coderifts 4.11.0 → 5.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coderifts",
-  "version": "4.11.0",
+  "version": "5.0.0",
   "description": "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
   "author": "CodeRifts <hello@coderifts.com>",
   "license": "MIT",
@@ -45,7 +45,7 @@
     "test": "node --test test/*.test.js"
   },
   "dependencies": {
-    "@coderifts/agent-guard": "^9.0.0",
+    "@coderifts/agent-guard": "^11.0.0",
     "chalk": "^4.1.2",
     "cli-table3": "^0.6.4",
     "commander": "^12.0.0",

package/scripts/assert-guard-major.js

@@ -12,15 +12,98 @@
  * Why: evening audit 2.4 — CLI sat on ^1.6.0 while published guard is 6.x.
  * 4.0.0: floor raised to 8 (deployGate inescapable_deploy includes fingerprint rebound).
  * 4.4.1: floor raised to 9 (TOKEN / VERIFIED-VIEW; bare currently_authorized is unverified_receipt_view).
+ * 4.12.0: floor raised to 10 (ENFORCING_STRICT requires the execution chain — a strict
+ *   composition that built under 9.x refuses to construct under 10.x, so a CLI that documents or
+ *   scaffolds strict must not run against a guard with the older meaning).
+ * 4.13.0: floor raised to 11 (computeBundleFingerprint returned a WRONG digest in 10.x — it
+ *   omitted the artifact count and the whole context block, so on identical inputs it produced
+ *   sha256:1a0e7470… where the server produced sha256:049650f2…; 11.0.0 delegates to the single
+ *   canonical crbundle.v1 preimage and matches byte for byte. COST MEASURED AS ZERO, the same way
+ *   the 10-raise was: the CLI imports only deployGate, asVerifiedDeployReceiptView,
+ *   DEPLOY_RECEIPT_VIEW_SPEC and matchGlob, none of which 11.0.0 touched, and the suite staged
+ *   against 11.0.0 returned an identical 532/530/2 with a byte-identical failure set. The floor
+ *   rises anyway, because a semantics floor is about what the CLI may RUN against, not about what
+ *   it happens to import today — a fingerprint that disagrees with the server is exactly the class
+ *   of difference this gate exists to refuse.)
  */
 
 const fs = require('fs');
 const path = require('path');
 
-/** Minimum acceptable major for @coderifts/agent-guard (published line). */
-const MIN_GUARD_MAJOR = 9;
+/** Minimum acceptable major for @coderifts/agent-guard in THIS package (the CLI). */
+const MIN_GUARD_MAJOR = 11;
 const DEP = '@coderifts/agent-guard';
 
+/**
+ * EVERY checkout that declares the guard — not just this one (roadmap 1058).
+ *
+ * WHY THIS TABLE EXISTS: this gate checked packages/cli only, while the app ROOT — where
+ * PRODUCTION uses the guard (src/mergegate/webhook-integration.js imports gateDecision) — sat on
+ * ^3.0.0 against a published 10.0.0. A seven-major gap survived precisely because the gate did not
+ * look there. A gate that inspects one of two call sites is not a gate.
+ *
+ * ONE FILE, PER-CHECKOUT FLOORS — chosen over a separate sibling check so there is ONE history
+ * section to record the next raise in. Two files would mean two floors with no structural reason
+ * they are ever raised together, which is the drift that produced this finding.
+ *
+ * Floors differ ON PURPOSE. A single shared floor would fail immediately and truthfully, but the
+ * fix for that is a dependency bump this gate must not force: see the app-root entry.
+ */
+const CHECKOUTS = [
+  {
+    id: 'cli',
+    label: 'packages/cli',
+    pkgPath: path.join(__dirname, '..', 'package.json'),
+    floor: MIN_GUARD_MAJOR,
+    why: 'CLI floor history is recorded in the module docblock above.',
+  },
+  {
+    id: 'app-root',
+    label: 'coderifts-app (root)',
+    pkgPath: path.join(__dirname, '..', '..', '..', 'package.json'),
+    floor: 3,
+    /**
+     * DELIBERATE, MEASURED, AND LOWER THAN THE CLI'S — recorded so it is a decision, not a default.
+     *
+     * 2026-08-26: bumping the root to ^10 breaks three merge-gate tests
+     * (test/mergegate-webhook.test.js: 46/46 on 3.0.0, 43/46 on 10.x). The app's own comment at
+     * webhook-integration.js:336-339 records why 3.x has been SAFE rather than merely unnoticed:
+     * the app ANDs three conditions (protection_inescapable && change_set_rebound && app_bound) so
+     * a stale package can never fail-open. That AND is load-bearing — measured against 3.0.0,
+     * gateDecision claims inescapable_merge:true even when required_check_app_bound is false or
+     * absent; the published claim is correct only because the app re-derives it.
+     *
+     * RE-MEASURED 2026-08-26 against 11.0.0, and TWO THINGS IN THE OLD NOTE WERE WRONG:
+     *
+     *  1. It said 10.0.0 "returns residuals: []". It does not. Given the correct input shape it
+     *     returns ['required_check_app_not_bound'] / ['required_check_app_binding_unknown'] — the
+     *     app's own vocabulary. The earlier reading passed protection.enforcement_state; the field
+     *     the gate reads is protection.enforcement, so the gate saw no protection at all.
+     *  2. The real difference is PRECEDENCE, not absence. The guard emits exactly ONE residual and
+     *     short-circuits on the enforcement gap, so where two gaps hold at once it reports
+     *     'admin_bypass_open' and the app expects 'required_check_app_binding_unknown'. The app's
+     *     collectBindingResiduals emits EVERY residual that holds — its docstring says so: "the
+     *     pure gate's published shape is a single honesty slot ... the second was suppressed".
+     *     That is why the app duplicates rather than consumes, and it is the whole reconciliation.
+     *
+     * 11.0.0 vs 10.0.0: NO CHANGE. Residual output is byte-identical across all three app-binding
+     * cases, and 11.0.0 touched only computeBundleFingerprint, which this path does not import. So
+     * 11 makes the bump neither easier nor harder — the blocker is unchanged and the deferral still
+     * holds for exactly the reason above, not for a residual shape that moved.
+     *
+     * WHAT THE BUMP ROUND MUST DECIDE: whether the guard should emit all holding residuals (then
+     * the app consumes gateOut.residuals and collectBindingResiduals is deleted), or whether the
+     * single-slot shape is deliberate (then the app keeps its collector and the duplication is
+     * documented as intended rather than left looking accidental). Do not bump before that choice.
+     *
+     * So the floor is pinned at 3 to stop it drifting LOWER unnoticed. Raise this number in that
+     * round and record the reason on the line below, in the style of the CLI history above.
+     */
+    why: 'root pinned at 3 pending the gateDecision residual-PRECEDENCE reconciliation (see comment; '
+      + 're-measured against 11.0.0 — unchanged from 10.0.0).',
+  },
+];
+
 function fail(msg) {
   console.error(`assert-guard-major: FAIL — ${msg}`);
   process.exit(1);
@@ -47,81 +130,80 @@ function floorMajorFromRange(range) {
   return parseInt(m[1], 10);
 }
 
-function main() {
-  const pkgPath = path.join(__dirname, '..', 'package.json');
-  const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+/** Resolve the installed guard version for a checkout dir, or null. */
+function resolvedVersionFor(startDir) {
+  try {
+    let dir = path.dirname(require.resolve(DEP, { paths: [startDir] }));
+    for (let i = 0; i < 6; i += 1) {
+      const cand = path.join(dir, 'package.json');
+      if (fs.existsSync(cand)) {
+        const rp = JSON.parse(fs.readFileSync(cand, 'utf8'));
+        if (rp.name === DEP) return rp.version;
+      }
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  } catch (_) { /* not installed here */ }
+  return null;
+}
+
+/** Check ONE checkout. Returns a line for the summary; calls fail() and exits on a violation. */
+function checkCheckout(c) {
+  if (!fs.existsSync(c.pkgPath)) {
+    fail(`${c.label}: package.json not found at ${c.pkgPath}`);
+  }
+  const pkg = JSON.parse(fs.readFileSync(c.pkgPath, 'utf8'));
   const range = pkg.dependencies && pkg.dependencies[DEP];
-  if (!range) fail(`${DEP} missing from dependencies`);
+  if (!range) fail(`${c.label}: ${DEP} missing from dependencies`);
 
   const floor = floorMajorFromRange(range);
   if (floor == null) {
     fail(
-      `${DEP} range ${JSON.stringify(range)} has no parseable major floor `
-      + `(wildcards/non-semver not allowed; need e.g. ^${MIN_GUARD_MAJOR}.0.0)`,
+      `${c.label}: ${DEP} range ${JSON.stringify(range)} has no parseable major floor `
+      + `(wildcards/non-semver not allowed; need e.g. ^${c.floor}.0.0)`,
     );
   }
-  if (floor < MIN_GUARD_MAJOR) {
+  if (floor < c.floor) {
     fail(
-      `${DEP} range ${JSON.stringify(range)} floors at major ${floor}; `
-      + `minimum acceptable major is ${MIN_GUARD_MAJOR}`,
+      `${c.label}: ${DEP} range ${JSON.stringify(range)} floors at major ${floor}; `
+      + `minimum acceptable major for this checkout is ${c.floor} — ${c.why}`,
     );
   }
 
-  // Optional: resolved install must not lag the declared floor (stale node_modules).
-  try {
-    const resolved = require(path.join(
-      path.dirname(require.resolve(`${DEP}`)),
-      // package root: require('@coderifts/agent-guard') → dist/cjs/index.js
-      '..',
-      '..',
-      'package.json',
-    ));
-    // From dist/cjs → package root is ../..
-  } catch (_) {
-    // try alternate resolve
+  const resolved = resolvedVersionFor(path.dirname(c.pkgPath));
+  if (!resolved) {
+    return `${c.label}: declared ${range} (floor ${floor} >= ${c.floor}); not resolved in tree`;
   }
-
-  let resolvedVersion = null;
-  try {
-    // Walk up from the main entry to package.json (exports block ./package.json).
-    let dir = path.dirname(require.resolve(DEP));
-    for (let i = 0; i < 6; i++) {
-      const cand = path.join(dir, 'package.json');
-      if (fs.existsSync(cand)) {
-        const rp = JSON.parse(fs.readFileSync(cand, 'utf8'));
-        if (rp.name === DEP) {
-          resolvedVersion = rp.version;
-          break;
-        }
-      }
-      const parent = path.dirname(dir);
-      if (parent === dir) break;
-      dir = parent;
-    }
-  } catch (err) {
-    // Not installed — range check alone is enough for prepublish if install follows.
-    ok(`declared ${DEP}@${range} (floor major ${floor} ≥ ${MIN_GUARD_MAJOR}); package not resolved in tree (${err && err.message})`);
-    return;
+  const rm = /^(\d+)/.exec(resolved);
+  const rMajor = rm ? parseInt(rm[1], 10) : null;
+  if (rMajor == null || rMajor < c.floor) {
+    fail(`${c.label}: resolved ${DEP}@${resolved} major ${rMajor} is below minimum ${c.floor}`);
   }
-
-  if (resolvedVersion) {
-    const rm = /^(\d+)/.exec(resolvedVersion);
-    const rMajor = rm ? parseInt(rm[1], 10) : null;
-    if (rMajor == null || rMajor < MIN_GUARD_MAJOR) {
-      fail(
-        `resolved ${DEP}@${resolvedVersion} major ${rMajor} is below minimum ${MIN_GUARD_MAJOR}`,
-      );
-    }
-    if (rMajor < floor) {
-      fail(
-        `resolved ${DEP}@${resolvedVersion} major ${rMajor} is below declared range floor ${floor}`,
-      );
-    }
-    ok(`declared ${DEP}@${range} (floor ${floor}); resolved ${resolvedVersion} (major ≥ ${MIN_GUARD_MAJOR})`);
-    return;
+  if (rMajor < floor) {
+    fail(`${c.label}: resolved ${DEP}@${resolved} major ${rMajor} is below declared range floor ${floor}`);
   }
+  return `${c.label}: declared ${range} (floor ${floor} >= ${c.floor}); resolved ${resolved}`;
+}
 
-  ok(`declared ${DEP}@${range} (floor major ${floor} ≥ ${MIN_GUARD_MAJOR})`);
+function main() {
+  const lines = CHECKOUTS.map(checkCheckout);
+  for (const l of lines) ok(l);
+
+  // DIVERGENCE NOTICE — visible, never fatal. The floors differ deliberately (see CHECKOUTS), so
+  // failing here would block a publish over a state we chose. Printing it keeps the gap from
+  // going quiet again, which is how it survived seven majors.
+  const floors = CHECKOUTS.map((c) => c.floor);
+  if (new Set(floors).size > 1) {
+    console.log(
+      `assert-guard-major: NOTE — checkout floors differ (${CHECKOUTS.map((c) => `${c.id}=${c.floor}`).join(', ')}). `
+      + 'Deliberate; each reason is recorded in CHECKOUTS. Not a failure.',
+    );
+  }
 }
 
-main();
+// Run only when executed directly, so the gate's own tests can import CHECKOUTS /
+// floorMajorFromRange without triggering a process.exit.
+if (require.main === module) main();
+
+module.exports = { CHECKOUTS, floorMajorFromRange, MIN_GUARD_MAJOR, DEP };