const n of names) {
+            if (typeof n === "string" && n)
+              table.add(n);
+          }
+        },
+        recordGoverned(name) {
+          if (typeof name === "string" && name)
+            governed.push(name);
+        },
+        snapshot,
+        handle
+      };
+    }
+    function freezeCoverageObserved(obs) {
+      const tools = Object.freeze(obs.tools.slice());
+      if (obs.class === "UNKNOWN_OUTSIDE_SCOPE") {
+        return Object.freeze({
+          class: "UNKNOWN_OUTSIDE_SCOPE",
+          governed_calls: obs.governed_calls,
+          tools
+        });
+      }
+      return Object.freeze({
+        class: obs.class,
+        governed_calls: obs.governed_calls,
+        tools,
+        total_calls: obs.total_calls,
+        ungoverned_calls: obs.ungoverned_calls,
+        ungoverned_tools: Object.freeze((obs.ungoverned_tools || []).slice())
+      });
+    }
+    function formatCoverageObservedLine(obs) {
+      const n = obs.governed_calls;
+      const callWord = n === 1 ? "call" : "calls";
+      if (obs.class === "UNKNOWN_OUTSIDE_SCOPE") {
+        return `governed ${n} ${callWord}; traffic outside the guarded table not observable from here`;
+      }
+      if (obs.class === "INCOMPLETE_OBSERVED") {
+        const names = obs.ungoverned_tools.join(", ");
+        return `governed ${n}/${obs.total_calls} dispatched calls; ${obs.ungoverned_calls} outside the guarded table: ${names}`;
+      }
+      return `governed ${n}/${obs.total_calls} dispatched calls; 0 outside the guarded table`;
+    }
+  }
+});
+
 // node_modules/@coderifts/agent-guard/dist/cjs/execution-proof.js
 var require_execution_proof = __commonJS({
   "node_modules/@coderifts/agent-guard/dist/cjs/execution-proof.js"(exports2) {
@@ -66555,6 +66682,7 @@ var require_execution_proof = __commonJS({
     exports2.hashExecutionResult = hashExecutionResult;
     exports2.buildExecutionProof = buildExecutionProof;
     var node_crypto_1 = require("node:crypto");
+    var coverage_observed_js_1 = require_coverage_observed();
     exports2.EXECUTION_PROOF_SPEC = "guard-execution-proof.v1";
     var LIMITS = Object.freeze({
       does_not_claim_change_safe: true,
@@ -66681,9 +66809,21 @@ var require_execution_proof = __commonJS({
       if (input.casEvidence && typeof input.casEvidence === "object") {
         proof.cas_evidence = Object.freeze({ ...input.casEvidence });
       }
+      if (input.commitLabel === "authorized_and_committed" || input.commitLabel === "authorized_not_committed") {
+        proof.commit_label = input.commitLabel;
+        if (input.commitLabel === "authorized_not_committed" && input.commitEvidenceReason === "commit_evidence_missing") {
+          proof.commit_evidence_reason = "commit_evidence_missing";
+        }
+      }
+      if (typeof input.monitoringAttestation === "string" && input.monitoringAttestation.length > 0) {
+        proof.monitoring_attestation = input.monitoringAttestation;
+      }
       if (Array.isArray(input.recheckTrail) && input.recheckTrail.length > 0) {
         proof.recheck_trail = Object.freeze(input.recheckTrail.map((e) => Object.freeze({ ...e })));
       }
+      if (input.coverageObserved && typeof input.coverageObserved === "object") {
+        proof.coverage_observed = (0, coverage_observed_js_1.freezeCoverageObserved)(input.coverageObserved);
+      }
       return freezeProof(proof);
     }
     function freezeMonitoringDelivery(d) {
@@ -67780,6 +67920,64 @@ var require_errors5 = __commonJS({
   }
 });
 
+// node_modules/@coderifts/sdk/dist/cjs/decision.js
+var require_decision = __commonJS({
+  "node_modules/@coderifts/sdk/dist/cjs/decision.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.hasExplicitExecutionAction = hasExplicitExecutionAction;
+    exports2.readDecision = readDecision;
+    var EXECUTION_ACTION = {
+      ALLOW: "CONTINUE",
+      WARN: "CONTINUE_WITH_MONITORING",
+      REQUIRE_APPROVAL: "REQUEST_APPROVAL",
+      BLOCK: "STOP"
+    };
+    function isExecutionAction(v) {
+      return v === "CONTINUE" || v === "CONTINUE_WITH_MONITORING" || v === "REQUEST_APPROVAL" || v === "STOP";
+    }
+    function hasExplicitExecutionAction(response) {
+      if (!response || typeof response !== "object")
+        return false;
+      const r = response;
+      const env = r.decision_result;
+      if (env && typeof env === "object" && isExecutionAction(env.execution_action))
+        return true;
+      return isExecutionAction(r.execution_action);
+    }
+    function readDecision(response) {
+      if (!response || typeof response !== "object") {
+        return { executionAction: "STOP", decision: null, reason: "UNREADABLE_DECISION" };
+      }
+      const r = response;
+      const env = r.decision_result;
+      if (env && typeof env === "object" && isExecutionAction(env.execution_action)) {
+        const receipt = env.receipt;
+        return {
+          executionAction: env.execution_action,
+          decision: typeof env.decision === "string" ? env.decision : null,
+          envelope: env,
+          receipt: receipt && typeof receipt === "object" ? receipt : void 0
+        };
+      }
+      if (isExecutionAction(r.execution_action)) {
+        return {
+          executionAction: r.execution_action,
+          decision: typeof r.decision === "string" ? r.decision : null
+        };
+      }
+      if (typeof r.decision === "string" && Object.prototype.hasOwnProperty.call(EXECUTION_ACTION, r.decision)) {
+        return { executionAction: EXECUTION_ACTION[r.decision], decision: r.decision };
+      }
+      return {
+        executionAction: "STOP",
+        decision: typeof r.decision === "string" ? r.decision : null,
+        reason: "UNREADABLE_DECISION"
+      };
+    }
+  }
+});
+
 // node_modules/@coderifts/sdk/dist/cjs/client.js
 var require_client = __commonJS({
   "node_modules/@coderifts/sdk/dist/cjs/client.js"(exports2) {
@@ -67787,6 +67985,7 @@ var require_client = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.CodeRifts = void 0;
     var errors_js_1 = require_errors5();
+    var decision_js_1 = require_decision();
     var DEFAULT_BASE_URL = "https://app.coderifts.com";
     var DEFAULT_TIMEOUT = 3e4;
     var CodeRifts = class {
@@ -67853,11 +68052,15 @@ var require_client = __commonJS({
           old_spec: req.old_spec,
           new_spec: req.new_spec
         });
-        const decision = raw.decision || "ALLOW";
+        const read = (0, decision_js_1.readDecision)(raw);
+        const safe = read.executionAction === "CONTINUE" && (0, decision_js_1.hasExplicitExecutionAction)(raw);
         return {
-          decision,
+          decision: raw.decision,
+          // Pass through — do not invent. Live POST /api/v1/agent/preflight emits this
+          // top-level; hiding it taught the wrong shape.
+          execution_action: raw.execution_action,
           omega_api: raw.omega_api ?? 0,
-          safe: decision === "ALLOW" || decision === "WARN",
+          safe,
           reflex_triggers: raw.reflex_triggers || [],
           affected_tools: raw.affected_tools || [],
           confidence_score: raw.confidence_score,
@@ -67877,9 +68080,13 @@ var require_client = __commonJS({
       }
       // ─── 3. explainDecision ────────────────────────────────────────────────
       /**
-       * Returns a human-readable explanation of why a decision was made.
+       * Human-readable explanation of a decision. **Advisory prose, not a gate.**
        *
-       * Computed client-side from the omega components and reflex triggers.
+       * Computed client-side — no HTTP. For control flow call `readDecision` on the
+       * response yourself. This method renders a summary from `execution_action`
+       * (via `readDecision`); `decision` is the governance label in the prose and
+       * never selects a branch. Unknown / absent action → "treat as STOP". Never
+       * reports a change as "safe to proceed".
        */
       async explainDecision(req) {
         const components = [];
@@ -67895,36 +68102,47 @@ var require_client = __commonJS({
           }
         }
         const triggers = req.reflex_triggers || [];
+        const read = (0, decision_js_1.readDecision)(advisoryReadInput(req));
         let summary = `Decision: ${req.decision} (\u03A9_API = ${req.omega_api}).`;
         if (triggers.length > 0) {
           summary += ` ${triggers.length} reflex rule(s) triggered.`;
         }
-        if (req.decision === "BLOCK") {
-          summary += " This change is blocked due to high risk.";
-        } else if (req.decision === "REQUIRE_APPROVAL") {
-          summary += " This change requires manual approval before merging.";
-        } else if (req.decision === "WARN") {
-          summary += " This change has warnings but can proceed.";
+        if (read.reason) {
+          summary += ` ${UNREADABLE_SUMMARY}`;
         } else {
-          summary += " This change is safe to proceed.";
+          summary += ` ${ACTION_SUMMARY[read.executionAction]}`;
         }
-        return { summary, components };
+        return {
+          summary,
+          components,
+          execution_action: read.executionAction,
+          reason: read.reason
+        };
       }
       // ─── 4. howToUnblock ───────────────────────────────────────────────────
       /**
-       * Returns actionable steps to resolve a BLOCK decision.
+       * Actionable steps to resolve a halted change. **Advisory prose, not a gate.**
        *
-       * Computed client-side from breaking changes and detected patterns.
+       * Computed client-side — no HTTP. For control flow call `readDecision`.
+       * "No unblock needed" is emitted **only** for a readable CONTINUE /
+       * CONTINUE_WITH_MONITORING. An unrecognised or absent action is treated as
+       * STOP and still yields steps — never "no unblock needed".
        */
       async howToUnblock(req) {
+        const read = (0, decision_js_1.readDecision)(advisoryReadInput(req));
         const actions = [];
         let step = 1;
-        if (req.decision !== "BLOCK") {
+        if (!read.reason && NO_UNBLOCK_ACTIONS.has(read.executionAction)) {
           actions.push({
             step: step++,
-            description: `Current decision is "${req.decision}" \u2014 no unblock needed.`
+            description: `Execution action is "${read.executionAction}" (decision: "${req.decision}") \u2014 no unblock needed.`
           });
-          return { actions };
+          return { actions, execution_action: read.executionAction, reason: read.reason };
+        }
+        if (read.reason) {
+          actions.push({ step: step++, description: UNREADABLE_UNBLOCK });
+        } else if (read.executionAction === "REQUEST_APPROVAL") {
+          actions.push({ step: step++, description: ACTION_SUMMARY.REQUEST_APPROVAL });
         }
         const bcs = req.breaking_changes || [];
         if (bcs.length > 0) {
@@ -67945,7 +68163,7 @@ var require_client = __commonJS({
           step: step++,
           description: "Request a manual override via POST /api/v1/ledger/:id/override if this is an emergency."
         });
-        return { actions };
+        return { actions, execution_action: read.executionAction, reason: read.reason };
       }
       // ─── 5. scoreMcp ──────────────────────────────────────────────────────
       /**
@@ -68067,6 +68285,25 @@ var require_client = __commonJS({
       }
     };
     exports2.CodeRifts = CodeRifts;
+    var ACTION_SUMMARY = {
+      CONTINUE: "Execution action: CONTINUE \u2014 this change may proceed.",
+      CONTINUE_WITH_MONITORING: "Execution action: CONTINUE_WITH_MONITORING \u2014 this change may proceed only with monitoring wired.",
+      REQUEST_APPROVAL: "Execution action: REQUEST_APPROVAL \u2014 manual approval is required before this change may proceed.",
+      STOP: "Execution action: STOP \u2014 this change must not proceed."
+    };
+    var UNREADABLE_SUMMARY = "Execution action is unrecognised or absent (UNREADABLE_DECISION) \u2014 treat as STOP; this change must not proceed.";
+    var UNREADABLE_UNBLOCK = "Execution action is unrecognised or absent (UNREADABLE_DECISION) \u2014 treat as STOP. Re-read a response that carries execution_action, and resolve the findings below before proceeding.";
+    var NO_UNBLOCK_ACTIONS = /* @__PURE__ */ new Set(["CONTINUE", "CONTINUE_WITH_MONITORING"]);
+    function advisoryReadInput(req) {
+      if (req.response !== void 0) {
+        if (!req.response || typeof req.response !== "object" || Array.isArray(req.response)) {
+          return req.response;
+        }
+        const { decision: _omit, ...rest } = req.response;
+        return rest;
+      }
+      return { execution_action: req.execution_action };
+    }
     function describeComponent(name, value) {
       const descriptions = {
         S_contract: "Contract severity score \u2014 measures how severe the breaking changes are",
@@ -68084,50 +68321,94 @@ var require_client = __commonJS({
   }
 });
 
-// node_modules/@coderifts/sdk/dist/cjs/decision.js
-var require_decision = __commonJS({
-  "node_modules/@coderifts/sdk/dist/cjs/decision.js"(exports2) {
+// node_modules/@coderifts/sdk/dist/cjs/policy.js
+var require_policy = __commonJS({
+  "node_modules/@coderifts/sdk/dist/cjs/policy.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.readDecision = readDecision;
-    var EXECUTION_ACTION = {
-      ALLOW: "CONTINUE",
-      WARN: "CONTINUE_WITH_MONITORING",
-      REQUIRE_APPROVAL: "REQUEST_APPROVAL",
-      BLOCK: "STOP"
-    };
-    function isExecutionAction(v) {
-      return v === "CONTINUE" || v === "CONTINUE_WITH_MONITORING" || v === "REQUEST_APPROVAL" || v === "STOP";
+    exports2.POLICY_ABSENT_WARN = exports2.CODERIFTS_POLICY = exports2.POLICY_MARKER = void 0;
+    exports2.policyPresenceOf = policyPresenceOf;
+    exports2.detectPolicyPresence = detectPolicyPresence;
+    exports2.withPolicy = withPolicy;
+    exports2.warnPolicyAbsentOnce = warnPolicyAbsentOnce;
+    exports2.observePolicyPresence = observePolicyPresence;
+    exports2.resetPolicyWarnForTests = resetPolicyWarnForTests;
+    exports2.POLICY_MARKER = "A receipt authorizes ONE operation: a merge receipt does not authorize a deploy.";
+    exports2.CODERIFTS_POLICY = 'Call `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".';
+    exports2.POLICY_ABSENT_WARN = "CodeRifts policy text not detected in the system prompt. The agent will still see the tools, but measured evidence shows operation-scope misuse is markedly more likely without it. See https://github.com/coderifts/agent-guard#policy-delivery.";
+    function textHasMarker(text) {
+      return text.includes(exports2.POLICY_MARKER);
     }
-    function readDecision(response) {
-      if (!response || typeof response !== "object") {
-        return { executionAction: "STOP", decision: null, reason: "UNREADABLE_DECISION" };
-      }
-      const r = response;
-      const env = r.decision_result;
-      if (env && typeof env === "object" && isExecutionAction(env.execution_action)) {
-        const receipt = env.receipt;
-        return {
-          executionAction: env.execution_action,
-          decision: typeof env.decision === "string" ? env.decision : null,
-          envelope: env,
-          receipt: receipt && typeof receipt === "object" ? receipt : void 0
-        };
+    function contentHasMarker(content) {
+      if (typeof content === "string")
+        return textHasMarker(content);
+      if (Array.isArray(content))
+        return content.some(contentHasMarker);
+      if (content && typeof content === "object") {
+        const o = content;
+        if (typeof o.text === "string" && textHasMarker(o.text))
+          return true;
+        if (typeof o.content === "string" && textHasMarker(o.content))
+          return true;
       }
-      if (isExecutionAction(r.execution_action)) {
-        return {
-          executionAction: r.execution_action,
-          decision: typeof r.decision === "string" ? r.decision : null
-        };
+      return false;
+    }
+    function policyPresenceOf(text) {
+      if (text == null)
+        return "unknown";
+      return textHasMarker(String(text)) ? "detected" : "absent";
+    }
+    function detectPolicyPresence(text) {
+      return policyPresenceOf(text);
+    }
+    function appendPolicyToString(existing) {
+      if (textHasMarker(existing))
+        return existing;
+      if (existing.trim() === "")
+        return exports2.CODERIFTS_POLICY;
+      return existing + "\n\n" + exports2.CODERIFTS_POLICY;
+    }
+    function withPolicy(input, opts) {
+      const inject = opts?.injectPolicy !== false;
+      if (typeof input === "string") {
+        if (!inject)
+          return input;
+        return appendPolicyToString(input);
       }
-      if (typeof r.decision === "string" && Object.prototype.hasOwnProperty.call(EXECUTION_ACTION, r.decision)) {
-        return { executionAction: EXECUTION_ACTION[r.decision], decision: r.decision };
+      const copy = input.map((m) => ({ ...m }));
+      if (!inject)
+        return copy;
+      if (copy.some((m) => contentHasMarker(m.content)))
+        return copy;
+      const sysIdx = copy.findIndex((m) => String(m.role).toLowerCase() === "system");
+      if (sysIdx >= 0) {
+        const sys = copy[sysIdx];
+        if (typeof sys.content === "string") {
+          copy[sysIdx] = { ...sys, content: appendPolicyToString(sys.content) };
+          return copy;
+        }
+        return [{ role: "system", content: exports2.CODERIFTS_POLICY }, ...copy];
       }
-      return {
-        executionAction: "STOP",
-        decision: typeof r.decision === "string" ? r.decision : null,
-        reason: "UNREADABLE_DECISION"
-      };
+      return [{ role: "system", content: exports2.CODERIFTS_POLICY }, ...copy];
+    }
+    var warnedThisProcess = false;
+    function defaultWarn(msg) {
+      console.warn(msg);
+    }
+    function warnPolicyAbsentOnce() {
+      if (warnedThisProcess)
+        return;
+      warnedThisProcess = true;
+      defaultWarn(exports2.POLICY_ABSENT_WARN);
+    }
+    function observePolicyPresence(text) {
+      const presence = policyPresenceOf(text);
+      if (presence === "absent")
+        warnPolicyAbsentOnce();
+      return presence;
+    }
+    function resetPolicyWarnForTests() {
+      warnedThisProcess = false;
     }
   }
 });
@@ -68589,16 +68870,268 @@ var require_execution_attestation = __commonJS({
   }
 });
 
+// node_modules/@coderifts/sdk/dist/cjs/monitoring-attestation.js
+var require_monitoring_attestation = __commonJS({
+  "node_modules/@coderifts/sdk/dist/cjs/monitoring-attestation.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.CLOCK_SKEW_LEEWAY_MS = exports2.MONITOR_ATTEST_ENVELOPE_TAG = exports2.MONITOR_ATTEST_SIGNING_PREFIX = exports2.MONITOR_ATTEST_VERSION = void 0;
+    exports2.monitorAttestSigningInput = monitorAttestSigningInput;
+    exports2.verifyMonitoringAttestation = verifyMonitoringAttestation;
+    var crypto_1 = require("crypto");
+    var leeway_js_1 = require_leeway();
+    Object.defineProperty(exports2, "CLOCK_SKEW_LEEWAY_MS", { enumerable: true, get: function() {
+      return leeway_js_1.CLOCK_SKEW_LEEWAY_MS;
+    } });
+    exports2.MONITOR_ATTEST_VERSION = "cr.monitor.attest.v1";
+    exports2.MONITOR_ATTEST_SIGNING_PREFIX = "crmonattest.v1";
+    exports2.MONITOR_ATTEST_ENVELOPE_TAG = "cr.monitor.attest.v1";
+    var REQUIRED_FIELDS = [
+      "kid",
+      "decision_id",
+      "receipt_digest",
+      "delivery_status",
+      "sink_kind",
+      "observed_at"
+    ];
+    var DELIVERY_STATUSES = ["delivered_acked", "sent_unacked", "not_delivered"];
+    var SINK_KINDS = ["callback", "http"];
+    var OPTIONAL_STRINGS = ["ack_digest"];
+    var ALLOWED_KEYS = /* @__PURE__ */ new Set(["v", ...REQUIRED_FIELDS, ...OPTIONAL_STRINGS, "attempt_count", "meta"]);
+    function scalar(v) {
+      return v == null ? "" : String(v);
+    }
+    function canonicalMeta(meta) {
+      const keys = Object.keys(meta).sort();
+      const o = {};
+      for (const k of keys)
+        o[k] = meta[k];
+      return JSON.stringify(o);
+    }
+    function metaOk(meta) {
+      if (meta == null)
+        return true;
+      if (typeof meta !== "object" || Array.isArray(meta))
+        return false;
+      const obj = meta;
+      const keys = Object.keys(obj);
+      if (keys.length > 8)
+        return false;
+      for (const k of keys) {
+        if (k.length === 0 || k.length > 64 || k.includes("|"))
+          return false;
+        const v = obj[k];
+        const t = typeof v;
+        if (t !== "string" && t !== "number" && t !== "boolean")
+          return false;
+        if (t === "string" && (v.length > 256 || v.includes("|")))
+          return false;
+      }
+      return true;
+    }
+    function monitorAttestSigningInput(body) {
+      const parts = [
+        exports2.MONITOR_ATTEST_SIGNING_PREFIX,
+        scalar(body.kid),
+        scalar(body.decision_id),
+        scalar(body.receipt_digest),
+        scalar(body.delivery_status),
+        body.ack_digest != null && String(body.ack_digest).length > 0 ? String(body.ack_digest) : "",
+        scalar(body.sink_kind),
+        scalar(body.observed_at),
+        body.attempt_count != null ? String(body.attempt_count) : ""
+      ];
+      if (body.meta && typeof body.meta === "object") {
+        parts.push(canonicalMeta(body.meta));
+      }
+      return parts.join("|");
+    }
+    function isIssueTimeWithinKeyWindow(ts, keyMeta) {
+      if (!keyMeta || keyMeta.status === "active")
+        return true;
+      if (keyMeta.status !== "retired")
+        return false;
+      if (typeof keyMeta.retired_at !== "string" || keyMeta.retired_at.length === 0)
+        return false;
+      if (typeof ts !== "string" || ts.length === 0)
+        return false;
+      const issueMs = Date.parse(ts);
+      if (!Number.isFinite(issueMs))
+        return false;
+      if (keyMeta.valid_from) {
+        const fromMs = Date.parse(keyMeta.valid_from);
+        if (Number.isFinite(fromMs) && issueMs < fromMs)
+          return false;
+      }
+      const retiredMs = Date.parse(keyMeta.retired_at);
+      if (!Number.isFinite(retiredMs))
+        return false;
+      if (issueMs >= retiredMs)
+        return false;
+      return true;
+    }
+    function resolveMonitoringKey(registry, kid) {
+      if (!registry || !Array.isArray(registry.keys) || !kid)
+        return null;
+      const matches = registry.keys.filter((k) => k && k.kid === kid && typeof k.public_key_pem === "string");
+      if (matches.length === 0)
+        return null;
+      const entry = matches.find((k) => k.status === "active") || matches[0];
+      try {
+        return {
+          publicKey: (0, crypto_1.createPublicKey)(entry.public_key_pem),
+          status: entry.status === "retired" ? "retired" : "active",
+          valid_from: entry.valid_from || null,
+          retired_at: entry.retired_at || null
+        };
+      } catch {
+        return null;
+      }
+    }
+    function verifyMonitoringAttestation(token, opts) {
+      const fail = (status, reason, payload2) => ({ valid: false, status, reason, payload: payload2 });
+      if (typeof token !== "string" || token.length === 0) {
+        return fail("MON_ATTEST_MALFORMED", "malformed_structure");
+      }
+      const segments = token.split("|");
+      if (segments.length !== 4 || segments.some((s) => !s)) {
+        return fail("MON_ATTEST_MALFORMED", "malformed_structure");
+      }
+      if (segments[0] !== exports2.MONITOR_ATTEST_ENVELOPE_TAG) {
+        return fail("MON_ATTEST_MALFORMED", "unsupported_version");
+      }
+      let payload;
+      try {
+        payload = JSON.parse(Buffer.from(segments[2], "base64url").toString("utf8"));
+      } catch {
+        return fail("MON_ATTEST_MALFORMED", "bad_json");
+      }
+      if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+        return fail("MON_ATTEST_MALFORMED", "bad_json");
+      }
+      if (payload.v !== exports2.MONITOR_ATTEST_VERSION) {
+        return fail("MON_ATTEST_MALFORMED", "unsupported_version", payload);
+      }
+      for (const k of REQUIRED_FIELDS) {
+        if (typeof payload[k] !== "string" || !payload[k].length) {
+          return fail("MON_ATTEST_MALFORMED", "missing_field", payload);
+        }
+      }
+      if (!DELIVERY_STATUSES.includes(payload.delivery_status)) {
+        return fail("MON_ATTEST_MALFORMED", "bad_delivery_status", payload);
+      }
+      if (!SINK_KINDS.includes(payload.sink_kind)) {
+        return fail("MON_ATTEST_MALFORMED", "bad_sink_kind", payload);
+      }
+      for (const k of OPTIONAL_STRINGS) {
+        if (payload[k] != null && typeof payload[k] !== "string") {
+          return fail("MON_ATTEST_MALFORMED", "bad_optional", payload);
+        }
+      }
+      if (payload.attempt_count != null && typeof payload.attempt_count !== "number") {
+        return fail("MON_ATTEST_MALFORMED", "bad_attempt_count", payload);
+      }
+      if (payload.kid !== segments[1]) {
+        return fail("MON_ATTEST_MALFORMED", "kid_mismatch", payload);
+      }
+      for (const k of Object.keys(payload)) {
+        if (!ALLOWED_KEYS.has(k))
+          return fail("MON_ATTEST_MALFORMED", "unknown_field", payload);
+      }
+      if (!metaOk(payload.meta))
+        return fail("MON_ATTEST_MALFORMED", "meta_bounds", payload);
+      if (typeof payload.ack_digest === "string" && payload.ack_digest.length > 0 && !payload.ack_digest.startsWith("sha256:")) {
+        return fail("MON_ATTEST_MALFORMED", "bad_ack_digest", payload);
+      }
+      if (typeof payload.receipt_digest === "string" && !payload.receipt_digest.startsWith("sha256:")) {
+        return fail("MON_ATTEST_MALFORMED", "bad_receipt_digest", payload);
+      }
+      for (const k of [...REQUIRED_FIELDS, ...OPTIONAL_STRINGS]) {
+        if (typeof payload[k] === "string" && payload[k].includes("|")) {
+          return fail("MON_ATTEST_INVALID_SIGNATURE", "delimiter_in_field", payload);
+        }
+      }
+      const resolved = resolveMonitoringKey(opts.registry, String(payload.kid));
+      if (!resolved)
+        return fail("MON_ATTEST_UNKNOWN_KEY", "unknown_kid", payload);
+      let sigOk = false;
+      try {
+        sigOk = (0, crypto_1.verify)(null, Buffer.from(monitorAttestSigningInput(payload), "utf8"), resolved.publicKey, Buffer.from(segments[3], "base64url"));
+      } catch {
+        return fail("MON_ATTEST_INVALID_SIGNATURE", "signature_error", payload);
+      }
+      if (!sigOk)
+        return fail("MON_ATTEST_INVALID_SIGNATURE", "signature_mismatch", payload);
+      const now = Number.isFinite(opts.now) ? opts.now : Date.now();
+      const observedMs = Date.parse(String(payload.observed_at));
+      if (!Number.isFinite(observedMs))
+        return fail("MON_ATTEST_MALFORMED", "bad_timestamp", payload);
+      if ((0, leeway_js_1.isIssuedInFuture)(observedMs, now, opts.intended)) {
+        return fail("MON_ATTEST_MALFORMED", "observed_at_in_future", payload);
+      }
+      let retiredHistorical = false;
+      if (resolved.status === "retired") {
+        if (!isIssueTimeWithinKeyWindow(String(payload.observed_at), resolved)) {
+          return fail("MON_ATTEST_UNKNOWN_KEY", "retired_key_outside_window", payload);
+        }
+        retiredHistorical = true;
+      }
+      const intended = opts.intended;
+      const wantsCross = !!(intended && (intended.decision_id || intended.receipt_digest));
+      if (wantsCross && intended) {
+        if (intended.decision_id && intended.decision_id !== payload.decision_id) {
+          return fail("MON_ATTEST_UNBOUND", "decision_id_mismatch", payload);
+        }
+        if (intended.receipt_digest && intended.receipt_digest !== payload.receipt_digest) {
+          return fail("MON_ATTEST_UNBOUND", "receipt_digest_mismatch", payload);
+        }
+      }
+      if (retiredHistorical) {
+        return { valid: true, status: "MON_ATTEST_RETIRED_KEY_VALID_AT_ISSUE", reason: null, payload };
+      }
+      return { valid: true, status: "MON_ATTEST_VALID", reason: null, payload };
+    }
+  }
+});
+
 // node_modules/@coderifts/sdk/dist/cjs/index.js
 var require_cjs3 = __commonJS({
   "node_modules/@coderifts/sdk/dist/cjs/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.ATTEST_ENVELOPE_TAG = exports2.ATTEST_SIGNING_PREFIX = exports2.ATTEST_VERSION = exports2.attestSigningInput = exports2.verifyExecutionAttestation = exports2.GRANT_SIGNING_PREFIX = exports2.GRANT_VERSION = exports2.receiptDigest = exports2.afterPayloadCanonical = exports2.computeScopeHash = exports2.verifyExecutionGrant = exports2.isIssuedInFuture = exports2.isReceiptExpired = exports2.declaresDestructiveProduction = exports2.expiryLeewayMs = exports2.CLOCK_SKEW_LEEWAY_MS = exports2.readDecision = exports2.AuthError = exports2.RateLimitError = exports2.TimeoutError = exports2.ApiError = exports2.CodeRiftsError = exports2.CodeRifts = void 0;
+    exports2.MONITOR_ATTEST_ENVELOPE_TAG = exports2.MONITOR_ATTEST_SIGNING_PREFIX = exports2.MONITOR_ATTEST_VERSION = exports2.monitorAttestSigningInput = exports2.verifyMonitoringAttestation = exports2.ATTEST_ENVELOPE_TAG = exports2.ATTEST_SIGNING_PREFIX = exports2.ATTEST_VERSION = exports2.attestSigningInput = exports2.verifyExecutionAttestation = exports2.GRANT_SIGNING_PREFIX = exports2.GRANT_VERSION = exports2.receiptDigest = exports2.afterPayloadCanonical = exports2.computeScopeHash = exports2.verifyExecutionGrant = exports2.isIssuedInFuture = exports2.isReceiptExpired = exports2.declaresDestructiveProduction = exports2.expiryLeewayMs = exports2.CLOCK_SKEW_LEEWAY_MS = exports2.readDecision = exports2.AuthError = exports2.RateLimitError = exports2.TimeoutError = exports2.ApiError = exports2.CodeRiftsError = exports2.resetPolicyWarnForTests = exports2.warnPolicyAbsentOnce = exports2.observePolicyPresence = exports2.detectPolicyPresence = exports2.policyPresenceOf = exports2.withPolicy = exports2.POLICY_ABSENT_WARN = exports2.POLICY_MARKER = exports2.CODERIFTS_POLICY = exports2.CodeRifts = void 0;
     var client_js_1 = require_client();
     Object.defineProperty(exports2, "CodeRifts", { enumerable: true, get: function() {
       return client_js_1.CodeRifts;
     } });
+    var policy_js_1 = require_policy();
+    Object.defineProperty(exports2, "CODERIFTS_POLICY", { enumerable: true, get: function() {
+      return policy_js_1.CODERIFTS_POLICY;
+    } });
+    Object.defineProperty(exports2, "POLICY_MARKER", { enumerable: true, get: function() {
+      return policy_js_1.POLICY_MARKER;
+    } });
+    Object.defineProperty(exports2, "POLICY_ABSENT_WARN", { enumerable: true, get: function() {
+      return policy_js_1.POLICY_ABSENT_WARN;
+    } });
+    Object.defineProperty(exports2, "withPolicy", { enumerable: true, get: function() {
+      return policy_js_1.withPolicy;
+    } });
+    Object.defineProperty(exports2, "policyPresenceOf", { enumerable: true, get: function() {
+      return policy_js_1.policyPresenceOf;
+    } });
+    Object.defineProperty(exports2, "detectPolicyPresence", { enumerable: true, get: function() {
+      return policy_js_1.detectPolicyPresence;
+    } });
+    Object.defineProperty(exports2, "observePolicyPresence", { enumerable: true, get: function() {
+      return policy_js_1.observePolicyPresence;
+    } });
+    Object.defineProperty(exports2, "warnPolicyAbsentOnce", { enumerable: true, get: function() {
+      return policy_js_1.warnPolicyAbsentOnce;
+    } });
+    Object.defineProperty(exports2, "resetPolicyWarnForTests", { enumerable: true, get: function() {
+      return policy_js_1.resetPolicyWarnForTests;
+    } });
     var errors_js_1 = require_errors5();
     Object.defineProperty(exports2, "CodeRiftsError", { enumerable: true, get: function() {
       return errors_js_1.CodeRiftsError;
@@ -68670,6 +69203,22 @@ var require_cjs3 = __commonJS({
     Object.defineProperty(exports2, "ATTEST_ENVELOPE_TAG", { enumerable: true, get: function() {
       return execution_attestation_js_1.ATTEST_ENVELOPE_TAG;
     } });
+    var monitoring_attestation_js_1 = require_monitoring_attestation();
+    Object.defineProperty(exports2, "verifyMonitoringAttestation", { enumerable: true, get: function() {
+      return monitoring_attestation_js_1.verifyMonitoringAttestation;
+    } });
+    Object.defineProperty(exports2, "monitorAttestSigningInput", { enumerable: true, get: function() {
+      return monitoring_attestation_js_1.monitorAttestSigningInput;
+    } });
+    Object.defineProperty(exports2, "MONITOR_ATTEST_VERSION", { enumerable: true, get: function() {
+      return monitoring_attestation_js_1.MONITOR_ATTEST_VERSION;
+    } });
+    Object.defineProperty(exports2, "MONITOR_ATTEST_SIGNING_PREFIX", { enumerable: true, get: function() {
+      return monitoring_attestation_js_1.MONITOR_ATTEST_SIGNING_PREFIX;
+    } });
+    Object.defineProperty(exports2, "MONITOR_ATTEST_ENVELOPE_TAG", { enumerable: true, get: function() {
+      return monitoring_attestation_js_1.MONITOR_ATTEST_ENVELOPE_TAG;
+    } });
   }
 });
 
@@ -68678,7 +69227,8 @@ var require_cas_attestation = __commonJS({
   "node_modules/@coderifts/agent-guard/dist/cjs/cas-attestation.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.CAS_ATTESTATION_SPEC = void 0;
+    exports2.COMMIT_EVIDENCE_MISSING = exports2.CAS_ATTESTATION_SPEC = void 0;
+    exports2.strictCommitObservation = strictCommitObservation;
     exports2.extractExecutorAttestationToken = extractExecutorAttestationToken;
     exports2.evaluateCasEvidence = evaluateCasEvidence;
     exports2.isGuardExecutionProof = isGuardExecutionProof;
@@ -68695,6 +69245,32 @@ var require_cas_attestation = __commonJS({
       does_not_claim_host_cannot_bypass: true,
       does_not_claim_governance_redecision: true
     });
+    exports2.COMMIT_EVIDENCE_MISSING = "commit_evidence_missing";
+    function bindingIntendedSupplied(outcome, opts) {
+      const from = intendedFromOutcome(outcome);
+      if (opts.grant && String(opts.grant).length > 0)
+        return true;
+      if (from.grant && String(from.grant).length > 0)
+        return true;
+      if (opts.receipt_digest && String(opts.receipt_digest).length > 0)
+        return true;
+      if (from.receipt_digest && String(from.receipt_digest).length > 0)
+        return true;
+      const gf = opts.grant_fields;
+      if (gf && (gf.jti || gf.scope_hash || gf.receipt_digest))
+        return true;
+      return false;
+    }
+    function strictCommitObservation(outcome, evidence, opts = {}) {
+      const crossChecked = evidence != null && evidence.class === "executor_attested" && bindingIntendedSupplied(outcome, opts);
+      if (crossChecked) {
+        return { commit_label: "authorized_and_committed" };
+      }
+      return {
+        commit_label: "authorized_not_committed",
+        commit_evidence_reason: exports2.COMMIT_EVIDENCE_MISSING
+      };
+    }
     var ABSENT_EVIDENCE = Object.freeze({
       class: "absent",
       attest_status: null,
@@ -68750,6 +69326,7 @@ var require_cas_attestation = __commonJS({
       const fromOutcome = intendedFromOutcome(outcome);
       const grant = opts.grant || fromOutcome.grant || null;
       const receipt_digest = opts.receipt_digest || fromOutcome.receipt_digest || null;
+      const grant_fields = opts.grant_fields || null;
       if (!registry || !Array.isArray(registry.keys)) {
         return hostClaimed(null, null, null);
       }
@@ -68761,6 +69338,8 @@ var require_cas_attestation = __commonJS({
         intended.grant = grant;
       if (receipt_digest)
         intended.receipt_digest = receipt_digest;
+      if (grant_fields)
+        intended.grant_fields = grant_fields;
       const wantsIntended = Object.keys(intended).length > 0;
       let verified;
       try {
@@ -68848,7 +69427,12 @@ var require_cas_attestation = __commonJS({
       const write_ran = cas.write_ran === true;
       const stale_during_commit = cas.status === "committed_stale_detected";
       const refused = cas.status === "refused";
-      const authorized_and_committed = receipt_verified && cas.status === "committed";
+      const cas_evidence = evaluateCasEvidence(outcome, opts);
+      let authorized_and_committed = receipt_verified && cas.status === "committed";
+      if (opts.profile === "ENFORCING_STRICT") {
+        const obs = strictCommitObservation(outcome, cas_evidence, opts);
+        authorized_and_committed = authorized_and_committed && obs.commit_label === "authorized_and_committed";
+      }
       const attestation = {
         attestation_spec: exports2.CAS_ATTESTATION_SPEC,
         references: Object.freeze({
@@ -68865,7 +69449,7 @@ var require_cas_attestation = __commonJS({
           stale_during_commit,
           refused
         }),
-        cas_evidence: evaluateCasEvidence(outcome, opts),
+        cas_evidence,
         limits: LIMITS
       };
       return freezeAttestation(attestation);
@@ -69113,7 +69697,15 @@ var require_monitoring_delivery = __commonJS({
         reason: "sink_unrecognised"
       };
     }
-    function formatMonitoringDeliveryLine(d) {
+    function formatMonitoringDeliveryLine(d, attestedKid) {
+      if (attestedKid) {
+        if (d.status === "sent_unacked")
+          return `monitoring: sent, not acked (attested kid ${attestedKid})`;
+        if (d.status === "not_delivered") {
+          return d.reason ? `monitoring: NOT delivered (${d.reason}; attested kid ${attestedKid})` : `monitoring: NOT delivered (attested kid ${attestedKid})`;
+        }
+        return `monitoring: delivered (attested kid ${attestedKid})`;
+      }
       if (d.status === "sent_unacked")
         return "monitoring: sent, not acked";
       if (d.status === "not_delivered") {
@@ -69139,6 +69731,267 @@ var require_monitoring_delivery = __commonJS({
   }
 });
 
+// node_modules/@coderifts/agent-guard/dist/cjs/monitoring-attestation.js
+var require_monitoring_attestation2 = __commonJS({
+  "node_modules/@coderifts/agent-guard/dist/cjs/monitoring-attestation.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.MONITOR_ATTEST_ENVELOPE_TAG = exports2.MONITOR_ATTEST_SIGNING_PREFIX = exports2.MONITOR_ATTEST_VERSION = void 0;
+    exports2.monitorAttestSigningInput = monitorAttestSigningInput;
+    exports2.receiptDigestOfToken = receiptDigestOfToken;
+    exports2.tryIssueMonitoringAttestation = tryIssueMonitoringAttestation;
+    exports2.kidFromMonitoringAttestation = kidFromMonitoringAttestation;
+    var node_crypto_1 = require("node:crypto");
+    exports2.MONITOR_ATTEST_VERSION = "cr.monitor.attest.v1";
+    exports2.MONITOR_ATTEST_SIGNING_PREFIX = "crmonattest.v1";
+    exports2.MONITOR_ATTEST_ENVELOPE_TAG = "cr.monitor.attest.v1";
+    var DELIVERY_STATUSES = ["delivered_acked", "sent_unacked", "not_delivered"];
+    var SINK_KINDS = ["callback", "http"];
+    function scalar(v) {
+      return v == null ? "" : String(v);
+    }
+    function monitorAttestSigningInput(body) {
+      const parts = [
+        exports2.MONITOR_ATTEST_SIGNING_PREFIX,
+        scalar(body.kid),
+        scalar(body.decision_id),
+        scalar(body.receipt_digest),
+        scalar(body.delivery_status),
+        body.ack_digest != null && String(body.ack_digest).length > 0 ? String(body.ack_digest) : "",
+        scalar(body.sink_kind),
+        scalar(body.observed_at),
+        body.attempt_count != null ? String(body.attempt_count) : ""
+      ];
+      return parts.join("|");
+    }
+    function receiptDigestOfToken(token) {
+      return "sha256:" + (0, node_crypto_1.createHash)("sha256").update(String(token), "utf8").digest("hex");
+    }
+    function b64url(buf) {
+      return buf.toString("base64url");
+    }
+    function envelopeReceiptToken(envelope) {
+      if (!envelope || typeof envelope !== "object")
+        return null;
+      const rec = envelope.receipt;
+      if (rec && typeof rec.token === "string" && rec.token.length > 0)
+        return rec.token;
+      return null;
+    }
+    async function tryIssueMonitoringAttestation(args) {
+      const cfg = args.config;
+      if (!cfg || typeof cfg.kid !== "string" || !cfg.kid || typeof cfg.signer !== "function") {
+        return void 0;
+      }
+      const delivery = args.delivery;
+      if (!delivery || typeof delivery.status !== "string")
+        return void 0;
+      if (!DELIVERY_STATUSES.includes(delivery.status))
+        return void 0;
+      const decision_id = args.envelope && typeof args.envelope.decision_id === "string" ? args.envelope.decision_id : "";
+      const token = envelopeReceiptToken(args.envelope);
+      if (!decision_id || !token)
+        return void 0;
+      const rawKind = delivery.evidence && delivery.evidence.sink_kind;
+      const sink_kind = SINK_KINDS.includes(String(rawKind)) ? rawKind : "callback";
+      const observed_at = delivery.evidence && delivery.evidence.at || args.now || (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z");
+      const ack_digest = delivery.status === "delivered_acked" && delivery.evidence && typeof delivery.evidence.ack_hash === "string" && delivery.evidence.ack_hash.startsWith("sha256:") ? delivery.evidence.ack_hash : void 0;
+      const body = {
+        v: exports2.MONITOR_ATTEST_VERSION,
+        kid: cfg.kid,
+        decision_id,
+        receipt_digest: receiptDigestOfToken(token),
+        delivery_status: delivery.status,
+        sink_kind,
+        observed_at
+      };
+      if (ack_digest)
+        body.ack_digest = ack_digest;
+      const input = Buffer.from(monitorAttestSigningInput(body), "utf8");
+      let sig;
+      try {
+        sig = await cfg.signer(input);
+      } catch {
+        return void 0;
+      }
+      if (sig == null)
+        return void 0;
+      const sigBuf = Buffer.isBuffer(sig) ? sig : Buffer.from(sig);
+      if (sigBuf.length === 0)
+        return void 0;
+      return [
+        exports2.MONITOR_ATTEST_ENVELOPE_TAG,
+        cfg.kid,
+        b64url(Buffer.from(JSON.stringify(body), "utf8")),
+        b64url(sigBuf)
+      ].join("|");
+    }
+    function kidFromMonitoringAttestation(token) {
+      if (typeof token !== "string" || token.length === 0)
+        return null;
+      const parts = token.split("|");
+      if (parts.length !== 4 || parts[0] !== exports2.MONITOR_ATTEST_ENVELOPE_TAG)
+        return null;
+      return parts[1] || null;
+    }
+  }
+});
+
+// node_modules/@coderifts/agent-guard/dist/cjs/policy.js
+var require_policy2 = __commonJS({
+  "node_modules/@coderifts/agent-guard/dist/cjs/policy.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.POLICY_ABSENT_WARN = exports2.CODERIFTS_POLICY = exports2.POLICY_MARKER = void 0;
+    exports2.policyPresenceOf = policyPresenceOf;
+    exports2.detectPolicyPresence = detectPolicyPresence;
+    exports2.withPolicy = withPolicy;
+    exports2.warnPolicyAbsentOnce = warnPolicyAbsentOnce;
+    exports2.observePolicyPresence = observePolicyPresence;
+    exports2.resetPolicyWarnForTests = resetPolicyWarnForTests;
+    exports2.POLICY_MARKER = "A receipt authorizes ONE operation: a merge receipt does not authorize a deploy.";
+    exports2.CODERIFTS_POLICY = 'Call `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".';
+    exports2.POLICY_ABSENT_WARN = "CodeRifts policy text not detected in the system prompt. The agent will still see the tools, but measured evidence shows operation-scope misuse is markedly more likely without it. See https://github.com/coderifts/agent-guard#policy-delivery.";
+    function textHasMarker(text) {
+      return text.includes(exports2.POLICY_MARKER);
+    }
+    function contentHasMarker(content) {
+      if (typeof content === "string")
+        return textHasMarker(content);
+      if (Array.isArray(content))
+        return content.some(contentHasMarker);
+      if (content && typeof content === "object") {
+        const o = content;
+        if (typeof o.text === "string" && textHasMarker(o.text))
+          return true;
+        if (typeof o.content === "string" && textHasMarker(o.content))
+          return true;
+      }
+      return false;
+    }
+    function policyPresenceOf(text) {
+      if (text == null)
+        return "unknown";
+      return textHasMarker(String(text)) ? "detected" : "absent";
+    }
+    function detectPolicyPresence(text) {
+      return policyPresenceOf(text);
+    }
+    function appendPolicyToString(existing) {
+      if (textHasMarker(existing))
+        return existing;
+      if (existing.trim() === "")
+        return exports2.CODERIFTS_POLICY;
+      return existing + "\n\n" + exports2.CODERIFTS_POLICY;
+    }
+    function withPolicy(input, opts) {
+      const inject = opts?.injectPolicy !== false;
+      if (typeof input === "string") {
+        if (!inject)
+          return input;
+        return appendPolicyToString(input);
+      }
+      const copy = input.map((m) => ({ ...m }));
+      if (!inject)
+        return copy;
+      if (copy.some((m) => contentHasMarker(m.content)))
+        return copy;
+      const sysIdx = copy.findIndex((m) => String(m.role).toLowerCase() === "system");
+      if (sysIdx >= 0) {
+        const sys = copy[sysIdx];
+        if (typeof sys.content === "string") {
+          copy[sysIdx] = { ...sys, content: appendPolicyToString(sys.content) };
+          return copy;
+        }
+        return [{ role: "system", content: exports2.CODERIFTS_POLICY }, ...copy];
+      }
+      return [{ role: "system", content: exports2.CODERIFTS_POLICY }, ...copy];
+    }
+    var warnedThisProcess = false;
+    function defaultWarn(msg) {
+      console.warn(msg);
+    }
+    function warnPolicyAbsentOnce() {
+      if (warnedThisProcess)
+        return;
+      warnedThisProcess = true;
+      defaultWarn(exports2.POLICY_ABSENT_WARN);
+    }
+    function observePolicyPresence(text) {
+      const presence = policyPresenceOf(text);
+      if (presence === "absent")
+        warnPolicyAbsentOnce();
+      return presence;
+    }
+    function resetPolicyWarnForTests() {
+      warnedThisProcess = false;
+    }
+  }
+});
+
+// node_modules/@coderifts/agent-guard/dist/cjs/execution-grant.js
+var require_execution_grant2 = __commonJS({
+  "node_modules/@coderifts/agent-guard/dist/cjs/execution-grant.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.isExecutionGrantEnabled = isExecutionGrantEnabled;
+    exports2.readExecutionGrantToken = readExecutionGrantToken;
+    exports2.firstArtifactId = firstArtifactId;
+    exports2.isSignerUnavailableError = isSignerUnavailableError;
+    exports2.resolveStateNonceForCall = resolveStateNonceForCall;
+    function isExecutionGrantEnabled(config) {
+      return !!(config && config.executionGrant && config.executionGrant.enabled === true);
+    }
+    function readExecutionGrantToken(response) {
+      if (!response || typeof response !== "object")
+        return null;
+      const g = response.execution_grant;
+      return typeof g === "string" && g.length > 0 ? g : null;
+    }
+    function firstArtifactId(artifacts) {
+      if (!Array.isArray(artifacts))
+        return null;
+      for (const a of artifacts) {
+        if (a && typeof a === "object" && typeof a.id === "string") {
+          const id = String(a.id).trim();
+          if (id)
+            return id;
+        }
+      }
+      return null;
+    }
+    function isSignerUnavailableError(err) {
+      if (!err || typeof err !== "object")
+        return false;
+      const e = err;
+      if (e.code === "SIGNER_UNAVAILABLE")
+        return true;
+      if (e.body && e.body.code === "SIGNER_UNAVAILABLE")
+        return true;
+      return false;
+    }
+    async function resolveStateNonceForCall(config, call, artifacts) {
+      const resolver = config.executionGrant && config.executionGrant.resolveStateNonce;
+      if (typeof resolver !== "function")
+        return { ok: true };
+      try {
+        const raw = await resolver({
+          artifactId: firstArtifactId(artifacts) || firstArtifactId(call.artifacts),
+          toolName: call.toolName,
+          args: call.arguments
+        });
+        if (raw == null || raw === "")
+          return { ok: true };
+        if (typeof raw !== "string")
+          return { ok: false };
+        return { ok: true, nonce: raw };
+      } catch {
+        return { ok: false };
+      }
+    }
+  }
+});
+
 // node_modules/@coderifts/agent-guard/dist/cjs/guard.js
 var require_guard = __commonJS({
   "node_modules/@coderifts/agent-guard/dist/cjs/guard.js"(exports2) {
@@ -69152,11 +70005,15 @@ var require_guard = __commonJS({
     var enforcement_gate_js_1 = require_enforcement_gate();
     var execution_time_fingerprint_js_1 = require_execution_time_fingerprint();
     var execution_proof_js_1 = require_execution_proof();
+    var coverage_observed_js_1 = require_coverage_observed();
     var freshness_js_1 = require_freshness();
     var conditional_write_js_1 = require_conditional_write();
     var commit_observation_js_1 = require_commit_observation();
     var cas_attestation_js_1 = require_cas_attestation();
     var monitoring_delivery_js_1 = require_monitoring_delivery();
+    var monitoring_attestation_js_1 = require_monitoring_attestation2();
+    var policy_js_1 = require_policy2();
+    var execution_grant_js_1 = require_execution_grant2();
     var breakers = /* @__PURE__ */ new WeakMap();
     var nowMs = () => Date.now();
     var iso = () => (/* @__PURE__ */ new Date()).toISOString();
@@ -69208,7 +70065,10 @@ var require_guard = __commonJS({
       s.fails = s.fails.filter((x) => t - x < win);
       return s.fails.length >= (config.maxUnavailablePerWindow ?? 3);
     }
-    function classifyError(err, config) {
+    function requestAsksForGrant(request) {
+      return !!(request && typeof request === "object" && request.include_execution_grant === true);
+    }
+    function classifyError(err, config, grantRequested = false) {
       const e = err;
       const name = e?.name;
       const status = e?.status ?? e?.body?.status;
@@ -69222,6 +70082,9 @@ var require_guard = __commonJS({
         return { cause: "REQUEST_REJECTED", integrity: true };
       if (status === 400 || status === 401 || status === 409)
         return { cause: "REQUEST_REJECTED", integrity: true };
+      if (grantRequested && ((0, execution_grant_js_1.isSignerUnavailableError)(err) || status === 503)) {
+        return { cause: "SIGNER_UNAVAILABLE", integrity: true };
+      }
       if (typeof status === "number" && status >= 500)
         return { cause: "SERVER_ERROR", integrity: false };
       if (name === "TypeError" || /fetch failed|network|ENOTFOUND|ECONNREFUSED|EAI_AGAIN/i.test(String(e?.message)))
@@ -69256,7 +70119,7 @@ var require_guard = __commonJS({
           const response = await withTimeout(config.client.authorizeChangeSet(request), Math.min(timeoutMs, remaining));
           return { ok: true, response };
         } catch (err) {
-          last = classifyError(err, config);
+          last = classifyError(err, config, requestAsksForGrant(request));
           if (last.integrity)
             return { ok: false, ...last };
         }
@@ -69282,52 +70145,73 @@ var require_guard = __commonJS({
         return { verified: null, cause: "RECEIPT_UNVERIFIED" };
       }
     }
-    async function runEnforced(config, factory, approved, redacted, freshness, conditional_write, monitoring_delivery) {
+    async function runEnforced(config, factory, approved, redacted, freshness, conditional_write, monitoring_delivery, monitoring_attestation, grantCtx, grantObs) {
       emit(config, { type: "execution_started", at: iso(), action: approved.action, decisionId: approved.envelope.decision_id });
       try {
-        const result = await factory(approved.envelope, redacted);
+        const result = grantCtx ? await factory(approved.envelope, redacted, grantCtx) : await factory(approved.envelope, redacted);
         const base = { executionAttempted: true, executed: true, enforced: true, result, verdict: approved, preflighted: true };
-        return finishExecuted(config, base, freshness, conditional_write, redacted, result, monitoring_delivery);
+        return finishExecuted(config, base, freshness, conditional_write, redacted, result, monitoring_delivery, monitoring_attestation, grantObs);
       } catch (error) {
         emit(config, { type: "factory_error", at: iso(), action: approved.action });
         const base = { executionAttempted: true, executed: false, enforced: true, error, verdict: approved, preflighted: true };
-        return finishExecuted(config, base, freshness, conditional_write, redacted, void 0, monitoring_delivery);
+        return finishExecuted(config, base, freshness, conditional_write, redacted, void 0, monitoring_delivery, monitoring_attestation, grantObs);
       }
     }
-    async function runUnenforced(config, factory, envelope, verdict, preflighted, redacted, freshness, conditional_write, monitoring_delivery) {
+    async function runUnenforced(config, factory, envelope, verdict, preflighted, redacted, freshness, conditional_write, monitoring_delivery, monitoring_attestation, grantCtx, grantObs) {
       emit(config, { type: "execution_started", at: iso() });
       try {
-        const result = await factory(envelope, redacted);
+        const result = grantCtx ? await factory(envelope, redacted, grantCtx) : await factory(envelope, redacted);
         const base = { executionAttempted: true, executed: true, enforced: false, result, verdict, preflighted };
-        return finishExecuted(config, base, freshness, conditional_write, redacted, result, monitoring_delivery);
+        return finishExecuted(config, base, freshness, conditional_write, redacted, result, monitoring_delivery, monitoring_attestation, grantObs);
       } catch (error) {
         emit(config, { type: "factory_error", at: iso() });
         const base = { executionAttempted: true, executed: false, enforced: false, error, verdict, preflighted };
-        return finishExecuted(config, base, freshness, conditional_write, redacted, void 0, monitoring_delivery);
+        return finishExecuted(config, base, freshness, conditional_write, redacted, void 0, monitoring_delivery, monitoring_attestation, grantObs);
       }
     }
-    function blocked(verdict, preflighted, freshness, conditional_write, monitoring_delivery) {
+    function attachPolicyPresence(outcome, config) {
+      if (config.systemPrompt == null)
+        return outcome;
+      const policy_presence = (0, policy_js_1.observePolicyPresence)(config.systemPrompt);
+      return { ...outcome, policy_presence };
+    }
+    function coverageSnap(config) {
+      if (!config.coverageObserver)
+        return {};
+      return { coverageObserved: (0, coverage_observed_js_1.freezeCoverageObserved)(config.coverageObserver.snapshot()) };
+    }
+    function coverageOutcomeFieldsFrom(s) {
+      return s.coverageObserved ? { coverage_observed: s.coverageObserved } : {};
+    }
+    function blocked(config, verdict, preflighted, freshness, conditional_write, monitoring_delivery, monitoring_attestation, grantObs) {
       const commit_observation = {
         status: "not_observed",
         observed_at: iso(),
         host_attestation: "absent"
       };
       const base = { executionAttempted: false, executed: false, enforced: false, verdict, preflighted };
-      return {
+      const cov = coverageSnap(config);
+      const out = {
         ...base,
         proof: (0, execution_proof_js_1.buildExecutionProof)({
           ...base,
           conditionalWriteBasis: conditional_write,
           commitObservation: commit_observation,
-          monitoringDelivery: monitoring_delivery
+          monitoringDelivery: monitoring_delivery,
+          ...monitoring_attestation ? { monitoringAttestation: monitoring_attestation } : {},
+          ...cov
         }),
         freshness,
         conditional_write,
         commit_observation,
-        ...monitoring_delivery ? { monitoring_delivery } : {}
+        ...monitoring_delivery ? { monitoring_delivery } : {},
+        ...monitoring_attestation ? { monitoring_attestation } : {},
+        ...coverageOutcomeFieldsFrom(cov),
+        ...grantObs ? { execution_grant: grantObs } : {}
       };
+      return attachPolicyPresence(out, config);
     }
-    async function finishExecuted(config, base, freshness, conditional_write, redacted, result, monitoring_delivery) {
+    async function finishExecuted(config, base, freshness, conditional_write, redacted, result, monitoring_delivery, monitoring_attestation, grantObs) {
       const enabled = config.requireCommitObservation !== false;
       const commit_observation = await (0, commit_observation_js_1.observeCommit)({
         enabled,
@@ -69355,33 +70239,49 @@ var require_guard = __commonJS({
           token: commit_observation.token
         });
       }
-      const cas_evidence = result !== void 0 ? (0, cas_attestation_js_1.evaluateCasEvidence)(result, {
-        registry: config.executorAttestation && config.executorAttestation.registry
-      }) : void 0;
+      const casOpts = {
+        registry: config.executorAttestation && config.executorAttestation.registry,
+        ...config.profile === "ENFORCING_STRICT" ? { profile: "ENFORCING_STRICT" } : {}
+      };
+      const cas_evidence = result !== void 0 ? (0, cas_attestation_js_1.evaluateCasEvidence)(result, casOpts) : void 0;
+      const strictObs = config.profile === "ENFORCING_STRICT" ? (0, cas_attestation_js_1.strictCommitObservation)(result, cas_evidence, casOpts) : null;
+      const cov = coverageSnap(config);
       const proof = (0, execution_proof_js_1.buildExecutionProof)({
         ...base,
         conditionalWriteBasis: conditional_write,
         commitObservation: commit_observation,
         monitoringDelivery: monitoring_delivery,
-        ...cas_evidence ? { casEvidence: cas_evidence } : {}
+        ...monitoring_attestation ? { monitoringAttestation: monitoring_attestation } : {},
+        ...cas_evidence ? { casEvidence: cas_evidence } : {},
+        ...strictObs ? {
+          commitLabel: strictObs.commit_label,
+          commitEvidenceReason: strictObs.commit_evidence_reason
+        } : {},
+        ...cov
       });
       if (result !== void 0 && (0, cas_attestation_js_1.isExecuteIfUnchangedOutcome)(result)) {
         try {
-          (0, cas_attestation_js_1.buildCasAttestation)(proof, result, {
-            registry: config.executorAttestation && config.executorAttestation.registry
-          });
+          (0, cas_attestation_js_1.buildCasAttestation)(proof, result, casOpts);
         } catch {
         }
       }
-      return {
+      const out = {
         ...base,
         proof,
         freshness,
         conditional_write,
         commit_observation,
         ...monitoring_delivery ? { monitoring_delivery } : {},
-        ...cas_evidence ? { cas_evidence } : {}
+        ...monitoring_attestation ? { monitoring_attestation } : {},
+        ...cas_evidence ? { cas_evidence } : {},
+        ...strictObs ? {
+          commit_label: strictObs.commit_label,
+          ...strictObs.commit_evidence_reason ? { commit_evidence_reason: strictObs.commit_evidence_reason } : {}
+        } : {},
+        ...coverageOutcomeFieldsFrom(cov),
+        ...grantObs ? { execution_grant: grantObs } : {}
       };
+      return attachPolicyPresence(out, config);
     }
     function preflightBeforeByIdFrom(arts) {
       const out = {};
@@ -69489,7 +70389,7 @@ var require_guard = __commonJS({
         const v = unavailableVerdict({ cause: "MISSING_ARTIFACT_CONTENT", failPolicy, resolution: "CLOSED", action: "STOP" }, count);
         const { basis } = freshnessFor(config, redacted, fctx, detection.artifacts);
         const { basis: cw } = conditionalWriteFor(config, redacted, cwctx);
-        return blocked(v, false, basis, cw);
+        return blocked(config, v, false, basis, cw);
       }
       if (failPolicy === "lkg" && !config.lkg) {
         breakerRecord(config);
@@ -69501,10 +70401,23 @@ var require_guard = __commonJS({
         previous_receipt: resolvePreviousReceipt(config),
         idempotency_key: void 0
       };
+      let grantObs;
+      let grantForCall = null;
+      if ((0, execution_grant_js_1.isExecutionGrantEnabled)(config)) {
+        grantObs = { requested: true, arrived: false };
+        const nonceRes = await (0, execution_grant_js_1.resolveStateNonceForCall)(config, redacted, detection.artifacts);
+        if (!nonceRes.ok) {
+          breakerRecord(config);
+          return closedIntegrity(config, "EXECUTION_GRANT_NONCE_UNRESOLVABLE", failPolicy, fctx, cwctx, redacted, detection.artifacts, void 0, void 0, grantObs);
+        }
+        request.include_execution_grant = true;
+        if (nonceRes.nonce)
+          request.state_nonce = nonceRes.nonce;
+      }
       const cap = config.maxPayloadBytes ?? 1e6;
       if (Buffer.byteLength(JSON.stringify(request), "utf8") > cap) {
         breakerRecord(config);
-        return closedIntegrity(config, "PAYLOAD_TOO_LARGE", failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, "PAYLOAD_TOO_LARGE", failPolicy, fctx, cwctx, redacted, detection.artifacts, void 0, void 0, grantObs);
       }
       emit(config, { type: "preflight_start", at: iso() });
       const pf = await preflightWithRetry(config, request);
@@ -69516,13 +70429,19 @@ var require_guard = __commonJS({
         if (pf.integrity) {
           emit(config, { type: "breaker_tripped", at: iso(), cause: pf.cause });
           const v2 = unavailableVerdict({ cause: pf.cause, failPolicy, resolution: "CLOSED", action: "STOP" }, count);
-          return blocked(v2, false, basis, cw);
+          return blocked(config, v2, false, basis, cw, void 0, void 0, grantObs);
         }
         const availCause = pf.cause;
+        if (grantObs && grantObs.requested) {
+          if (breakerTripped(config))
+            emit(config, { type: "breaker_tripped", at: iso(), cause: availCause });
+          const v2 = unavailableVerdict({ cause: availCause, failPolicy, resolution: "CLOSED", action: "STOP" }, count);
+          return blocked(config, v2, false, basis, cw, void 0, void 0, grantObs);
+        }
         if (failPolicy === "open" && !breakerTripped(config)) {
           emit(config, { type: "preflight_unavailable", at: iso(), cause: availCause, action: "CONTINUE" });
           const v2 = unavailableVerdict({ cause: availCause, failPolicy: "open", resolution: "OPEN_PASSTHROUGH", action: "CONTINUE" }, count);
-          return runUnenforced(config, executeFactory, null, v2, false, redacted, basis, cw);
+          return runUnenforced(config, executeFactory, null, v2, false, redacted, basis, cw, void 0, void 0, void 0, grantObs);
         }
         if (failPolicy === "lkg") {
           const lkg = await tryLkg(config, inputFp);
@@ -69535,25 +70454,25 @@ var require_guard = __commonJS({
         if (breakerTripped(config))
           emit(config, { type: "breaker_tripped", at: iso(), cause: availCause });
         const v = unavailableVerdict({ cause: availCause, failPolicy, resolution: "CLOSED", action: "STOP" }, count);
-        return blocked(v, false, basis, cw);
+        return blocked(config, v, false, basis, cw, void 0, void 0, grantObs);
       }
       const rd = (0, read_decision_js_1.readDecision)(pf.response);
       if (rd.reason === "EXECUTION_ACTION_UNRECOGNISED") {
         breakerRecord(config);
-        return closedIntegrity(config, "EXECUTION_ACTION_UNRECOGNISED", failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, "EXECUTION_ACTION_UNRECOGNISED", failPolicy, fctx, cwctx, redacted, detection.artifacts, void 0, void 0, grantObs);
       }
       if (rd.reason === "UNREADABLE_DECISION") {
         breakerRecord(config);
-        return closedIntegrity(config, "UNREADABLE_DECISION", failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, "UNREADABLE_DECISION", failPolicy, fctx, cwctx, redacted, detection.artifacts, void 0, void 0, grantObs);
       }
       if (!rd.envelope) {
         breakerRecord(config);
-        return closedIntegrity(config, "SCHEMA_INVALID", failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, "SCHEMA_INVALID", failPolicy, fctx, cwctx, redacted, detection.artifacts, void 0, void 0, grantObs);
       }
       const envelope = rd.envelope;
       if (!(0, read_decision_js_1.isClosedAction)(rd.executionAction)) {
         breakerRecord(config);
-        return closedIntegrity(config, "EXECUTION_ACTION_UNRECOGNISED", failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, "EXECUTION_ACTION_UNRECOGNISED", failPolicy, fctx, cwctx, redacted, detection.artifacts, void 0, void 0, grantObs);
       }
       const closedAction = rd.executionAction;
       const expired = isExpired(envelope);
@@ -69565,22 +70484,31 @@ var require_guard = __commonJS({
       emit(config, { type: "preflight_result", at: iso(), action: closedAction, decisionId: envelope.decision_id });
       if (config.verifyReceipts !== false && !receiptVerified && envelope.receipt?.token) {
         breakerRecord(config);
-        return closedIntegrity(config, bindResult.cause ?? "RECEIPT_UNVERIFIED", failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, bindResult.cause ?? "RECEIPT_UNVERIFIED", failPolicy, fctx, cwctx, redacted, detection.artifacts, void 0, void 0, grantObs);
       }
       const gate = (0, enforcement_gate_js_1.evaluateEnvelope)(pf.response, envelope, closedAction, detection.artifacts);
       if (gate.verdict === "fail-closed") {
         breakerRecord(config);
-        return closedIntegrity(config, gate.cause, failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, gate.cause, failPolicy, fctx, cwctx, redacted, detection.artifacts, void 0, void 0, grantObs);
       }
       if (gate.verdict === "block-strict") {
         const { basis } = freshnessFor(config, redacted, fctx, detection.artifacts);
         const { basis: cw } = conditionalWriteFor(config, redacted, cwctx);
-        return gate.decision === "BLOCK" ? blocked({ kind: "BLOCK", action: "STOP", envelope, receiptVerified }, true, basis, cw) : blocked({ kind: "APPROVAL", action: "REQUEST_APPROVAL", envelope, receiptVerified }, true, basis, cw);
+        return gate.decision === "BLOCK" ? blocked(config, { kind: "BLOCK", action: "STOP", envelope, receiptVerified }, true, basis, cw, void 0, void 0, grantObs) : blocked(config, { kind: "APPROVAL", action: "REQUEST_APPROVAL", envelope, receiptVerified }, true, basis, cw, void 0, void 0, grantObs);
       }
       const kind = gate.kind;
+      if (grantObs && grantObs.requested) {
+        grantForCall = (0, execution_grant_js_1.readExecutionGrantToken)(pf.response);
+        grantObs = { requested: true, arrived: !!grantForCall };
+        if (!grantForCall) {
+          breakerRecord(config);
+          return closedIntegrity(config, "EXECUTION_GRANT_MISSING", failPolicy, fctx, cwctx, redacted, detection.artifacts, void 0, void 0, grantObs);
+        }
+      }
+      const grantCtx = grantObs ? { execution_grant: grantForCall } : void 0;
       if (expired) {
         breakerRecord(config);
-        return closedIntegrity(config, "SCHEMA_INVALID", failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, "SCHEMA_INVALID", failPolicy, fctx, cwctx, redacted, detection.artifacts, void 0, void 0, grantObs);
       }
       const sinkWired = config.monitoringSinkWired === true && typeof config.onEvent === "function";
       if (kind === "MONITOR") {
@@ -69590,6 +70518,7 @@ var require_guard = __commonJS({
           emit(config, { type: "monitoring_unwired", at: iso(), decisionId: envelope.decision_id });
       }
       let monitoringDelivery;
+      let monitoringAttestation;
       if (kind === "MONITOR") {
         if (!sinkWired) {
           monitoringDelivery = {
@@ -69617,31 +70546,37 @@ var require_guard = __commonJS({
               decisionId: envelope.decision_id,
               cause: monitoringDelivery.reason
             });
-            if ((0, monitoring_delivery_js_1.monitoringDeliveryFailClosed)(config)) {
-              breakerRecord(config);
-              return closedIntegrity(config, "MONITORING_UNWIRED", failPolicy, fctx, cwctx, redacted, detection.artifacts, monitoringDelivery);
-            }
           }
         }
+        monitoringAttestation = await (0, monitoring_attestation_js_1.tryIssueMonitoringAttestation)({
+          config: config.monitoringAttestation,
+          delivery: monitoringDelivery,
+          envelope,
+          now: iso()
+        });
+        if (sinkWired && monitoringDelivery.status === "not_delivered" && (0, monitoring_delivery_js_1.monitoringDeliveryFailClosed)(config)) {
+          breakerRecord(config);
+          return closedIntegrity(config, "MONITORING_UNWIRED", failPolicy, fctx, cwctx, redacted, detection.artifacts, monitoringDelivery, monitoringAttestation, grantObs);
+        }
       }
       const { basis: freshBasis, blockCause: freshBlock } = freshnessFor(config, redacted, fctx, detection.artifacts);
       if (freshBlock === "FRESHNESS_REQUIRED" || freshBlock === "FRESHNESS_FAILED") {
         breakerRecord(config);
-        return closedIntegrity(config, freshBlock, failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, freshBlock, failPolicy, fctx, cwctx, redacted, detection.artifacts, void 0, void 0, grantObs);
       }
       const { basis: cwBasis, blockCause: cwBlock } = conditionalWriteFor(config, redacted, cwctx);
       if (cwBlock === "CONDITIONAL_WRITE_REQUIRED") {
         breakerRecord(config);
-        return closedIntegrity(config, cwBlock, failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, cwBlock, failPolicy, fctx, cwctx, redacted, detection.artifacts, void 0, void 0, grantObs);
       }
       if (config.observeOnly) {
         emit(config, { type: "observe_only_passthrough", at: iso(), action: closedAction });
         const verdict = kind === "ALLOW" ? { kind: "ALLOW", action: "CONTINUE", envelope, receiptVerified } : { kind: "MONITOR", action: "CONTINUE_WITH_MONITORING", envelope, receiptVerified };
-        return runUnenforced(config, executeFactory, envelope, verdict, true, redacted, freshBasis, cwBasis, monitoringDelivery);
+        return runUnenforced(config, executeFactory, envelope, verdict, true, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation, grantCtx, grantObs);
       }
       if (kind === "MONITOR" && sinkWired && monitoringDelivery && monitoringDelivery.status === "not_delivered") {
         const degraded = { kind: "MONITOR", action: "CONTINUE_WITH_MONITORING", envelope, receiptVerified };
-        return runUnenforced(config, executeFactory, envelope, degraded, true, redacted, freshBasis, cwBasis, monitoringDelivery);
+        return runUnenforced(config, executeFactory, envelope, degraded, true, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation, grantCtx, grantObs);
       }
       const enforceable = receiptVerified && (kind === "ALLOW" || sinkWired);
       if (enforceable) {
@@ -69654,7 +70589,7 @@ var require_guard = __commonJS({
             cause: "requireExecutionStateMatch_false"
           });
           const offVerdict = kind === "ALLOW" ? { kind: "ALLOW", action: "CONTINUE", envelope, receiptVerified } : { kind: "MONITOR", action: "CONTINUE_WITH_MONITORING", envelope, receiptVerified };
-          return runUnenforced(config, executeFactory, envelope, offVerdict, true, redacted, freshBasis, cwBasis, monitoringDelivery);
+          return runUnenforced(config, executeFactory, envelope, offVerdict, true, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation, grantCtx, grantObs);
         }
         const et = (0, execution_time_fingerprint_js_1.checkExecutionTimeFingerprint)({
           artifacts: detection.artifacts,
@@ -69668,7 +70603,7 @@ var require_guard = __commonJS({
           const unmeasurable = (0, execution_time_fingerprint_js_1.isUnmeasurableExecutionStateReason)(et.reason);
           if (execStateMode === true) {
             breakerRecord(config);
-            return closedIntegrity(config, unmeasurable ? "EXECUTION_STATE_UNMEASURABLE" : "EXECUTION_STATE_DRIFT", failPolicy, fctx, cwctx, redacted, detection.artifacts);
+            return closedIntegrity(config, unmeasurable ? "EXECUTION_STATE_UNMEASURABLE" : "EXECUTION_STATE_DRIFT", failPolicy, fctx, cwctx, redacted, detection.artifacts, void 0, void 0, grantObs);
           }
           if (unmeasurable) {
             emit(config, {
@@ -69691,21 +70626,21 @@ var require_guard = __commonJS({
             });
           }
           const warnVerdict = kind === "ALLOW" ? { kind: "ALLOW", action: "CONTINUE", envelope, receiptVerified } : { kind: "MONITOR", action: "CONTINUE_WITH_MONITORING", envelope, receiptVerified };
-          return runUnenforced(config, executeFactory, envelope, warnVerdict, true, redacted, freshBasis, cwBasis, monitoringDelivery);
+          return runUnenforced(config, executeFactory, envelope, warnVerdict, true, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation, grantCtx, grantObs);
         }
         const approved = kind === "ALLOW" ? { kind: "ALLOW", action: "CONTINUE", envelope, receiptVerified: true } : { kind: "MONITOR", action: "CONTINUE_WITH_MONITORING", envelope, receiptVerified: true };
-        return runEnforced(config, executeFactory, approved, redacted, freshBasis, cwBasis, monitoringDelivery);
+        return runEnforced(config, executeFactory, approved, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation, grantCtx, grantObs);
       }
       breakerRecord(config);
-      return closedIntegrity(config, receiptVerified ? "MONITORING_UNWIRED" : "RECEIPT_MISSING", failPolicy, fctx, cwctx, redacted, detection.artifacts, monitoringDelivery);
+      return closedIntegrity(config, receiptVerified ? "MONITORING_UNWIRED" : "RECEIPT_MISSING", failPolicy, fctx, cwctx, redacted, detection.artifacts, monitoringDelivery, monitoringAttestation, grantObs);
     }
-    function closedIntegrity(config, cause, failPolicy, fctx, cwctx, redacted, arts, monitoring_delivery) {
+    function closedIntegrity(config, cause, failPolicy, fctx, cwctx, redacted, arts, monitoring_delivery, monitoring_attestation, grantObs) {
       const count = breakers.get(config)?.fails.length ?? 1;
       emit(config, { type: "breaker_tripped", at: iso(), cause });
       const v = unavailableVerdict({ cause, failPolicy, resolution: "CLOSED", action: "STOP" }, count);
       const { basis } = freshnessFor(config, redacted, fctx, arts);
       const { basis: cw } = conditionalWriteFor(config, redacted, cwctx);
-      return blocked(v, false, basis, cw, monitoring_delivery);
+      return blocked(config, v, false, basis, cw, monitoring_delivery, monitoring_attestation, grantObs);
     }
     function isExpired(envelope) {
       const exp = envelope.expires_at;
@@ -70133,6 +71068,114 @@ var require_session_taint = __commonJS({
   }
 });
 
+// node_modules/@coderifts/agent-guard/dist/cjs/coverage-attestation.js
+var require_coverage_attestation = __commonJS({
+  "node_modules/@coderifts/agent-guard/dist/cjs/coverage-attestation.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.COVERAGE_ATTEST_ENVELOPE_TAG = exports2.COVERAGE_ATTEST_SIGNING_PREFIX = exports2.COVERAGE_ATTEST_VERSION = void 0;
+    exports2.coverageAttestSigningInput = coverageAttestSigningInput;
+    exports2.tryIssueCoverageAttestation = tryIssueCoverageAttestation;
+    exports2.kidFromCoverageAttestation = kidFromCoverageAttestation;
+    exports2.COVERAGE_ATTEST_VERSION = "cr.coverage.attest.v1";
+    exports2.COVERAGE_ATTEST_SIGNING_PREFIX = "crcovattest.v1";
+    exports2.COVERAGE_ATTEST_ENVELOPE_TAG = "cr.coverage.attest.v1";
+    var ENVELOPE_CLASSES = ["INCOMPLETE_OBSERVED", "UNKNOWN_OUTSIDE_SCOPE"];
+    var NUL = "";
+    function scalar(v) {
+      return v == null ? "" : String(v);
+    }
+    function canonicalUngoverned(list) {
+      return Array.isArray(list) ? list.map((s) => String(s)).join(NUL) : "";
+    }
+    function coverageAttestSigningInput(body) {
+      const parts = [
+        exports2.COVERAGE_ATTEST_SIGNING_PREFIX,
+        scalar(body.kid),
+        scalar(body.session_id),
+        scalar(body.observed_class),
+        body.governed_calls != null ? String(body.governed_calls) : "",
+        body.total_calls != null ? String(body.total_calls) : "",
+        canonicalUngoverned(body.ungoverned_tools),
+        scalar(body.decision_id),
+        scalar(body.receipt_digest),
+        scalar(body.observed_at)
+      ];
+      return parts.join("|");
+    }
+    function b64url(buf) {
+      return buf.toString("base64url");
+    }
+    function hasHalfB(cov) {
+      return cov.class !== "UNKNOWN_OUTSIDE_SCOPE" && typeof cov.total_calls === "number";
+    }
+    async function tryIssueCoverageAttestation(args) {
+      const cfg = args.config;
+      if (!cfg || typeof cfg.kid !== "string" || !cfg.kid || typeof cfg.signer !== "function") {
+        return void 0;
+      }
+      if (typeof cfg.sessionId !== "string" || cfg.sessionId.length === 0)
+        return void 0;
+      const cov = args.coverage;
+      if (!cov || typeof cov !== "object")
+        return void 0;
+      if (typeof cov.governed_calls !== "number" || !Number.isInteger(cov.governed_calls) || cov.governed_calls < 0) {
+        return void 0;
+      }
+      const halfB = hasHalfB(cov);
+      const observed_class = halfB ? "INCOMPLETE_OBSERVED" : "UNKNOWN_OUTSIDE_SCOPE";
+      if (!ENVELOPE_CLASSES.includes(observed_class))
+        return void 0;
+      const body = {
+        v: exports2.COVERAGE_ATTEST_VERSION,
+        kid: cfg.kid,
+        session_id: cfg.sessionId,
+        observed_class,
+        governed_calls: cov.governed_calls,
+        observed_at: args.now || (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z")
+      };
+      if (halfB) {
+        const withTotals = cov;
+        if (!Number.isInteger(withTotals.total_calls) || withTotals.total_calls < cov.governed_calls) {
+          return void 0;
+        }
+        body.total_calls = withTotals.total_calls;
+        body.ungoverned_tools = Array.isArray(withTotals.ungoverned_tools) ? withTotals.ungoverned_tools.map((s) => String(s)) : [];
+      }
+      if (typeof args.decisionId === "string" && args.decisionId)
+        body.decision_id = args.decisionId;
+      if (typeof args.receiptDigest === "string" && args.receiptDigest)
+        body.receipt_digest = args.receiptDigest;
+      const input = Buffer.from(coverageAttestSigningInput(body), "utf8");
+      let sig;
+      try {
+        sig = await cfg.signer(input);
+      } catch {
+        return void 0;
+      }
+      if (sig == null)
+        return void 0;
+      const sigBuf = Buffer.isBuffer(sig) ? sig : Buffer.from(sig);
+      if (sigBuf.length === 0)
+        return void 0;
+      return [
+        exports2.COVERAGE_ATTEST_ENVELOPE_TAG,
+        cfg.kid,
+        b64url(Buffer.from(JSON.stringify(body), "utf8")),
+        b64url(sigBuf)
+      ].join("|");
+    }
+    function kidFromCoverageAttestation(token) {
+      if (typeof token !== "string" || token.length === 0)
+        return null;
+      const parts = token.split("|");
+      if (parts.length !== 4 || parts[0] !== exports2.COVERAGE_ATTEST_ENVELOPE_TAG)
+        return null;
+      return parts[1] || null;
+    }
+  }
+});
+
 // node_modules/@coderifts/agent-guard/dist/cjs/final-answer-proof.js
 var require_final_answer_proof = __commonJS({
   "node_modules/@coderifts/agent-guard/dist/cjs/final-answer-proof.js"(exports2) {
@@ -70143,9 +71186,15 @@ var require_final_answer_proof = __commonJS({
     exports2.attachProofToAgentResponse = attachProofToAgentResponse;
     var execution_proof_js_1 = require_execution_proof();
     var monitoring_delivery_js_1 = require_monitoring_delivery();
+    var monitoring_attestation_js_1 = require_monitoring_attestation2();
+    var coverage_observed_js_1 = require_coverage_observed();
     function deriveProofBanner(proof) {
       if (!proof || typeof proof !== "object")
         return "NO_PREFLIGHT";
+      if (proof.commit_label === "authorized_and_committed")
+        return "AUTHORIZED_AND_COMMITTED";
+      if (proof.commit_label === "authorized_not_committed")
+        return "AUTHORIZED_NOT_COMMITTED";
       if (proof.currently_authorized === null) {
         return "NOT_EVALUATED_SKIPPED";
       }
@@ -70160,6 +71209,10 @@ var require_final_answer_proof = __commonJS({
       switch (banner) {
         case "ENFORCED":
           return "ENFORCED \u2014 receipt verified; call ran on the guarded path";
+        case "AUTHORIZED_AND_COMMITTED":
+          return "AUTHORIZED AND COMMITTED \u2014 executor-attested CAS (grant/receipt cross-checked)";
+        case "AUTHORIZED_NOT_COMMITTED":
+          return "authorized; commit not proven (no executor attestation)";
         case "AUTHORIZED":
           return "AUTHORIZED \u2014 receipt verified for this scope (not a claim of full host protection)";
         case "NOT_AUTHORIZED":
@@ -70286,7 +71339,13 @@ var require_final_answer_proof = __commonJS({
         if (co.token)
           lines.push(bullet(`token: ${co.token}`));
         const ce = proof.cas_evidence;
-        if (ce && ce.class === "executor_attested") {
+        if (proof.commit_label === "authorized_not_committed") {
+          lines.push(bullet("authorized; commit not proven (no executor attestation)"));
+          if (proof.commit_evidence_reason) {
+            lines.push(bullet(`reason: ${proof.commit_evidence_reason}`));
+          }
+          lines.push(bullet("Observed at T3, not atomic: another writer may act between write and observation; token-only adapters compare version token not content; host attestation is a host claim layered on the measurement."));
+        } else if (ce && ce.class === "executor_attested") {
           const kid = ce.executor_kid != null ? ce.executor_kid : "\u2026";
           const st = ce.attest_status != null ? ce.attest_status : "ATTEST_VALID";
           lines.push(bullet(`committed \u2014 executor-attested (${st}, kid ${kid})`));
@@ -70302,8 +71361,19 @@ var require_final_answer_proof = __commonJS({
       const mdv = proof.monitoring_delivery;
       if (mdv && typeof mdv === "object" && typeof mdv.status === "string") {
         lines.push(h2("Monitoring delivery"));
-        lines.push(bullet((0, monitoring_delivery_js_1.formatMonitoringDeliveryLine)(mdv)));
+        const attestedKid = (0, monitoring_attestation_js_1.kidFromMonitoringAttestation)(proof.monitoring_attestation);
+        lines.push(bullet((0, monitoring_delivery_js_1.formatMonitoringDeliveryLine)(mdv, attestedKid)));
         lines.push(bullet("delivered_acked means the sink returned an ack \u2014 it does NOT mean a human saw the event."));
+        if (attestedKid) {
+          lines.push(bullet("attested means a holder of the monitoring key observed this delivery status \u2014 not that a human read the alert, and not that the sink is configured for the right audience."));
+        }
+        lines.push("");
+      }
+      const cov = proof.coverage_observed;
+      if (cov && typeof cov === "object" && typeof cov.class === "string") {
+        lines.push(h2("Coverage (observed)"));
+        lines.push(bullet((0, coverage_observed_js_1.formatCoverageObservedLine)(cov)));
+        lines.push(bullet(`class: ${cov.class}`));
         lines.push("");
       }
       lines.push(h2("Limits (non-claims \u2014 always true on this proof)"));
@@ -71625,6 +72695,64 @@ var require_auto_derive = __commonJS({
   }
 });
 
+// node_modules/@coderifts/agent-guard/dist/cjs/cas-adapters/fs-default-wire.js
+var require_fs_default_wire = __commonJS({
+  "node_modules/@coderifts/agent-guard/dist/cjs/cas-adapters/fs-default-wire.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.inferFsPathFromArgs = inferFsPathFromArgs;
+    exports2.inferFullFileWriteContent = inferFullFileWriteContent;
+    exports2.wrapWriteWithFsCas = wrapWriteWithFsCas;
+    var cas_attestation_js_1 = require_cas_attestation();
+    var fs_js_1 = require_fs();
+    function inferFsPathFromArgs(args) {
+      if (!args || typeof args !== "object")
+        return null;
+      const path = args.path;
+      if (typeof path !== "string")
+        return null;
+      const trimmed = path.trim();
+      if (!trimmed)
+        return null;
+      if (/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(trimmed))
+        return null;
+      return trimmed;
+    }
+    function inferFullFileWriteContent(args) {
+      if (!args || typeof args !== "object")
+        return null;
+      const a = args;
+      if (typeof a.contents === "string")
+        return a.contents;
+      if (typeof a.content === "string" && a.old_string == null && a.new_string == null) {
+        return a.content;
+      }
+      return null;
+    }
+    async function wrapWriteWithFsCas(args, write) {
+      const filePath = inferFsPathFromArgs(args);
+      const content = inferFullFileWriteContent(args);
+      if (filePath && content != null) {
+        let expected;
+        try {
+          expected = await (0, fs_js_1.createFsVersionToken)(filePath);
+        } catch {
+          return write();
+        }
+        return (0, fs_js_1.writeFileIfUnchanged)({
+          path: filePath,
+          expected_token: expected,
+          content
+        });
+      }
+      const raw = await write();
+      if ((0, cas_attestation_js_1.isExecuteIfUnchangedOutcome)(raw))
+        return raw;
+      return raw;
+    }
+  }
+});
+
 // node_modules/@coderifts/agent-guard/dist/cjs/tool-registry.js
 var require_tool_registry = __commonJS({
   "node_modules/@coderifts/agent-guard/dist/cjs/tool-registry.js"(exports2) {
@@ -71637,6 +72765,7 @@ var require_tool_registry = __commonJS({
     var freshness_js_1 = require_freshness();
     var auto_recheck_js_1 = require_auto_recheck();
     var auto_derive_js_1 = require_auto_derive();
+    var fs_default_wire_js_1 = require_fs_default_wire();
     var RegistryConstructionError = class extends Error {
       code;
       toolName;
@@ -71815,7 +72944,10 @@ var require_tool_registry = __commonJS({
             resolvePriorContent: guardCfg.resolvePriorContent
           });
           const fctx = await refreshContext(call);
-          const factory = async (_envelope, redacted) => rawExecute(redacted ? redacted.arguments : args);
+          const factory = async (_envelope, redacted, execution) => {
+            const rawArgs = redacted ? redacted.arguments : args;
+            return (0, fs_default_wire_js_1.wrapWriteWithFsCas)(rawArgs, () => execution ? rawExecute(rawArgs, execution) : rawExecute(rawArgs));
+          };
           const outcome = (0, auto_recheck_js_1.normalizeAutoRecheck)(guardCfg.autoRecheck) ? await (0, auto_recheck_js_1.runAutoRecheckLoop)({
             call,
             factory,
@@ -72719,6 +73851,7 @@ var require_with_coderifts = __commonJS({
     exports2.guardedFractionAmongRoutes = guardedFractionAmongRoutes;
     exports2.withCodeRifts = withCodeRifts;
     var tool_registry_js_1 = require_tool_registry();
+    var coverage_observed_js_1 = require_coverage_observed();
     function foldTableSettledCalls(events) {
       const counts = { GUARDED: 0, PASSTHROUGH: 0, BYPASSED: 0 };
       for (const e of events) {
@@ -72745,6 +73878,7 @@ var require_with_coderifts = __commonJS({
     var RESIDUAL_CALLS_OUTSIDE_GUARDED_PATH = "calls_outside_guarded_path_invisible";
     var RESIDUAL_FORCED_READONLY = "composition_forced_readonly_on_heuristic_mutator";
     var RESIDUAL_UNKNOWN_READONLY = "composition_unknown_treated_as_readonly";
+    var RESIDUAL_GRANT_BEARER_NO_STATE_NONCE = "execution_grant_bearer_no_state_nonce";
     var COVERAGE_STRENGTH = {
       COMPLETE: 3,
       PARTIAL: 2,
@@ -72757,6 +73891,20 @@ var require_with_coderifts = __commonJS({
     function isEnforcingStrict(input) {
       return input.profile === "ENFORCING_STRICT";
     }
+    function enforcingStrictExecutionChainProblems(input) {
+      const grant = input.executionGrant;
+      const enabled = !!(grant && grant.enabled === true);
+      if (enabled)
+        return [];
+      const what = grant === void 0 ? "executionGrant is absent" : "executionGrant.enabled is not true";
+      return [
+        `ENFORCING_STRICT requires the execution chain, but ${what}. Without a grant the guard authorizes a change but nothing binds the executor to it, so a commit can never be proven (the outcome stays authorized_not_committed / commit_evidence_missing). Add:
+    executionGrant: { enabled: true }
+  and, for the ATOMIC profile (single-use at the executor), also:
+    executionGrant: { enabled: true, resolveStateNonce: ({ artifactId }) => nonceFor(artifactId) }
+  A grant without resolveStateNonce is the BEARER profile: permitted under strict, and recorded as residual ${RESIDUAL_GRANT_BEARER_NO_STATE_NONCE}.`
+      ];
+    }
     function enforcingStrictWeakenFlags(input) {
       const flags = [];
       if (input.requireCoverage !== void 0) {
@@ -72924,6 +74072,23 @@ var require_with_coderifts = __commonJS({
       };
       return state;
     }
+    function wrapForCoverageObserved(tool, observer) {
+      const innerExecute = tool.execute;
+      const shell = {
+        name: tool.name,
+        description: tool.description,
+        inputSchema: tool.inputSchema,
+        meta: tool.meta,
+        _coderifts: tool._coderifts,
+        execute: async (args) => {
+          observer.recordGoverned(tool.name);
+          return innerExecute(args);
+        }
+      };
+      if (!Object.isFrozen(shell._coderifts))
+        Object.freeze(shell._coderifts);
+      return Object.freeze(shell);
+    }
     function wrapForReceiptCursor(tool, cursor) {
       if (!tool._coderifts.guarded || !cursor.enabled)
         return tool;
@@ -72977,6 +74142,7 @@ var require_with_coderifts = __commonJS({
         if (typeof input.resolvePriorContent !== "function") {
           problems.push("ENFORCING_STRICT cannot be weakened: resolvePriorContent conflicts");
         }
+        problems.push(...enforcingStrictExecutionChainProblems(input));
       }
       if (problems.length > 0) {
         throw new Error(`withCodeRifts: construction aborted \u2014 ${problems.length} condition(s):
@@ -72986,7 +74152,8 @@ var require_with_coderifts = __commonJS({
       const threadReceipts = input.threadReceipts !== false;
       const receiptCursor = createReceiptCursor(threadReceipts);
       const hostPreviousReceipt = input.previousReceipt;
-      const guard = { client: input.client, operation: input.operation };
+      const coverageObserver = (0, coverage_observed_js_1.createCoverageObserver)();
+      const guard = { client: input.client, operation: input.operation, coverageObserver };
       if (input.onEvent !== void 0) {
         guard.onEvent = input.onEvent;
       }
@@ -73040,6 +74207,15 @@ var require_with_coderifts = __commonJS({
       if (input.executorAttestation !== void 0) {
         guard.executorAttestation = input.executorAttestation;
       }
+      if (input.monitoringAttestation !== void 0) {
+        guard.monitoringAttestation = input.monitoringAttestation;
+      }
+      if (input.systemPrompt !== void 0) {
+        guard.systemPrompt = input.systemPrompt;
+      }
+      if (input.executionGrant !== void 0) {
+        guard.executionGrant = input.executionGrant;
+      }
       const strict = isEnforcingStrict(input);
       if (strict) {
         guard.requireFreshness = true;
@@ -73057,6 +74233,7 @@ var require_with_coderifts = __commonJS({
       };
       const requireCoverage = strict ? "COMPLETE" : input.requireCoverage;
       const { tools, report } = (0, tool_registry_js_1.guardToolRegistry)(input.tools, config);
+      coverageObserver.setTableNames(tools.map((t) => t.name));
       if (requireCoverage !== void 0) {
         const requiredRank = coverageRank(requireCoverage);
         const actualRank = coverageRank(report.coverage) ?? -1;
@@ -73072,6 +74249,12 @@ var require_with_coderifts = __commonJS({
       if (report.warnings.includes("unknown_treated_as_readonly")) {
         residuals.push(RESIDUAL_UNKNOWN_READONLY);
       }
+      {
+        const g = input.executionGrant;
+        if (g && g.enabled === true && typeof g.resolveStateNonce !== "function") {
+          residuals.push(RESIDUAL_GRANT_BEARER_NO_STATE_NONCE);
+        }
+      }
       const freshness_resolver_wired = typeof input.resolvePriorContent === "function";
       if (!freshness_resolver_wired) {
         residuals.push(RESIDUAL_FRESHNESS_NOT_CONFIGURED);
@@ -73085,9 +74268,13 @@ var require_with_coderifts = __commonJS({
       const composition_assurance = {
         coverage: "PARTIAL",
         inescapable_runtime: compositionInescapableRuntime,
-        residuals,
-        freshness_resolver_wired
+        residuals: Object.freeze(residuals.slice()),
+        freshness_resolver_wired,
+        get observed_class() {
+          return coverageObserver.snapshot().class;
+        }
       };
+      Object.freeze(composition_assurance);
       let toolsOut = tools;
       if (threadReceipts) {
         toolsOut = toolsOut.map((t) => wrapForReceiptCursor(t, receiptCursor));
@@ -73099,11 +74286,13 @@ var require_with_coderifts = __commonJS({
       } else if (threadReceipts) {
         toolsOut = Object.freeze(toolsOut);
       }
+      toolsOut = Object.freeze(toolsOut.map((t) => wrapForCoverageObserved(t, coverageObserver)));
       const result = {
         tools: toolsOut,
         registry_report: report,
         composition_assurance,
-        receipt_thread: receiptCursor.handle
+        receipt_thread: receiptCursor.handle,
+        coverage_observed: coverageObserver.handle
       };
       if (input.repository !== void 0)
         result.repository = input.repository;
@@ -73112,6 +74301,73 @@ var require_with_coderifts = __commonJS({
   }
 });
 
+// node_modules/@coderifts/agent-guard/dist/cjs/gate-refusal.js
+var require_gate_refusal = __commonJS({
+  "node_modules/@coderifts/agent-guard/dist/cjs/gate-refusal.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.FRESHNESS_RESOLVER_FIX = void 0;
+    exports2.verdictKind = verdictKind;
+    exports2.verdictCause = verdictCause;
+    exports2.freshnessRefusalTeaching = freshnessRefusalTeaching;
+    exports2.formatGateRefusalBody = formatGateRefusalBody;
+    exports2.formatGuardError = formatGuardError;
+    exports2.FRESHNESS_RESOLVER_FIX = "pass resolvePriorContent (e.g. createFsPriorContentResolver()) to withCodeRifts / GuardConfig";
+    function verdictKind(outcome) {
+      const v = outcome.verdict;
+      return v && typeof v === "object" && "kind" in v ? String(v.kind) : "UNKNOWN";
+    }
+    function verdictCause(outcome) {
+      const v = outcome.verdict;
+      if (v && typeof v === "object" && "cause" in v && typeof v.cause === "string") {
+        return v.cause;
+      }
+      return void 0;
+    }
+    function freshnessRefusalTeaching(outcome) {
+      const cause = verdictCause(outcome);
+      const basis = outcome.freshness;
+      const wiring = basis && typeof basis === "object" ? basis.wiring : void 0;
+      const degradeReason = basis && basis.wiring === "DEGRADED" && basis.degrade ? basis.degrade.reason : void 0;
+      const assessment = basis && basis.wiring === "ACTIVE" && basis.assessment ? basis.assessment.outcome : void 0;
+      if (cause === "FRESHNESS_REQUIRED") {
+        if (wiring === "NOT_CONFIGURED") {
+          return `cause: FRESHNESS_REQUIRED \u2014 resolvePriorContent / prior-content resolver not configured. One-line fix: ${exports2.FRESHNESS_RESOLVER_FIX}.`;
+        }
+        if (wiring === "DEGRADED") {
+          const why = degradeReason || "resolver_returned_empty";
+          return `cause: FRESHNESS_REQUIRED \u2014 prior-content resolver is configured but DEGRADED (${why}). Fix the resolver so it returns current file bytes.`;
+        }
+        return `cause: FRESHNESS_REQUIRED \u2014 freshness measurement was required and was not ACTIVE. One-line fix: ${exports2.FRESHNESS_RESOLVER_FIX}.`;
+      }
+      if (cause === "FRESHNESS_FAILED") {
+        const o = assessment || "UNKNOWN";
+        return `cause: FRESHNESS_FAILED \u2014 prior-content measurement ran and fail-closed (${o}). Re-preflight with current bytes; do not retry the stale change-set.`;
+      }
+      return null;
+    }
+    function formatGateRefusalBody(outcome) {
+      const kind = verdictKind(outcome);
+      let body = `CodeRifts gate did not permit execution (verdict: ${kind}). No tool result was produced.`;
+      const teach = freshnessRefusalTeaching(outcome);
+      if (teach)
+        body += ` ${teach}`;
+      return body;
+    }
+    function formatGuardError(err) {
+      if (err instanceof Error)
+        return err.message || err.name || "Error";
+      if (typeof err === "string")
+        return err;
+      try {
+        return JSON.stringify(err);
+      } catch {
+        return String(err);
+      }
+    }
+  }
+});
+
 // node_modules/@coderifts/agent-guard/dist/cjs/adapters/openai.js
 var require_openai = __commonJS({
   "node_modules/@coderifts/agent-guard/dist/cjs/adapters/openai.js"(exports2) {
@@ -73125,6 +74381,7 @@ var require_openai = __commonJS({
     exports2.bindOpenAIGuardOutcome = bindOpenAIGuardOutcome;
     var with_coderifts_js_1 = require_with_coderifts();
     var final_answer_proof_js_1 = require_final_answer_proof();
+    var gate_refusal_js_1 = require_gate_refusal();
     var EMPTY_PARAMETERS = Object.freeze({
       type: "object",
       properties: {}
@@ -73155,7 +74412,8 @@ var require_openai = __commonJS({
         protected_tools,
         registry_report: result.registry_report,
         composition_assurance: result.composition_assurance,
-        receipt_thread: result.receipt_thread
+        receipt_thread: result.receipt_thread,
+        coverage_observed: result.coverage_observed
       };
       if (result.repository !== void 0) {
         out.repository = result.repository;
@@ -73181,12 +74439,11 @@ var require_openai = __commonJS({
       if (outcome.executed === true) {
         body = serialize(outcome.result);
       } else if (outcome.executionAttempted === false) {
-        const kind = outcome.verdict && typeof outcome.verdict === "object" && "kind" in outcome.verdict ? String(outcome.verdict.kind) : "UNKNOWN";
-        body = `CodeRifts gate did not permit execution (verdict: ${kind}). No tool result was produced.`;
+        body = (0, gate_refusal_js_1.formatGateRefusalBody)(outcome);
       } else {
         const err = "error" in outcome ? outcome.error : void 0;
-        const errText = formatGuardError(err);
-        const kind = outcome.verdict && typeof outcome.verdict === "object" && "kind" in outcome.verdict ? String(outcome.verdict.kind) : "UNKNOWN";
+        const errText = (0, gate_refusal_js_1.formatGuardError)(err);
+        const kind = (0, gate_refusal_js_1.verdictKind)(outcome);
         body = `Tool execution failed after gate decision (verdict: ${kind}): ${errText}`;
       }
       const content = args.attachProof === false ? body : (0, final_answer_proof_js_1.attachProofToAgentResponse)(body, outcome.proof);
@@ -73197,17 +74454,6 @@ var require_openai = __commonJS({
       };
       return msg;
     }
-    function formatGuardError(err) {
-      if (err instanceof Error)
-        return err.message || err.name || "Error";
-      if (typeof err === "string")
-        return err;
-      try {
-        return JSON.stringify(err);
-      } catch {
-        return String(err);
-      }
-    }
   }
 });
 
@@ -73224,6 +74470,7 @@ var require_anthropic = __commonJS({
     exports2.bindAnthropicGuardOutcome = bindAnthropicGuardOutcome;
     var with_coderifts_js_1 = require_with_coderifts();
     var final_answer_proof_js_1 = require_final_answer_proof();
+    var gate_refusal_js_1 = require_gate_refusal();
     var EMPTY_INPUT_SCHEMA = Object.freeze({
       type: "object",
       properties: {}
@@ -73254,7 +74501,8 @@ var require_anthropic = __commonJS({
         protected_tools,
         registry_report: result.registry_report,
         composition_assurance: result.composition_assurance,
-        receipt_thread: result.receipt_thread
+        receipt_thread: result.receipt_thread,
+        coverage_observed: result.coverage_observed
       };
       if (result.repository !== void 0) {
         out.repository = result.repository;
@@ -73280,12 +74528,11 @@ var require_anthropic = __commonJS({
       if (outcome.executed === true) {
         body = serialize(outcome.result);
       } else if (outcome.executionAttempted === false) {
-        const kind = verdictKind(outcome);
-        body = `CodeRifts gate did not permit execution (verdict: ${kind}). No tool result was produced.`;
+        body = (0, gate_refusal_js_1.formatGateRefusalBody)(outcome);
       } else {
         const err = "error" in outcome ? outcome.error : void 0;
-        const kind = verdictKind(outcome);
-        body = `Tool execution failed after gate decision (verdict: ${kind}): ${formatGuardError(err)}`;
+        const kind = (0, gate_refusal_js_1.verdictKind)(outcome);
+        body = `Tool execution failed after gate decision (verdict: ${kind}): ${(0, gate_refusal_js_1.formatGuardError)(err)}`;
       }
       const content = args.attachProof === false ? body : (0, final_answer_proof_js_1.attachProofToAgentResponse)(body, outcome.proof);
       const block = {
@@ -73295,20 +74542,6 @@ var require_anthropic = __commonJS({
       };
       return block;
     }
-    function verdictKind(outcome) {
-      return outcome.verdict && typeof outcome.verdict === "object" && "kind" in outcome.verdict ? String(outcome.verdict.kind) : "UNKNOWN";
-    }
-    function formatGuardError(err) {
-      if (err instanceof Error)
-        return err.message || err.name || "Error";
-      if (typeof err === "string")
-        return err;
-      try {
-        return JSON.stringify(err);
-      } catch {
-        return String(err);
-      }
-    }
   }
 });
 
@@ -73317,34 +74550,65 @@ var require_langgraph = __commonJS({
   "node_modules/@coderifts/agent-guard/dist/cjs/adapters/langgraph.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.LangGraphToolsNotStructuredError = void 0;
+    exports2.isLangGraphReactAgentTool = isLangGraphReactAgentTool;
     exports2.protectedToolToLangGraph = protectedToolToLangGraph;
     exports2.toLangGraphTools = toLangGraphTools;
+    exports2.bindLangGraphTools = bindLangGraphTools;
     exports2.withCodeRiftsLangGraph = withCodeRiftsLangGraph;
     exports2.langGraphToolAdapter = langGraphToolAdapter;
     exports2.defaultSerializeLangGraphToolResult = defaultSerializeLangGraphToolResult;
     exports2.bindLangGraphGuardOutcome = bindLangGraphGuardOutcome;
     var with_coderifts_js_1 = require_with_coderifts();
     var final_answer_proof_js_1 = require_final_answer_proof();
+    var gate_refusal_js_1 = require_gate_refusal();
+    var LangGraphToolsNotStructuredError = class extends Error {
+      constructor(message) {
+        super(message ?? "withCodeRiftsLangGraph() tools are not StructuredTool-compatible for createReactAgent. createReactAgent (@langchain/langgraph) requires StructuredToolInterface | DynamicTool | RunnableToolLike (name, description, schema, invoke, lc_runnable). Fix: wrap with tool() from @langchain/core/tools \u2014 see README (LangChain / LangGraph).");
+        this.name = "LangGraphToolsNotStructuredError";
+      }
+    };
+    exports2.LangGraphToolsNotStructuredError = LangGraphToolsNotStructuredError;
+    function isLangGraphReactAgentTool(t) {
+      if (!t || typeof t !== "object")
+        return false;
+      const o = t;
+      return typeof o.name === "string" && o.name.length > 0 && typeof o.description === "string" && o.schema != null && typeof o.schema === "object" && !Array.isArray(o.schema) && typeof o.invoke === "function" && typeof o.func === "function" && o.lc_runnable === true;
+    }
     var EMPTY_SCHEMA = Object.freeze({
       type: "object",
       properties: {}
     });
     function protectedToolToLangGraph(tool) {
       const schema = tool.inputSchema != null && typeof tool.inputSchema === "object" && !Array.isArray(tool.inputSchema) ? tool.inputSchema : { ...EMPTY_SCHEMA };
-      const guarded = (args) => Promise.resolve(tool.execute(args));
+      const guarded = (args, _config) => Promise.resolve().then(() => tool.execute(args));
+      const description = tool.description != null && tool.description !== "" ? tool.description : tool.name;
       const out = {
         name: tool.name,
+        description,
         schema,
         func: guarded,
-        invoke: guarded
+        invoke: guarded,
+        lc_runnable: true
       };
-      if (tool.description != null && tool.description !== "") {
-        out.description = tool.description;
+      if (!isLangGraphReactAgentTool(out)) {
+        throw new LangGraphToolsNotStructuredError(`protectedToolToLangGraph(${JSON.stringify(tool.name)}): tool is not createReactAgent-consumable. Fix: wrap with tool() from @langchain/core/tools \u2014 see README (LangChain / LangGraph).`);
       }
       return out;
     }
     function toLangGraphTools(protectedTools) {
-      return protectedTools.map(protectedToolToLangGraph);
+      return bindLangGraphTools(protectedTools.map(protectedToolToLangGraph));
+    }
+    function bindLangGraphTools(tools) {
+      const out = [];
+      for (const t of tools) {
+        if (!isLangGraphReactAgentTool(t)) {
+          const n = t && typeof t === "object" && "name" in t ? String(t.name) : "?";
+          throw new LangGraphToolsNotStructuredError(`bindLangGraphTools: ${JSON.stringify(n)} is not StructuredTool-compatible for createReactAgent. Fix: wrap with tool() from @langchain/core/tools \u2014 see README (LangChain / LangGraph).`);
+        }
+        out.push(t);
+      }
+      return out;
     }
     function withCodeRiftsLangGraph(input) {
       const core = (0, with_coderifts_js_1.withCodeRifts)(input);
@@ -73358,7 +74622,8 @@ var require_langgraph = __commonJS({
         protected_tools,
         registry_report: result.registry_report,
         composition_assurance: result.composition_assurance,
-        receipt_thread: result.receipt_thread
+        receipt_thread: result.receipt_thread,
+        coverage_observed: result.coverage_observed
       };
       if (result.repository !== void 0) {
         out.repository = result.repository;
@@ -73384,12 +74649,11 @@ var require_langgraph = __commonJS({
       if (outcome.executed === true) {
         body = serialize(outcome.result);
       } else if (outcome.executionAttempted === false) {
-        const kind = verdictKind(outcome);
-        body = `CodeRifts gate did not permit execution (verdict: ${kind}). No tool result was produced.`;
+        body = (0, gate_refusal_js_1.formatGateRefusalBody)(outcome);
       } else {
         const err = "error" in outcome ? outcome.error : void 0;
-        const kind = verdictKind(outcome);
-        body = `Tool execution failed after gate decision (verdict: ${kind}): ${formatGuardError(err)}`;
+        const kind = (0, gate_refusal_js_1.verdictKind)(outcome);
+        body = `Tool execution failed after gate decision (verdict: ${kind}): ${(0, gate_refusal_js_1.formatGuardError)(err)}`;
       }
       const content = args.attachProof === false ? body : (0, final_answer_proof_js_1.attachProofToAgentResponse)(body, outcome.proof);
       const msg = {
@@ -73401,20 +74665,6 @@ var require_langgraph = __commonJS({
       }
       return msg;
     }
-    function verdictKind(outcome) {
-      return outcome.verdict && typeof outcome.verdict === "object" && "kind" in outcome.verdict ? String(outcome.verdict.kind) : "UNKNOWN";
-    }
-    function formatGuardError(err) {
-      if (err instanceof Error)
-        return err.message || err.name || "Error";
-      if (typeof err === "string")
-        return err;
-      try {
-        return JSON.stringify(err);
-      } catch {
-        return String(err);
-      }
-    }
   }
 });
 
@@ -73431,6 +74681,7 @@ var require_gemini = __commonJS({
     exports2.bindGeminiGuardOutcome = bindGeminiGuardOutcome;
     var with_coderifts_js_1 = require_with_coderifts();
     var final_answer_proof_js_1 = require_final_answer_proof();
+    var gate_refusal_js_1 = require_gate_refusal();
     var EMPTY_PARAMETERS = Object.freeze({
       type: "object",
       properties: {}
@@ -73465,7 +74716,8 @@ var require_gemini = __commonJS({
         protected_tools,
         registry_report: result.registry_report,
         composition_assurance: result.composition_assurance,
-        receipt_thread: result.receipt_thread
+        receipt_thread: result.receipt_thread,
+        coverage_observed: result.coverage_observed
       };
       if (result.repository !== void 0) {
         out.repository = result.repository;
@@ -73495,15 +74747,12 @@ var require_gemini = __commonJS({
       if (outcome.executed === true) {
         base = { result: serialize(outcome.result) };
       } else if (outcome.executionAttempted === false) {
-        const kind = verdictKind(outcome);
-        base = {
-          gate_message: `CodeRifts gate did not permit execution (verdict: ${kind}). No tool result was produced.`
-        };
+        base = { gate_message: (0, gate_refusal_js_1.formatGateRefusalBody)(outcome) };
       } else {
         const err = "error" in outcome ? outcome.error : void 0;
-        const kind = verdictKind(outcome);
+        const kind = (0, gate_refusal_js_1.verdictKind)(outcome);
         base = {
-          gate_message: `Tool execution failed after gate decision (verdict: ${kind}): ${formatGuardError(err)}`
+          gate_message: `Tool execution failed after gate decision (verdict: ${kind}): ${(0, gate_refusal_js_1.formatGuardError)(err)}`
         };
       }
       const bound = args.attachProof === false ? base : (0, final_answer_proof_js_1.attachProofToAgentResponse)(base, outcome.proof);
@@ -73515,20 +74764,6 @@ var require_gemini = __commonJS({
       };
       return part;
     }
-    function verdictKind(outcome) {
-      return outcome.verdict && typeof outcome.verdict === "object" && "kind" in outcome.verdict ? String(outcome.verdict.kind) : "UNKNOWN";
-    }
-    function formatGuardError(err) {
-      if (err instanceof Error)
-        return err.message || err.name || "Error";
-      if (typeof err === "string")
-        return err;
-      try {
-        return JSON.stringify(err);
-      } catch {
-        return String(err);
-      }
-    }
   }
 });
 
@@ -73824,19 +75059,253 @@ var require_execute_tool_call = __commonJS({
   }
 });
 
+// node_modules/@coderifts/agent-guard/dist/cjs/toolset-attestation.js
+var require_toolset_attestation = __commonJS({
+  "node_modules/@coderifts/agent-guard/dist/cjs/toolset-attestation.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.TOOLSET_ATTEST_STATEMENT = exports2.TOOLSET_ATTEST_ENVELOPE_TAG = exports2.TOOLSET_ATTEST_SIGNING_PREFIX = exports2.TOOLSET_ATTEST_VERSION = void 0;
+    exports2.computeToolsetDigest = computeToolsetDigest;
+    exports2.declarationEntriesFromTools = declarationEntriesFromTools;
+    exports2.toolsetAttestSigningInput = toolsetAttestSigningInput;
+    exports2.tryIssueToolsetAttestation = tryIssueToolsetAttestation;
+    exports2.kidFromToolsetAttestation = kidFromToolsetAttestation;
+    var node_crypto_1 = require("node:crypto");
+    exports2.TOOLSET_ATTEST_VERSION = "cr.toolset.attest.v1";
+    exports2.TOOLSET_ATTEST_SIGNING_PREFIX = "crtoolsetattest.v1";
+    exports2.TOOLSET_ATTEST_ENVELOPE_TAG = "cr.toolset.attest.v1";
+    exports2.TOOLSET_ATTEST_STATEMENT = "this is the complete set of tools that can mutate a governed target";
+    var ENVELOPE_CLASSES = ["mutating", "readonly"];
+    var MAX_ENTRIES = 512;
+    var scalar = (v) => v == null ? "" : String(v);
+    var optional = (v) => v != null && String(v).length > 0 ? String(v) : "";
+    function b64url(buf) {
+      return buf.toString("base64url");
+    }
+    function sha256hex(s) {
+      return (0, node_crypto_1.createHash)("sha256").update(s, "utf8").digest("hex");
+    }
+    function toEnvelopeClass(cls) {
+      return cls === "readonly" ? "readonly" : "mutating";
+    }
+    function stableStringify(value) {
+      if (value === null || typeof value !== "object")
+        return JSON.stringify(value) ?? "null";
+      if (Array.isArray(value))
+        return "[" + value.map(stableStringify).join(",") + "]";
+      const obj = value;
+      const keys = Object.keys(obj).sort();
+      return "{" + keys.map((k) => JSON.stringify(k) + ":" + stableStringify(obj[k])).join(",") + "}";
+    }
+    function computeToolsetDigest(entries) {
+      if (!Array.isArray(entries))
+        return { ok: false, reason: "entries_not_array" };
+      if (entries.length === 0)
+        return { ok: false, reason: "entries_empty" };
+      if (entries.length > MAX_ENTRIES)
+        return { ok: false, reason: "entries_too_many" };
+      const seen = /* @__PURE__ */ new Set();
+      const rows = [];
+      for (const e of entries) {
+        if (!e || typeof e !== "object")
+          return { ok: false, reason: "entry_not_object" };
+        const name = e.name;
+        const cls = e.mutation_class;
+        const sd = e.input_schema_digest;
+        if (typeof name !== "string" || !name || name.length > 128)
+          return { ok: false, reason: "bad_entry_name" };
+        if (name.includes("|"))
+          return { ok: false, reason: "delimiter_in_entry_name" };
+        if (!ENVELOPE_CLASSES.includes(cls))
+          return { ok: false, reason: "bad_mutation_class" };
+        if (sd != null) {
+          if (typeof sd !== "string" || !sd.startsWith("sha256:") || sd.includes("|")) {
+            return { ok: false, reason: "bad_input_schema_digest" };
+          }
+        }
+        if (seen.has(name))
+          return { ok: false, reason: "duplicate_entry_name" };
+        seen.add(name);
+        rows.push([name, cls, sd == null ? "" : sd]);
+      }
+      rows.sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0);
+      const canonical = rows.map((r) => r.join(" ")).join("");
+      return {
+        ok: true,
+        digest: "sha256:" + sha256hex(canonical),
+        tool_count: rows.length,
+        mutating_count: rows.filter((r) => r[1] === "mutating").length
+      };
+    }
+    function declarationEntriesFromTools(tools) {
+      const out = [];
+      for (const t of tools) {
+        if (!t || typeof t.name !== "string" || !t.name)
+          continue;
+        const entry = {
+          name: t.name,
+          mutation_class: toEnvelopeClass(t._coderifts.mutationClass)
+        };
+        if (t.inputSchema !== void 0) {
+          entry.input_schema_digest = "sha256:" + sha256hex(stableStringify(t.inputSchema));
+        }
+        out.push(entry);
+      }
+      return out;
+    }
+    function toolsetAttestSigningInput(body) {
+      const parts = [
+        exports2.TOOLSET_ATTEST_SIGNING_PREFIX,
+        scalar(body.kid),
+        scalar(body.declarer),
+        scalar(body.statement),
+        scalar(body.set_digest),
+        scalar(body.declared_at),
+        optional(body.session_id),
+        optional(body.receipt_digest),
+        optional(body.framework),
+        optional(body.framework_version),
+        optional(body.guard_version),
+        body.tool_count == null ? "" : String(body.tool_count),
+        body.mutating_count == null ? "" : String(body.mutating_count),
+        optional(body.scope_note)
+      ];
+      return parts.join("|");
+    }
+    var SIGNED_STRING_FIELDS = [
+      "kid",
+      "declarer",
+      "statement",
+      "set_digest",
+      "declared_at",
+      "session_id",
+      "receipt_digest",
+      "scope_note",
+      "framework",
+      "framework_version",
+      "guard_version"
+    ];
+    function fieldHasDelimiter(body) {
+      for (const k of SIGNED_STRING_FIELDS) {
+        const v = body[k];
+        if (typeof v === "string" && v.includes("|"))
+          return true;
+      }
+      return false;
+    }
+    async function tryIssueToolsetAttestation(args) {
+      const cfg = args.config;
+      if (!cfg || typeof cfg.kid !== "string" || !cfg.kid || typeof cfg.signer !== "function") {
+        return void 0;
+      }
+      if (typeof cfg.declarer !== "string" || cfg.declarer.length === 0)
+        return void 0;
+      const hasFw = typeof cfg.framework === "string" && cfg.framework.length > 0;
+      const hasFwV = typeof cfg.frameworkVersion === "string" && cfg.frameworkVersion.length > 0;
+      if (hasFw !== hasFwV)
+        return void 0;
+      const tools = args.tools;
+      if (!Array.isArray(tools) || tools.length === 0)
+        return void 0;
+      const entries = declarationEntriesFromTools(tools);
+      const digest = computeToolsetDigest(entries);
+      if (!digest.ok)
+        return void 0;
+      const body = {
+        v: exports2.TOOLSET_ATTEST_VERSION,
+        kid: cfg.kid,
+        declarer: cfg.declarer,
+        statement: exports2.TOOLSET_ATTEST_STATEMENT,
+        set_digest: digest.digest,
+        declared_at: args.now || (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z"),
+        tool_count: digest.tool_count,
+        mutating_count: digest.mutating_count
+      };
+      if (typeof cfg.sessionId === "string" && cfg.sessionId)
+        body.session_id = cfg.sessionId;
+      if (typeof args.receiptDigest === "string" && args.receiptDigest)
+        body.receipt_digest = args.receiptDigest;
+      if (hasFw) {
+        body.framework = cfg.framework;
+        body.framework_version = cfg.frameworkVersion;
+      }
+      if (typeof args.guardVersion === "string" && args.guardVersion)
+        body.guard_version = args.guardVersion;
+      if (typeof args.scopeNote === "string" && args.scopeNote)
+        body.scope_note = args.scopeNote;
+      if (fieldHasDelimiter(body))
+        return void 0;
+      const input = Buffer.from(toolsetAttestSigningInput(body), "utf8");
+      let sig;
+      try {
+        sig = await cfg.signer(input);
+      } catch {
+        return void 0;
+      }
+      if (sig == null)
+        return void 0;
+      const sigBuf = Buffer.isBuffer(sig) ? sig : Buffer.from(sig);
+      if (sigBuf.length === 0)
+        return void 0;
+      return [
+        exports2.TOOLSET_ATTEST_ENVELOPE_TAG,
+        cfg.kid,
+        b64url(Buffer.from(JSON.stringify(body), "utf8")),
+        b64url(sigBuf)
+      ].join("|");
+    }
+    function kidFromToolsetAttestation(token) {
+      if (typeof token !== "string" || token.length === 0)
+        return null;
+      const parts = token.split("|");
+      if (parts.length !== 4 || parts[0] !== exports2.TOOLSET_ATTEST_ENVELOPE_TAG)
+        return null;
+      return parts[1] || null;
+    }
+  }
+});
+
 // node_modules/@coderifts/agent-guard/dist/cjs/index.js
 var require_cjs4 = __commonJS({
   "node_modules/@coderifts/agent-guard/dist/cjs/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.freshnessAllowsEnforce = exports2.computePathSetTreeHash = exports2.contentByteIdentical = exports2.assessWriteStylePrior = exports2.assessFreshness = exports2.deriveProofBanner = exports2.attachProofToAgentResponse = exports2.renderFinalAnswerProof = exports2.EXECUTION_PROOF_SPEC = exports2.assertEnforcedReceiptInvariant = exports2.hashExecutionResult = exports2.buildExecutionProof = exports2.DEFAULT_MONITORING_SINK_TIMEOUT_MS = exports2.ackBytes = exports2.verifyAckHmac = exports2.monitoringDeliveryFailClosed = exports2.formatMonitoringDeliveryLine = exports2.deliverMonitoring = exports2.hashObservedContent = exports2.observeCommit = exports2.deriveKeySignal = exports2.pathClass = exports2.classifyCommand = exports2.projectState = exports2.emptySessionState = exports2.computeTainted = exports2.evaluate = exports2.updateSession = exports2.SESSION_TAINT_VERSION = exports2.SessionTaintTracker = exports2.readDecision = exports2.EXECUTION_TIME_FP_REASONS = exports2.EXECUTION_STATE_UNMEASURABLE_NOTE = exports2.isUnmeasurableExecutionStateReason = exports2.computeCanonicalBundleFingerprint = exports2.authorizedFingerprintFromEnvelope = exports2.checkExecutionTimeFingerprint = exports2.computeBundleFingerprint = exports2.computeArtifactDigest = exports2.evaluateEnvelope = exports2.RECEIPT_PREV_NULL = exports2.decodeReceiptBodyPrev = exports2.previousReceiptCommitment = exports2.verifyReceiptChainLinkage = exports2.canonicalJson = exports2.computeBodyHash = exports2.bindReceiptToEnvelope = exports2.DETECTOR_VERSION = exports2.builtinDetector = exports2.guardToolCall = void 0;
-    exports2.RegistryConstructionError = exports2.guardToolRegistry = exports2.globToRegExp = exports2.matchGlob = exports2.blobMapKey = exports2.classifyByName = exports2.resolveArtifacts = exports2.REMEDIATION_LOOP_ATTESTATION_SPEC = exports2.isCasAttestation = exports2.readPriorBlockRemediation = exports2.readRemediationTransaction = exports2.buildRemediationLoopAttestation = exports2.CAS_ATTESTATION_SPEC = exports2.extractExecutorAttestationToken = exports2.evaluateCasEvidence = exports2.isExecuteIfUnchangedOutcome = exports2.isGuardExecutionProof = exports2.buildCasAttestation = exports2.REGISTRY_ABSENT_TOKEN = exports2.REGISTRY_VERSION_TOKEN_PREFIX = exports2.registryTokenRaw = exports2.writeRegistryIfUnchanged = exports2.createRegistryVersionToken = exports2.DB_ABSENT_TOKEN = exports2.DB_VERSION_TOKEN_PREFIX = exports2.dbTokenRaw = exports2.writeDbIfUnchanged = exports2.createDbVersionToken = exports2.API_ABSENT_TOKEN = exports2.API_VERSION_TOKEN_PREFIX = exports2.apiTokenRaw = exports2.writeApiIfUnchanged = exports2.createApiVersionToken = exports2.FS_ABSENT_TOKEN = exports2.FS_VERSION_TOKEN_PREFIX = exports2.fsTokenContentHash = exports2.createFsPriorContentResolver = exports2.writeFileIfUnchanged = exports2.readVersionedFile = exports2.createFsVersionToken = exports2.StaleVersionTokenAbort = exports2.executeIfUnchanged = exports2.RESIDUAL_UNCONDITIONAL_WRITE = exports2.conditionalWriteResidual = exports2.tokensEqual = exports2.buildConditionalWriteBasis = exports2.buildFreshnessBasis = exports2.collectFreshnessCallContext = exports2.artifactIdsForResolve = exports2.isWriteStyleCall = void 0;
-    exports2.executeLangGraphToolCall = exports2.executeGeminiToolCall = exports2.executeAnthropicToolCall = exports2.executeOpenAIToolCall = exports2.executeProtectedTool = exports2.defaultSerializeGeminiToolResult = exports2.bindGeminiGuardOutcome = exports2.protectedToolToFunctionDeclaration = exports2.toGeminiTools = exports2.geminiToolAdapter = exports2.withCodeRiftsGemini = exports2.defaultSerializeLangGraphToolResult = exports2.bindLangGraphGuardOutcome = exports2.protectedToolToLangGraph = exports2.toLangGraphTools = exports2.langGraphToolAdapter = exports2.withCodeRiftsLangGraph = exports2.defaultSerializeAnthropicToolResult = exports2.bindAnthropicGuardOutcome = exports2.protectedToolToAnthropic = exports2.toAnthropicTools = exports2.anthropicToolAdapter = exports2.withCodeRiftsAnthropic = exports2.defaultSerializeOpenAIToolResult = exports2.bindOpenAIGuardOutcome = exports2.protectedToolToOpenAI = exports2.toOpenAITools = exports2.openAIToolAdapter = exports2.withCodeRiftsOpenAI = exports2.guardedFractionAmongRoutes = exports2.foldTableSettledCalls = exports2.withCodeRifts = exports2.AUTO_DERIVE_READ_TIMEOUT_MS = exports2.AUTO_DERIVE_SOURCE = exports2.defaultFsReader = exports2.normalizeAutoDerive = exports2.runAutoDerive = exports2.AUTO_RECHECK_MAX_CAP = exports2.clampMaxAttempts = exports2.normalizeAutoRecheck = exports2.runAutoRecheckLoop = exports2.coverageReport = exports2.DEPLOY_REPAIRABLE_REASONS = exports2.bindDeploy = exports2.verifyDeployReceiptToken = exports2.DEPLOY_RECEIPT_VIEW_SPEC = exports2.isVerifiedDeployReceiptView = exports2.asVerifiedDeployReceiptView = exports2.deployGate = exports2.gateDecision = void 0;
-    exports2.surfaceEnvelopeFields = exports2.isGuardOutcome = void 0;
+    exports2.monitorAttestSigningInput = exports2.kidFromMonitoringAttestation = exports2.tryIssueMonitoringAttestation = exports2.DEFAULT_MONITORING_SINK_TIMEOUT_MS = exports2.ackBytes = exports2.verifyAckHmac = exports2.monitoringDeliveryFailClosed = exports2.formatMonitoringDeliveryLine = exports2.deliverMonitoring = exports2.hashObservedContent = exports2.observeCommit = exports2.deriveKeySignal = exports2.pathClass = exports2.classifyCommand = exports2.projectState = exports2.emptySessionState = exports2.computeTainted = exports2.evaluate = exports2.updateSession = exports2.SESSION_TAINT_VERSION = exports2.SessionTaintTracker = exports2.readDecision = exports2.EXECUTION_TIME_FP_REASONS = exports2.EXECUTION_STATE_UNMEASURABLE_NOTE = exports2.isUnmeasurableExecutionStateReason = exports2.computeCanonicalBundleFingerprint = exports2.authorizedFingerprintFromEnvelope = exports2.checkExecutionTimeFingerprint = exports2.computeBundleFingerprint = exports2.computeArtifactDigest = exports2.evaluateEnvelope = exports2.RECEIPT_PREV_NULL = exports2.decodeReceiptBodyPrev = exports2.previousReceiptCommitment = exports2.verifyReceiptChainLinkage = exports2.canonicalJson = exports2.computeBodyHash = exports2.bindReceiptToEnvelope = exports2.DETECTOR_VERSION = exports2.builtinDetector = exports2.resetPolicyWarnForTests = exports2.warnPolicyAbsentOnce = exports2.observePolicyPresence = exports2.detectPolicyPresence = exports2.policyPresenceOf = exports2.withPolicy = exports2.POLICY_ABSENT_WARN = exports2.POLICY_MARKER = exports2.CODERIFTS_POLICY = exports2.guardToolCall = void 0;
+    exports2.createRegistryVersionToken = exports2.DB_ABSENT_TOKEN = exports2.DB_VERSION_TOKEN_PREFIX = exports2.dbTokenRaw = exports2.writeDbIfUnchanged = exports2.createDbVersionToken = exports2.API_ABSENT_TOKEN = exports2.API_VERSION_TOKEN_PREFIX = exports2.apiTokenRaw = exports2.writeApiIfUnchanged = exports2.createApiVersionToken = exports2.FS_ABSENT_TOKEN = exports2.FS_VERSION_TOKEN_PREFIX = exports2.fsTokenContentHash = exports2.createFsPriorContentResolver = exports2.writeFileIfUnchanged = exports2.readVersionedFile = exports2.createFsVersionToken = exports2.StaleVersionTokenAbort = exports2.executeIfUnchanged = exports2.RESIDUAL_UNCONDITIONAL_WRITE = exports2.conditionalWriteResidual = exports2.tokensEqual = exports2.buildConditionalWriteBasis = exports2.buildFreshnessBasis = exports2.collectFreshnessCallContext = exports2.artifactIdsForResolve = exports2.isWriteStyleCall = exports2.freshnessAllowsEnforce = exports2.computePathSetTreeHash = exports2.contentByteIdentical = exports2.assessWriteStylePrior = exports2.assessFreshness = exports2.deriveProofBanner = exports2.attachProofToAgentResponse = exports2.renderFinalAnswerProof = exports2.EXECUTION_PROOF_SPEC = exports2.assertEnforcedReceiptInvariant = exports2.hashExecutionResult = exports2.buildExecutionProof = exports2.COVERAGE_ATTEST_ENVELOPE_TAG = exports2.COVERAGE_ATTEST_SIGNING_PREFIX = exports2.COVERAGE_ATTEST_VERSION = exports2.coverageAttestSigningInput = exports2.kidFromCoverageAttestation = exports2.tryIssueCoverageAttestation = exports2.MONITOR_ATTEST_ENVELOPE_TAG = exports2.MONITOR_ATTEST_SIGNING_PREFIX = exports2.MONITOR_ATTEST_VERSION = exports2.receiptDigestOfToken = void 0;
+    exports2.formatCoverageObservedLine = exports2.freezeCoverageObserved = exports2.createCoverageObserver = exports2.readExecutionGrantToken = exports2.isExecutionGrantEnabled = exports2.guardedFractionAmongRoutes = exports2.foldTableSettledCalls = exports2.withCodeRifts = exports2.AUTO_DERIVE_READ_TIMEOUT_MS = exports2.AUTO_DERIVE_SOURCE = exports2.defaultFsReader = exports2.normalizeAutoDerive = exports2.runAutoDerive = exports2.AUTO_RECHECK_MAX_CAP = exports2.clampMaxAttempts = exports2.normalizeAutoRecheck = exports2.runAutoRecheckLoop = exports2.coverageReport = exports2.DEPLOY_REPAIRABLE_REASONS = exports2.bindDeploy = exports2.verifyDeployReceiptToken = exports2.DEPLOY_RECEIPT_VIEW_SPEC = exports2.isVerifiedDeployReceiptView = exports2.asVerifiedDeployReceiptView = exports2.deployGate = exports2.gateDecision = exports2.RegistryConstructionError = exports2.guardToolRegistry = exports2.globToRegExp = exports2.matchGlob = exports2.blobMapKey = exports2.classifyByName = exports2.resolveArtifacts = exports2.REMEDIATION_LOOP_ATTESTATION_SPEC = exports2.isCasAttestation = exports2.readPriorBlockRemediation = exports2.readRemediationTransaction = exports2.buildRemediationLoopAttestation = exports2.COMMIT_EVIDENCE_MISSING = exports2.CAS_ATTESTATION_SPEC = exports2.strictCommitObservation = exports2.extractExecutorAttestationToken = exports2.evaluateCasEvidence = exports2.isExecuteIfUnchangedOutcome = exports2.isGuardExecutionProof = exports2.buildCasAttestation = exports2.REGISTRY_ABSENT_TOKEN = exports2.REGISTRY_VERSION_TOKEN_PREFIX = exports2.registryTokenRaw = exports2.writeRegistryIfUnchanged = void 0;
+    exports2.kidFromToolsetAttestation = exports2.tryIssueToolsetAttestation = exports2.toolsetAttestSigningInput = exports2.declarationEntriesFromTools = exports2.computeToolsetDigest = exports2.TOOLSET_ATTEST_STATEMENT = exports2.TOOLSET_ATTEST_ENVELOPE_TAG = exports2.TOOLSET_ATTEST_SIGNING_PREFIX = exports2.TOOLSET_ATTEST_VERSION = exports2.surfaceEnvelopeFields = exports2.isGuardOutcome = exports2.executeLangGraphToolCall = exports2.executeGeminiToolCall = exports2.executeAnthropicToolCall = exports2.executeOpenAIToolCall = exports2.executeProtectedTool = exports2.defaultSerializeGeminiToolResult = exports2.bindGeminiGuardOutcome = exports2.protectedToolToFunctionDeclaration = exports2.toGeminiTools = exports2.geminiToolAdapter = exports2.withCodeRiftsGemini = exports2.wrapWriteWithFsCas = exports2.inferFullFileWriteContent = exports2.inferFsPathFromArgs = exports2.FRESHNESS_RESOLVER_FIX = exports2.freshnessRefusalTeaching = exports2.formatGateRefusalBody = exports2.defaultSerializeLangGraphToolResult = exports2.bindLangGraphGuardOutcome = exports2.LangGraphToolsNotStructuredError = exports2.isLangGraphReactAgentTool = exports2.bindLangGraphTools = exports2.protectedToolToLangGraph = exports2.toLangGraphTools = exports2.langGraphToolAdapter = exports2.withCodeRiftsLangGraph = exports2.defaultSerializeAnthropicToolResult = exports2.bindAnthropicGuardOutcome = exports2.protectedToolToAnthropic = exports2.toAnthropicTools = exports2.anthropicToolAdapter = exports2.withCodeRiftsAnthropic = exports2.defaultSerializeOpenAIToolResult = exports2.bindOpenAIGuardOutcome = exports2.protectedToolToOpenAI = exports2.toOpenAITools = exports2.openAIToolAdapter = exports2.withCodeRiftsOpenAI = void 0;
     var guard_js_1 = require_guard();
     Object.defineProperty(exports2, "guardToolCall", { enumerable: true, get: function() {
       return guard_js_1.guardToolCall;
     } });
+    var policy_js_1 = require_policy2();
+    Object.defineProperty(exports2, "CODERIFTS_POLICY", { enumerable: true, get: function() {
+      return policy_js_1.CODERIFTS_POLICY;
+    } });
+    Object.defineProperty(exports2, "POLICY_MARKER", { enumerable: true, get: function() {
+      return policy_js_1.POLICY_MARKER;
+    } });
+    Object.defineProperty(exports2, "POLICY_ABSENT_WARN", { enumerable: true, get: function() {
+      return policy_js_1.POLICY_ABSENT_WARN;
+    } });
+    Object.defineProperty(exports2, "withPolicy", { enumerable: true, get: function() {
+      return policy_js_1.withPolicy;
+    } });
+    Object.defineProperty(exports2, "policyPresenceOf", { enumerable: true, get: function() {
+      return policy_js_1.policyPresenceOf;
+    } });
+    Object.defineProperty(exports2, "detectPolicyPresence", { enumerable: true, get: function() {
+      return policy_js_1.detectPolicyPresence;
+    } });
+    Object.defineProperty(exports2, "observePolicyPresence", { enumerable: true, get: function() {
+      return policy_js_1.observePolicyPresence;
+    } });
+    Object.defineProperty(exports2, "warnPolicyAbsentOnce", { enumerable: true, get: function() {
+      return policy_js_1.warnPolicyAbsentOnce;
+    } });
+    Object.defineProperty(exports2, "resetPolicyWarnForTests", { enumerable: true, get: function() {
+      return policy_js_1.resetPolicyWarnForTests;
+    } });
     var detector_js_1 = require_detector();
     Object.defineProperty(exports2, "builtinDetector", { enumerable: true, get: function() {
       return detector_js_1.builtinDetector;
@@ -73957,6 +75426,47 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "DEFAULT_MONITORING_SINK_TIMEOUT_MS", { enumerable: true, get: function() {
       return monitoring_delivery_js_1.DEFAULT_MONITORING_SINK_TIMEOUT_MS;
     } });
+    var monitoring_attestation_js_1 = require_monitoring_attestation2();
+    Object.defineProperty(exports2, "tryIssueMonitoringAttestation", { enumerable: true, get: function() {
+      return monitoring_attestation_js_1.tryIssueMonitoringAttestation;
+    } });
+    Object.defineProperty(exports2, "kidFromMonitoringAttestation", { enumerable: true, get: function() {
+      return monitoring_attestation_js_1.kidFromMonitoringAttestation;
+    } });
+    Object.defineProperty(exports2, "monitorAttestSigningInput", { enumerable: true, get: function() {
+      return monitoring_attestation_js_1.monitorAttestSigningInput;
+    } });
+    Object.defineProperty(exports2, "receiptDigestOfToken", { enumerable: true, get: function() {
+      return monitoring_attestation_js_1.receiptDigestOfToken;
+    } });
+    Object.defineProperty(exports2, "MONITOR_ATTEST_VERSION", { enumerable: true, get: function() {
+      return monitoring_attestation_js_1.MONITOR_ATTEST_VERSION;
+    } });
+    Object.defineProperty(exports2, "MONITOR_ATTEST_SIGNING_PREFIX", { enumerable: true, get: function() {
+      return monitoring_attestation_js_1.MONITOR_ATTEST_SIGNING_PREFIX;
+    } });
+    Object.defineProperty(exports2, "MONITOR_ATTEST_ENVELOPE_TAG", { enumerable: true, get: function() {
+      return monitoring_attestation_js_1.MONITOR_ATTEST_ENVELOPE_TAG;
+    } });
+    var coverage_attestation_js_1 = require_coverage_attestation();
+    Object.defineProperty(exports2, "tryIssueCoverageAttestation", { enumerable: true, get: function() {
+      return coverage_attestation_js_1.tryIssueCoverageAttestation;
+    } });
+    Object.defineProperty(exports2, "kidFromCoverageAttestation", { enumerable: true, get: function() {
+      return coverage_attestation_js_1.kidFromCoverageAttestation;
+    } });
+    Object.defineProperty(exports2, "coverageAttestSigningInput", { enumerable: true, get: function() {
+      return coverage_attestation_js_1.coverageAttestSigningInput;
+    } });
+    Object.defineProperty(exports2, "COVERAGE_ATTEST_VERSION", { enumerable: true, get: function() {
+      return coverage_attestation_js_1.COVERAGE_ATTEST_VERSION;
+    } });
+    Object.defineProperty(exports2, "COVERAGE_ATTEST_SIGNING_PREFIX", { enumerable: true, get: function() {
+      return coverage_attestation_js_1.COVERAGE_ATTEST_SIGNING_PREFIX;
+    } });
+    Object.defineProperty(exports2, "COVERAGE_ATTEST_ENVELOPE_TAG", { enumerable: true, get: function() {
+      return coverage_attestation_js_1.COVERAGE_ATTEST_ENVELOPE_TAG;
+    } });
     var execution_proof_js_1 = require_execution_proof();
     Object.defineProperty(exports2, "buildExecutionProof", { enumerable: true, get: function() {
       return execution_proof_js_1.buildExecutionProof;
@@ -74113,9 +75623,15 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "extractExecutorAttestationToken", { enumerable: true, get: function() {
       return cas_attestation_js_1.extractExecutorAttestationToken;
     } });
+    Object.defineProperty(exports2, "strictCommitObservation", { enumerable: true, get: function() {
+      return cas_attestation_js_1.strictCommitObservation;
+    } });
     Object.defineProperty(exports2, "CAS_ATTESTATION_SPEC", { enumerable: true, get: function() {
       return cas_attestation_js_1.CAS_ATTESTATION_SPEC;
     } });
+    Object.defineProperty(exports2, "COMMIT_EVIDENCE_MISSING", { enumerable: true, get: function() {
+      return cas_attestation_js_1.COMMIT_EVIDENCE_MISSING;
+    } });
     var remediation_loop_attestation_js_1 = require_remediation_loop_attestation();
     Object.defineProperty(exports2, "buildRemediationLoopAttestation", { enumerable: true, get: function() {
       return remediation_loop_attestation_js_1.buildRemediationLoopAttestation;
@@ -74227,6 +75743,23 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "guardedFractionAmongRoutes", { enumerable: true, get: function() {
       return with_coderifts_js_1.guardedFractionAmongRoutes;
     } });
+    var execution_grant_js_1 = require_execution_grant2();
+    Object.defineProperty(exports2, "isExecutionGrantEnabled", { enumerable: true, get: function() {
+      return execution_grant_js_1.isExecutionGrantEnabled;
+    } });
+    Object.defineProperty(exports2, "readExecutionGrantToken", { enumerable: true, get: function() {
+      return execution_grant_js_1.readExecutionGrantToken;
+    } });
+    var coverage_observed_js_1 = require_coverage_observed();
+    Object.defineProperty(exports2, "createCoverageObserver", { enumerable: true, get: function() {
+      return coverage_observed_js_1.createCoverageObserver;
+    } });
+    Object.defineProperty(exports2, "freezeCoverageObserved", { enumerable: true, get: function() {
+      return coverage_observed_js_1.freezeCoverageObserved;
+    } });
+    Object.defineProperty(exports2, "formatCoverageObservedLine", { enumerable: true, get: function() {
+      return coverage_observed_js_1.formatCoverageObservedLine;
+    } });
     var openai_js_1 = require_openai();
     Object.defineProperty(exports2, "withCodeRiftsOpenAI", { enumerable: true, get: function() {
       return openai_js_1.withCodeRiftsOpenAI;
@@ -74278,12 +75811,41 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "protectedToolToLangGraph", { enumerable: true, get: function() {
       return langgraph_js_1.protectedToolToLangGraph;
     } });
+    Object.defineProperty(exports2, "bindLangGraphTools", { enumerable: true, get: function() {
+      return langgraph_js_1.bindLangGraphTools;
+    } });
+    Object.defineProperty(exports2, "isLangGraphReactAgentTool", { enumerable: true, get: function() {
+      return langgraph_js_1.isLangGraphReactAgentTool;
+    } });
+    Object.defineProperty(exports2, "LangGraphToolsNotStructuredError", { enumerable: true, get: function() {
+      return langgraph_js_1.LangGraphToolsNotStructuredError;
+    } });
     Object.defineProperty(exports2, "bindLangGraphGuardOutcome", { enumerable: true, get: function() {
       return langgraph_js_1.bindLangGraphGuardOutcome;
     } });
     Object.defineProperty(exports2, "defaultSerializeLangGraphToolResult", { enumerable: true, get: function() {
       return langgraph_js_1.defaultSerializeLangGraphToolResult;
     } });
+    var gate_refusal_js_1 = require_gate_refusal();
+    Object.defineProperty(exports2, "formatGateRefusalBody", { enumerable: true, get: function() {
+      return gate_refusal_js_1.formatGateRefusalBody;
+    } });
+    Object.defineProperty(exports2, "freshnessRefusalTeaching", { enumerable: true, get: function() {
+      return gate_refusal_js_1.freshnessRefusalTeaching;
+    } });
+    Object.defineProperty(exports2, "FRESHNESS_RESOLVER_FIX", { enumerable: true, get: function() {
+      return gate_refusal_js_1.FRESHNESS_RESOLVER_FIX;
+    } });
+    var fs_default_wire_js_1 = require_fs_default_wire();
+    Object.defineProperty(exports2, "inferFsPathFromArgs", { enumerable: true, get: function() {
+      return fs_default_wire_js_1.inferFsPathFromArgs;
+    } });
+    Object.defineProperty(exports2, "inferFullFileWriteContent", { enumerable: true, get: function() {
+      return fs_default_wire_js_1.inferFullFileWriteContent;
+    } });
+    Object.defineProperty(exports2, "wrapWriteWithFsCas", { enumerable: true, get: function() {
+      return fs_default_wire_js_1.wrapWriteWithFsCas;
+    } });
     var gemini_js_1 = require_gemini();
     Object.defineProperty(exports2, "withCodeRiftsGemini", { enumerable: true, get: function() {
       return gemini_js_1.withCodeRiftsGemini;
@@ -74325,6 +75887,34 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "surfaceEnvelopeFields", { enumerable: true, get: function() {
       return execute_tool_call_js_1.surfaceEnvelopeFields;
     } });
+    var toolset_attestation_js_1 = require_toolset_attestation();
+    Object.defineProperty(exports2, "TOOLSET_ATTEST_VERSION", { enumerable: true, get: function() {
+      return toolset_attestation_js_1.TOOLSET_ATTEST_VERSION;
+    } });
+    Object.defineProperty(exports2, "TOOLSET_ATTEST_SIGNING_PREFIX", { enumerable: true, get: function() {
+      return toolset_attestation_js_1.TOOLSET_ATTEST_SIGNING_PREFIX;
+    } });
+    Object.defineProperty(exports2, "TOOLSET_ATTEST_ENVELOPE_TAG", { enumerable: true, get: function() {
+      return toolset_attestation_js_1.TOOLSET_ATTEST_ENVELOPE_TAG;
+    } });
+    Object.defineProperty(exports2, "TOOLSET_ATTEST_STATEMENT", { enumerable: true, get: function() {
+      return toolset_attestation_js_1.TOOLSET_ATTEST_STATEMENT;
+    } });
+    Object.defineProperty(exports2, "computeToolsetDigest", { enumerable: true, get: function() {
+      return toolset_attestation_js_1.computeToolsetDigest;
+    } });
+    Object.defineProperty(exports2, "declarationEntriesFromTools", { enumerable: true, get: function() {
+      return toolset_attestation_js_1.declarationEntriesFromTools;
+    } });
+    Object.defineProperty(exports2, "toolsetAttestSigningInput", { enumerable: true, get: function() {
+      return toolset_attestation_js_1.toolsetAttestSigningInput;
+    } });
+    Object.defineProperty(exports2, "tryIssueToolsetAttestation", { enumerable: true, get: function() {
+      return toolset_attestation_js_1.tryIssueToolsetAttestation;
+    } });
+    Object.defineProperty(exports2, "kidFromToolsetAttestation", { enumerable: true, get: function() {
+      return toolset_attestation_js_1.kidFromToolsetAttestation;
+    } });
   }
 });
 
@@ -202426,7 +204016,7 @@ var require_clock_skew_leeway = __commonJS({
 });
 
 // ../../src/verdict-core/execution-grant.js
-var require_execution_grant2 = __commonJS({
+var require_execution_grant3 = __commonJS({
   "../../src/verdict-core/execution-grant.js"(exports2, module2) {
     "use strict";
     var crypto = require("node:crypto");
@@ -203700,7 +205290,7 @@ var require_change_set = __commonJS({
           const {
             issueExecutionGrant,
             afterPayloadCanonical
-          } = require_execution_grant2();
+          } = require_execution_grant3();
           const grantTarget = nonEmptyStr(context.target_id) || artifactDigest;
           const stateNonce = typeof input.state_nonce === "string" && input.state_nonce.length > 0 ? input.state_nonce : null;
           executionGrant = issueExecutionGrant({
@@ -210176,6 +211766,20 @@ var require_mcp_repo_config = __commonJS({
   }
 });
 
+// src/generated/gate-pin.json
+var require_gate_pin = __commonJS({
+  "src/generated/gate-pin.json"(exports2, module2) {
+    module2.exports = {
+      repo: "coderifts/contract-gate",
+      sha: "e5b6315e38c66a2274583ddf4d7be11515180326",
+      tag: "v0.5.0",
+      resolved_from: "https://github.com/coderifts/contract-gate refs/tags/v0",
+      resolved_at: "2026-08-26T08:37:01Z",
+      note: "STRICT template pins this full commit SHA (GitHub: only a full SHA is immutable). v0 is a tag we move on every release, so it is NOT a pin. Re-run scripts/generate-gate-pin.js on each gate release; Dependabot bumps adopters."
+    };
+  }
+});
+
 // src/contract-gate-workflow.js
 var require_contract_gate_workflow = __commonJS({
   "src/contract-gate-workflow.js"(exports2, module2) {
@@ -210184,6 +211788,13 @@ var require_contract_gate_workflow = __commonJS({
     var path = require("path");
     var WORKFLOW_REL = ".github/workflows/coderifts.yml";
     var GATE_ACTION = "coderifts/contract-gate@v0";
+    var GATE_PIN = require_gate_pin();
+    if (typeof GATE_PIN.sha !== "string" || !/^[0-9a-f]{40}$/.test(GATE_PIN.sha)) {
+      throw new Error(
+        "contract-gate-workflow: generated/gate-pin.json carries no valid 40-hex sha \u2014 re-run scripts/generate-gate-pin.js. Refusing to emit an unpinned STRICT workflow."
+      );
+    }
+    var GATE_ACTION_STRICT = `coderifts/contract-gate@${GATE_PIN.sha}` + (GATE_PIN.tag ? ` # ${GATE_PIN.tag}` : " # (no semver tag shares this commit)");
     var ENFORCEMENT_DOC = "https://github.com/coderifts/contract-gate/blob/main/ENFORCEMENT.md";
     var WORKFLOW_BODY = `# Written by \`coderifts init --agents\`. Re-run is a no-op when this file already exists.
 #
@@ -210193,6 +211804,10 @@ var require_contract_gate_workflow = __commonJS({
 # Turn the check on in repo settings to enforce (${ENFORCEMENT_DOC}).
 #
 # Copied from the gate repo example (examples/contract-gate.yml) \u2014 action at @v0.
+# @v0 is a MOVING tag on purpose: this default template trades immutability for easy updates,
+# so you get gate fixes without editing this file. It is NOT a security pin. If you need one,
+# use \`coderifts init --agents --strict\`, which pins a full commit SHA. Do not "fix" this to a
+# SHA and do not "fix" strict back to a tag \u2014 the difference is deliberate.
 name: CodeRifts Contract Gate
 
 # Run on EVERY pull request. Do NOT add paths: filters \u2014 a required check that
@@ -210226,13 +211841,16 @@ jobs:
 `;
     var STRICT_WORKFLOW_BODY = `# Written by \`coderifts init --agents --strict\`. Re-run is a no-op when this file already exists.
 #
-# STRICT template: require-verified-monitoring is ON.
+# STRICT template: require-verified-monitoring is ON, and the action is pinned to a FULL COMMIT
+# SHA. GitHub: only a full commit SHA is immutable. \`@v0\` is a tag CodeRifts moves on every
+# release, so it is not a pin \u2014 the default (non-strict) template stays on \`@v0\` on purpose,
+# because easy updates are the point there. Do not "fix" the difference. Dependabot bumps this SHA.
 # This workflow POSTS the Check Run named exactly:
 #   CodeRifts / contract-gate
 # It does NOT enable branch protection and it does NOT make that check required.
 # Turn the check on in repo settings to enforce (${ENFORCEMENT_DOC}).
 #
-# Copied from the gate repo example (examples/contract-gate.yml) \u2014 action at @v0.
+# Copied from the gate repo example (examples/contract-gate.yml) \u2014 action pinned to a full SHA.
 name: CodeRifts Contract Gate
 
 # Run on EVERY pull request. Do NOT add paths: filters \u2014 a required check that
@@ -210253,7 +211871,7 @@ jobs:
           # REQUIRED: the gate derives the change set from git diff base...head.
           fetch-depth: 0
 
-      - uses: ${GATE_ACTION}
+      - uses: ${GATE_ACTION_STRICT}
         with:
           api-key: \${{ secrets.CODERIFTS_API_KEY }}
           # api-url: https://app.coderifts.com   # override only for self-hosted
@@ -210307,6 +211925,8 @@ jobs:
       WORKFLOW_BODY,
       STRICT_WORKFLOW_BODY,
       GATE_ACTION,
+      GATE_ACTION_STRICT,
+      GATE_PIN,
       ENFORCEMENT_DOC,
       writeContractGateWorkflow,
       workflowPresent