coderifts 4.12.0 → 5.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coderifts",
-  "version": "4.12.0",
+  "version": "5.0.0",
   "description": "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
   "author": "CodeRifts <hello@coderifts.com>",
   "license": "MIT",
@@ -45,7 +45,7 @@
     "test": "node --test test/*.test.js"
   },
   "dependencies": {
-    "@coderifts/agent-guard": "^10.0.0",
+    "@coderifts/agent-guard": "^11.0.0",
     "chalk": "^4.1.2",
     "cli-table3": "^0.6.4",
     "commander": "^12.0.0",

package/scripts/assert-guard-major.js

@@ -15,13 +15,23 @@
  * 4.12.0: floor raised to 10 (ENFORCING_STRICT requires the execution chain — a strict
  *   composition that built under 9.x refuses to construct under 10.x, so a CLI that documents or
  *   scaffolds strict must not run against a guard with the older meaning).
+ * 4.13.0: floor raised to 11 (computeBundleFingerprint returned a WRONG digest in 10.x — it
+ *   omitted the artifact count and the whole context block, so on identical inputs it produced
+ *   sha256:1a0e7470… where the server produced sha256:049650f2…; 11.0.0 delegates to the single
+ *   canonical crbundle.v1 preimage and matches byte for byte. COST MEASURED AS ZERO, the same way
+ *   the 10-raise was: the CLI imports only deployGate, asVerifiedDeployReceiptView,
+ *   DEPLOY_RECEIPT_VIEW_SPEC and matchGlob, none of which 11.0.0 touched, and the suite staged
+ *   against 11.0.0 returned an identical 532/530/2 with a byte-identical failure set. The floor
+ *   rises anyway, because a semantics floor is about what the CLI may RUN against, not about what
+ *   it happens to import today — a fingerprint that disagrees with the server is exactly the class
+ *   of difference this gate exists to refuse.)
  */
 
 const fs = require('fs');
 const path = require('path');
 
 /** Minimum acceptable major for @coderifts/agent-guard in THIS package (the CLI). */
-const MIN_GUARD_MAJOR = 10;
+const MIN_GUARD_MAJOR = 11;
 const DEP = '@coderifts/agent-guard';
 
 /**
@@ -55,17 +65,42 @@ const CHECKOUTS = [
     /**
      * DELIBERATE, MEASURED, AND LOWER THAN THE CLI'S — recorded so it is a decision, not a default.
      *
-     * 2026-08-26: bumping the root to ^10 breaks three merge-gate tests. gateDecision under 10.0.0
-     * returns residuals: [] where the app expects 'required_check_app_not_bound'
-     * (test/mergegate-webhook.test.js: 46/46 on 3.0.0, 3 failures on 10.0.0). The app's own comment
-     * at webhook-integration.js:336-339 records why 3.x has been SAFE rather than merely unnoticed:
-     * the app ANDs three conditions so a stale package can never fail-open.
+     * 2026-08-26: bumping the root to ^10 breaks three merge-gate tests
+     * (test/mergegate-webhook.test.js: 46/46 on 3.0.0, 43/46 on 10.x). The app's own comment at
+     * webhook-integration.js:336-339 records why 3.x has been SAFE rather than merely unnoticed:
+     * the app ANDs three conditions (protection_inescapable && change_set_rebound && app_bound) so
+     * a stale package can never fail-open. That AND is load-bearing — measured against 3.0.0,
+     * gateDecision claims inescapable_merge:true even when required_check_app_bound is false or
+     * absent; the published claim is correct only because the app re-derives it.
      *
-     * So the floor is pinned at 3 to stop it drifting LOWER unnoticed, and raising it is a separate
-     * round that must first reconcile the residual vocabulary. Raise this number in that round and
-     * record the reason on the line below, in the style of the CLI history above.
+     * RE-MEASURED 2026-08-26 against 11.0.0, and TWO THINGS IN THE OLD NOTE WERE WRONG:
+     *
+     *  1. It said 10.0.0 "returns residuals: []". It does not. Given the correct input shape it
+     *     returns ['required_check_app_not_bound'] / ['required_check_app_binding_unknown'] — the
+     *     app's own vocabulary. The earlier reading passed protection.enforcement_state; the field
+     *     the gate reads is protection.enforcement, so the gate saw no protection at all.
+     *  2. The real difference is PRECEDENCE, not absence. The guard emits exactly ONE residual and
+     *     short-circuits on the enforcement gap, so where two gaps hold at once it reports
+     *     'admin_bypass_open' and the app expects 'required_check_app_binding_unknown'. The app's
+     *     collectBindingResiduals emits EVERY residual that holds — its docstring says so: "the
+     *     pure gate's published shape is a single honesty slot ... the second was suppressed".
+     *     That is why the app duplicates rather than consumes, and it is the whole reconciliation.
+     *
+     * 11.0.0 vs 10.0.0: NO CHANGE. Residual output is byte-identical across all three app-binding
+     * cases, and 11.0.0 touched only computeBundleFingerprint, which this path does not import. So
+     * 11 makes the bump neither easier nor harder — the blocker is unchanged and the deferral still
+     * holds for exactly the reason above, not for a residual shape that moved.
+     *
+     * WHAT THE BUMP ROUND MUST DECIDE: whether the guard should emit all holding residuals (then
+     * the app consumes gateOut.residuals and collectBindingResiduals is deleted), or whether the
+     * single-slot shape is deliberate (then the app keeps its collector and the duplication is
+     * documented as intended rather than left looking accidental). Do not bump before that choice.
+     *
+     * So the floor is pinned at 3 to stop it drifting LOWER unnoticed. Raise this number in that
+     * round and record the reason on the line below, in the style of the CLI history above.
      */
-    why: 'root pinned at 3 pending the gateDecision residual-vocabulary reconciliation (see comment).',
+    why: 'root pinned at 3 pending the gateDecision residual-PRECEDENCE reconciliation (see comment; '
+      + 're-measured against 11.0.0 — unchanged from 10.0.0).',
   },
 ];