coderifts 4.2.0 → 4.3.0

package/dist/cli.js

@@ -3007,7 +3007,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "4.2.0",
+      version: "4.3.0",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -71780,1056 +71780,1769 @@ var require_cjs3 = __commonJS({
   }
 });
 
-// src/commands/deploy-gate.js
-var require_deploy_gate2 = __commonJS({
-  "src/commands/deploy-gate.js"(exports2, module2) {
+// src/commands/claude-hook.js
+var require_claude_hook = __commonJS({
+  "src/commands/claude-hook.js"(exports2, module2) {
     "use strict";
     var fs = require("fs");
     var path = require("path");
-    var chalk = require_source();
-    var { deployGate } = require_cjs3();
-    var { renderJson } = require_json2();
-    if (process.env.NO_COLOR) chalk.level = 0;
-    var REPAIRABLE = /* @__PURE__ */ new Set(["env_mismatch", "stale_artifact", "operation_mismatch", "receipt_not_authorized", "fingerprint_mismatch", "body_hash_mismatch"]);
-    function enforceSignal(options) {
-      return options && options.enforce === true || String(process.env.CODERIFTS_DEPLOY_ENFORCE || "").toLowerCase() === "true";
+    var { execSync } = require("child_process");
+    var { getApiKey } = require_config();
+    var { cloudAuthorizePreflight } = require_cloud();
+    var DEFAULT_SPEC_PATH = "api/openapi.yaml";
+    var CLOSED_ACTIONS = /* @__PURE__ */ new Set([
+      "CONTINUE",
+      "CONTINUE_WITH_MONITORING",
+      "REQUEST_APPROVAL",
+      "STOP"
+    ]);
+    var USAGE = [
+      "Usage: coderifts claude-hook",
+      "",
+      "Claude Code PreToolUse hook: gates Write|Edit|MultiEdit when they touch the",
+      "configured contract spec path. Reads JSON context from STDIN.",
+      "",
+      "Exit map (Claude Code semantics \u2014 get this exactly right):",
+      "  2  BLOCK \u2014 tool call cancelled (BLOCK/STOP, REQUEST_APPROVAL, unrecognised action,",
+      "     governance could not run, CONTINUE_WITH_MONITORING without a wired sink)",
+      "  0  allow \u2014 CONTINUE, or CWM with a host-asserted monitoring sink, or non-contract skip",
+      "  1  NEVER used for security deny (Claude treats exit 1 as non-blocking; action proceeds)",
+      "",
+      "Fail-closed DEFAULT (exit 2, reason enforce_indeterminate) when governance could not run:",
+      "  no API key / API unreachable / disk unreadable / edit-apply failure on the spec path",
+      "  Absence of a key is not permission. Explicit opt-out: CODERIFTS_ADVISORY=1|true.",
+      "",
+      "Parse-gap DEFAULT (exit 2): unparseable stdin / missing file_path \u2014 refusing (fail-closed);",
+      "  set CODERIFTS_ADVISORY=1 to soften. JSONL hook_blocked cause stdin_unparseable|missing_file_path.",
+      "",
+      "Still exit 0 (nothing to govern): non-spec path, identical content.",
+      "",
+      "CONTINUE_WITH_MONITORING: allow only if the host asserts a sink",
+      "  (CODERIFTS_MONITORING_SINK_WIRED=1|true or git config coderifts.monitoringSinkWired).",
+      "  Host claim \u2014 not delivery proof (same class as GuardConfig.monitoringSinkWired).",
+      "",
+      "CODERIFTS_STRICT=1|true: same fail-closed as default; cannot be weakened by ADVISORY.",
+      "",
+      "Spec path (same source as git pre-push hook):",
+      "  git config coderifts.specPath  (default: api/openapi.yaml)",
+      "",
+      "Baseline at PreToolUse: before = current file on disk (pre-edit state \u2014 the tool has",
+      "not written yet). after = proposed content from tool_input (Write: content; Edit/MultiEdit:",
+      "old\u2192new applied to disk content).",
+      "",
+      "Push-time equivalent: coderifts hook install (git exit 1 on BLOCK)."
+    ].join("\n");
+    function isEnvFlag(env, name) {
+      const v = env && env[name];
+      if (v == null || v === "") return false;
+      const s = String(v).trim().toLowerCase();
+      return s === "1" || s === "true";
     }
-    function observeCDEnforcement(options = {}) {
-      const envVal = String(process.env.CODERIFTS_DEPLOY_ENFORCE || "").toLowerCase();
-      let enforcement;
-      if (enforceSignal(options)) enforcement = "ENFORCING";
-      else if (envVal === "unknown") enforcement = "UNKNOWN";
-      else enforcement = "ADVISORY";
-      const bypass_possible = String(process.env.CODERIFTS_DEPLOY_NO_BYPASS || "").toLowerCase() !== "true";
-      return {
-        enforcement,
-        bypass_possible,
-        step_is_required: enforcement === "ENFORCING",
-        required_step_name: "CodeRifts / deploy-gate",
-        attestation_source: "cli_flag"
-      };
+    function isStrictMode(env = process.env) {
+      return isEnvFlag(env, "CODERIFTS_STRICT");
     }
-    function deployReportResiduals(state, enforcement_inescapable, enforcement, change_set_rebound) {
-      const out = [];
-      if (state !== "success") return out;
-      if (enforcement_inescapable !== true) {
-        if (enforcement === "ENFORCING") out.push("bypass_open");
-        else if (enforcement === "ADVISORY") out.push("deploy_gate_advisory");
-        else if (enforcement === "ABSENT") out.push("deploy_path_ungated");
-      }
-      if (change_set_rebound !== true) {
-        out.push("change_set_not_rebound");
+    function isAdvisoryMode(env = process.env) {
+      return isEnvFlag(env, "CODERIFTS_ADVISORY");
+    }
+    function isMonitoringSinkWired({ env = process.env, deps = {}, result = null } = {}) {
+      if (deps && deps.monitoringSinkWired === true) return true;
+      if (isEnvFlag(env, "CODERIFTS_MONITORING_SINK_WIRED")) return true;
+      const git = readGitConfig("coderifts.monitoringSinkWired", deps);
+      if (git) {
+        const s = String(git).trim().toLowerCase();
+        if (s === "1" || s === "true") return true;
       }
-      return out;
+      if (result && result.monitoringSinkWired === true) return true;
+      const dr = result && result.decision_result;
+      if (dr && typeof dr === "object" && dr.monitoringSinkWired === true) return true;
+      return false;
     }
-    function deployCoverageInput(enforcement_state, inescapable_deploy) {
-      return { enforcement_state, inescapable_deploy: inescapable_deploy === true, applicability_attested: true };
+    var HOOK_TRIGGER_SOURCE = "claude_hook";
+    function extractFingerprint(result) {
+      const d = result && typeof result === "object" && !Array.isArray(result) ? result : {};
+      const dr = d.decision_result && typeof d.decision_result === "object" ? d.decision_result : {};
+      const fp = dr.fingerprint || d.fingerprint || d.verdict_fingerprint || d.input_fingerprint;
+      return typeof fp === "string" && fp.length > 0 ? fp : void 0;
     }
-    function deployBind({ environment, artifact_id, receipt, observed_cd_enforcement, expected_fingerprint, expected_body_hash }) {
-      const attested_enforcement = observed_cd_enforcement && observed_cd_enforcement.enforcement || "UNKNOWN";
-      if (!receipt) {
-        return {
-          deploy_check_status: "pending",
-          reason: "no_receipt",
-          must_re_preflight: true,
-          attested_enforcement,
-          gate: null,
-          report_residuals: [],
-          coverage_deploy_input: deployCoverageInput(attested_enforcement, false)
-        };
-      }
-      const requiredContext = {
-        operation: "deploy",
-        enforcement: {
-          enforcement: attested_enforcement,
-          // fail-closed: bypass is possible unless observation proved it disabled.
-          bypass_possible: !(observed_cd_enforcement && observed_cd_enforcement.bypass_possible === false)
-        }
-      };
-      let change_set_rebound = false;
-      if (attested_enforcement === "ENFORCING") {
-        if (expected_fingerprint != null) {
-          requiredContext.expected_fingerprint = expected_fingerprint;
-          change_set_rebound = true;
-        }
-        if (expected_body_hash != null) requiredContext.expected_body_hash = expected_body_hash;
-      }
-      const gate = deployGate({ deployTarget: { environment, artifact_id }, receipt, requiredContext });
-      const enforcement_inescapable = attested_enforcement === "ENFORCING" && !!(observed_cd_enforcement && observed_cd_enforcement.bypass_possible === false);
-      const inescapable_deploy = gate.inescapable_deploy === true && change_set_rebound === true;
-      return {
-        deploy_check_status: gate.state,
-        reason: gate.reason,
-        must_re_preflight: REPAIRABLE.has(gate.reason),
-        attested_enforcement,
-        gate: { deploy_allowed: gate.deploy_allowed, reason: gate.reason, inescapable_deploy },
-        report_residuals: deployReportResiduals(gate.state, enforcement_inescapable, attested_enforcement, change_set_rebound),
-        coverage_deploy_input: deployCoverageInput(attested_enforcement, inescapable_deploy)
-      };
+    function fingerprintPrefix(fp) {
+      if (typeof fp !== "string" || fp.length === 0) return void 0;
+      const colon = fp.indexOf(":");
+      if (colon > 0 && colon < fp.length - 1) {
+        const scheme = fp.slice(0, colon + 1);
+        const rest = fp.slice(colon + 1);
+        return scheme + rest.slice(0, 12) + (rest.length > 12 ? "\u2026" : "");
+      }
+      return fp.length > 16 ? `${fp.slice(0, 16)}\u2026` : fp;
+    }
+    function renderAllowProofBlock({ decision, executionAction, decisionId, fingerprint } = {}) {
+      const decPart = decision ? ` decision=${decision}` : "";
+      const eaPart = executionAction ? ` execution_action=${executionAction}` : "";
+      const idPart = decisionId ? ` decision_id=${decisionId}` : "";
+      const lines = [`CodeRifts claude-hook: AUTHORIZED${decPart}${eaPart}${idPart}`];
+      const pref = fingerprintPrefix(fingerprint);
+      if (pref) lines.push(`- receipt: ${pref}`);
+      lines.push("- Interpretation: authorized at verify time for the bound scope only \u2014 see Limits.");
+      lines.push("- authorized; execution/commit not proven by this hook");
+      return lines.join("\n");
     }
-    function clampExit(deployCheckStatus, enforce) {
-      if (deployCheckStatus === "success") return 0;
-      if (deployCheckStatus === "failure" && enforce === true) return 1;
-      return 0;
+    function hookSessionId(env) {
+      const fromEnv = env && env.CODERIFTS_SESSION_ID && String(env.CODERIFTS_SESSION_ID).trim();
+      if (fromEnv) return fromEnv;
+      if (!hookSessionId._gen) hookSessionId._gen = `hook-${process.pid}-${Date.now()}`;
+      return hookSessionId._gen;
     }
-    function readReceiptFile(filePath) {
-      if (!filePath) return null;
-      const resolved = path.resolve(filePath);
-      if (!fs.existsSync(resolved)) return null;
+    function appendGuardEventLog(env, event, deps = {}) {
+      const p = env && env.CODERIFTS_GUARD_EVENT_LOG;
+      if (p == null || String(p).trim() === "") return;
+      const errLog = deps.errLog || ((m) => console.error(String(m)));
+      const append = deps.appendFileSync || ((file, data) => fs.appendFileSync(file, data));
       try {
-        return JSON.parse(fs.readFileSync(resolved, "utf-8"));
-      } catch (_) {
-        return null;
+        append(String(p).trim(), JSON.stringify(event) + "\n");
+      } catch (err) {
+        try {
+          errLog(`CodeRifts claude-hook: CODERIFTS_GUARD_EVENT_LOG write failed (${err && err.message})`);
+        } catch {
+        }
       }
     }
-    function extractDecisionIdFromReceipt(receipt) {
-      if (!receipt || typeof receipt !== "object") return null;
-      if (typeof receipt.decision_id === "string" && receipt.decision_id.trim()) {
-        return receipt.decision_id.trim();
+    function failClosedOrAdvisory({ advisory, strict, site, softMsg, why, errLog }) {
+      if (advisory && !strict) {
+        errLog(`${softMsg} (CODERIFTS_ADVISORY)`);
+        return { exitCode: 0, reason: site, site };
       }
-      const nested = receipt.decision_result;
-      if (nested && typeof nested === "object" && typeof nested.decision_id === "string" && nested.decision_id.trim()) {
-        return nested.decision_id.trim();
+      if (strict) {
+        errLog(
+          `CodeRifts claude-hook: CODERIFTS_STRICT: governance could not run (${why}) \u2014 blocking. Set a key / restore network, or unset CODERIFTS_STRICT.`
+        );
+        return { exitCode: 2, reason: "enforce_indeterminate", site, strictBlocked: true };
       }
-      return null;
-    }
-    function formatOutcomeReportHint(decisionId) {
-      const id = String(decisionId);
-      return [
-        "# report the deploy outcome after your deploy step:",
-        `coderifts outcome <deploy_succeeded|deploy_failed|rolled_back> --decision ${id}`
-      ].join("\n");
+      errLog(
+        `CodeRifts claude-hook: governance could not run (${why}) \u2014 blocking. Set CODERIFTS_ADVISORY=1 to allow without governance (explicit opt-out).`
+      );
+      return { exitCode: 2, reason: "enforce_indeterminate", site };
     }
-    function renderDeployGateTerminal(bind, enforce) {
-      const g = bind.gate;
-      const color = bind.deploy_check_status === "success" ? chalk.green : bind.deploy_check_status === "failure" ? chalk.red : chalk.yellow;
-      const lines = [];
-      lines.push("");
-      lines.push(chalk.bold(`  CodeRifts deploy-gate \u2014 ${color(bind.deploy_check_status.toUpperCase())}`));
-      lines.push(`  Reason:             ${bind.reason}`);
-      lines.push(`  Enforcement:        ${bind.attested_enforcement}`);
-      lines.push(`  inescapable_deploy: ${g ? g.inescapable_deploy : false}`);
-      if (bind.report_residuals.length) lines.push(`  Residuals:          ${bind.report_residuals.join(", ")}`);
-      if (bind.must_re_preflight) lines.push(chalk.yellow("  Action: re-preflight this { environment, artifact } \u2014 the receipt does not authorize it."));
-      lines.push("");
-      lines.push(enforce ? chalk.dim("  Enforcing \u2014 a failing gate exits non-zero (blocks the deploy step).") : chalk.dim("  Advisory (phase 1) \u2014 does not block the deploy (exit 0)."));
-      lines.push("");
-      return lines.join("\n");
+    function softOrStrictBlock({ strict, reason, softMsg, why, errLog }) {
+      return failClosedOrAdvisory({
+        advisory: false,
+        strict: !!strict,
+        site: reason,
+        softMsg,
+        why,
+        errLog
+      });
     }
-    async function runDeployGate(options = {}) {
-      const environment = options.env;
-      const artifactId = options.artifact;
-      if (!environment || !artifactId) {
-        console.error(chalk.red("Error: --env and --artifact are required."));
-        process.exit(1);
-        return;
-      }
-      const enforce = enforceSignal(options);
-      const receipt = readReceiptFile(options.receipt);
-      const observed = observeCDEnforcement({ enforce });
-      const bind = deployBind({ environment, artifact_id: artifactId, receipt, observed_cd_enforcement: observed });
-      const code = clampExit(bind.deploy_check_status, enforce);
-      const decisionId = extractDecisionIdFromReceipt(receipt);
-      if (options.json) {
-        console.log(renderJson({
-          command: "deploy-gate",
-          environment,
-          artifact_id: artifactId,
-          phase: enforce ? "enforcing" : "advisory",
-          exit_code: code,
-          decision_id: decisionId,
-          ...bind
-        }));
-      } else {
-        console.log(renderDeployGateTerminal(bind, enforce));
-        if (decisionId) {
-          console.log(formatOutcomeReportHint(decisionId));
-          console.log("");
-        }
+    function readGitConfig(key, deps = {}) {
+      const run = deps.execSync || execSync;
+      const cwd = deps.cwd || process.cwd();
+      try {
+        const v = run(`git config ${key}`, { encoding: "utf8", cwd, stdio: ["ignore", "pipe", "pipe"] });
+        const t = String(v || "").trim();
+        return t || null;
+      } catch {
+        return null;
       }
-      process.exit(code);
     }
-    module2.exports = {
-      runDeployGate,
-      deployBind,
-      observeCDEnforcement,
-      clampExit,
-      readReceiptFile,
-      extractDecisionIdFromReceipt,
-      formatOutcomeReportHint,
-      renderDeployGateTerminal
-    };
-  }
-});
-
-// src/commands/publish-gate.js
-var require_publish_gate = __commonJS({
-  "src/commands/publish-gate.js"(exports2, module2) {
-    "use strict";
-    var fs = require("fs");
-    var path = require("path");
-    var { execFileSync } = require("child_process");
-    var chalk = require_source();
-    var { getApiKey } = require_config();
-    var { cloudDiff } = require_cloud();
-    if (process.env.NO_COLOR) chalk.level = 0;
-    var ZERO_SHA = "0000000000000000000000000000000000000000";
-    var CLOSED_ACTIONS = /* @__PURE__ */ new Set([
-      "CONTINUE",
-      "CONTINUE_WITH_MONITORING",
-      "REQUEST_APPROVAL",
-      "STOP"
-    ]);
-    var PERMIT_ACTIONS = /* @__PURE__ */ new Set(["CONTINUE", "CONTINUE_WITH_MONITORING"]);
-    function defaultGit(args, cwd) {
-      return execFileSync("git", args, {
-        cwd: cwd || process.cwd(),
-        encoding: "utf8",
-        maxBuffer: 16 * 1024 * 1024,
-        stdio: ["ignore", "pipe", "pipe"]
-      }).trim();
+    function resolveApiKey(deps = {}) {
+      const getKey = deps.getApiKey || getApiKey;
+      const fromLogin = getKey();
+      if (fromLogin) return fromLogin;
+      const env = deps.env || process.env;
+      const fromEnv = env.CODERIFTS_API_KEY && String(env.CODERIFTS_API_KEY).trim();
+      if (fromEnv) return fromEnv;
+      return readGitConfig("coderifts.apiKey", deps);
     }
-    function gitShow(ref, filePath, { gitImpl = defaultGit, cwd } = {}) {
-      try {
-        const out = gitImpl(["show", `${ref}:${filePath}`], cwd);
-        return { ok: true, content: out == null ? "" : String(out) };
-      } catch (err) {
-        const msg = err && err.stderr ? String(err.stderr) : err && err.message || String(err);
-        return {
-          ok: false,
-          code: "GIT_ERROR",
-          message: `git error reading ${ref}:${filePath}: ${msg.slice(0, 300)}`
-        };
-      }
+    function resolveSpecPath(deps = {}) {
+      const fromGit = readGitConfig("coderifts.specPath", deps);
+      if (fromGit) return fromGit;
+      return DEFAULT_SPEC_PATH;
     }
-    function readPackageVersion(cwd, readFile = fs.readFileSync) {
-      const pkgPath = path.join(cwd || process.cwd(), "package.json");
+    function parseStdinJson(raw) {
+      if (raw == null || String(raw).trim() === "") {
+        return { ok: false, reason: "empty stdin" };
+      }
+      let obj;
       try {
-        const raw = readFile(pkgPath, "utf8");
-        const pkg2 = JSON.parse(raw);
-        return pkg2 && typeof pkg2.version === "string" ? pkg2.version : null;
+        obj = JSON.parse(String(raw));
       } catch {
-        return null;
+        return { ok: false, reason: "stdin is not JSON" };
+      }
+      if (!obj || typeof obj !== "object" || Array.isArray(obj)) {
+        return { ok: false, reason: "stdin JSON is not an object" };
+      }
+      const toolName = obj.tool_name || obj.toolName || obj.name || null;
+      let toolInput = obj.tool_input || obj.toolInput || obj.input || null;
+      if (toolInput == null && obj.file_path) toolInput = obj;
+      if (!toolName || typeof toolName !== "string") {
+        return { ok: false, reason: "missing tool_name" };
       }
+      if (!toolInput || typeof toolInput !== "object") {
+        return { ok: false, reason: "missing tool_input" };
+      }
+      return { ok: true, toolName: String(toolName), toolInput };
     }
-    function resolveBeforeSpec(specPath, {
-      gitImpl = defaultGit,
-      cwd = process.cwd(),
-      readFile = fs.readFileSync,
-      packageVersion = null
-    } = {}) {
-      const version = packageVersion != null ? packageVersion : readPackageVersion(cwd, readFile);
-      const tried = [];
-      if (version) {
-        const tags = [`v${version}`, version];
-        for (const tag of tags) {
-          tried.push(`tag:${tag}`);
-          try {
-            gitImpl(["rev-parse", "--verify", `${tag}^{commit}`], cwd);
-          } catch {
-            continue;
-          }
-          const shown = gitShow(tag, specPath, { gitImpl, cwd });
-          if (!shown.ok) {
-            return {
-              ok: false,
-              code: shown.code || "GIT_ERROR",
-              message: shown.message,
-              tried
-            };
-          }
-          if (shown.content.trim() === "") {
-            return {
-              ok: false,
-              code: "EMPTY_BEFORE",
-              message: `Empty contract artifact at tag ${tag}:${specPath}. Refusing to treat empty before as NEW_ARTIFACT (would false-pass enforce).`,
-              tried
-            };
-          }
-          return { ok: true, content: shown.content, source: `tag:${tag}`, tried };
-        }
-      } else {
-        tried.push("package.json:version (missing)");
+    function isSpecPath(filePath, specPath) {
+      if (!filePath || !specPath) return false;
+      const fp = path.normalize(String(filePath).replace(/\\/g, "/"));
+      const sp = path.normalize(String(specPath).replace(/\\/g, "/"));
+      if (fp === sp) return true;
+      if (fp.endsWith("/" + sp) || fp.endsWith(sp)) return true;
+      const baseFp = path.basename(fp);
+      const baseSp = path.basename(sp);
+      if (baseFp === baseSp && (fp.endsWith(sp) || sp.endsWith(baseSp))) {
+        const tail = sp.split("/").filter(Boolean).join("/");
+        return fp.replace(/\\/g, "/").endsWith(tail);
       }
-      const bases = ["origin/main", "origin/master", "main", "master"];
-      for (const base of bases) {
-        tried.push(`merge-base:${base}`);
-        let mb;
-        try {
-          mb = gitImpl(["merge-base", "HEAD", base], cwd);
-        } catch {
-          continue;
+      return false;
+    }
+    function deriveAfterContent(toolName, toolInput, diskBefore) {
+      const name = String(toolName || "");
+      if (name === "Write" || name === "write") {
+        if (typeof toolInput.content !== "string") {
+          return { ok: false, reason: "Write tool_input.content missing or not a string" };
         }
-        if (!mb || mb === ZERO_SHA) continue;
-        const shown = gitShow(mb, specPath, { gitImpl, cwd });
-        if (!shown.ok) {
-          return {
-            ok: false,
-            code: shown.code || "GIT_ERROR",
-            message: shown.message,
-            tried
-          };
+        return { ok: true, after: toolInput.content };
+      }
+      if (name === "Edit" || name === "edit") {
+        const oldS = toolInput.old_string != null ? toolInput.old_string : toolInput.oldString;
+        const newS = toolInput.new_string != null ? toolInput.new_string : toolInput.newString;
+        if (typeof oldS !== "string" || typeof newS !== "string") {
+          return { ok: false, reason: "Edit tool_input.old_string/new_string missing" };
         }
-        if (shown.content.trim() === "") {
-          return {
-            ok: false,
-            code: "EMPTY_BEFORE",
-            message: `Empty contract artifact at merge-base ${mb}:${specPath} (${base}). Refusing to treat empty before as NEW_ARTIFACT (would false-pass enforce).`,
-            tried
-          };
+        if (!diskBefore.includes(oldS)) {
+          return { ok: false, reason: "Edit old_string not found in disk content" };
         }
-        return {
-          ok: true,
-          content: shown.content,
-          source: `merge-base:${base}@${mb.slice(0, 12)}`,
-          tried
-        };
+        return { ok: true, after: diskBefore.replace(oldS, newS) };
       }
-      return {
-        ok: false,
-        code: "BEFORE_UNRESOLVED",
-        message: `Could not resolve a non-empty before-spec for ${specPath}. Tried: (a) git tag of package.json version, (b) merge-base with origin/main. Attempts: ${tried.join(", ")}. Fail-closed \u2014 will not publish without a baseline.`,
-        tried
-      };
-    }
-    function resolveAfterSpec(specPath, {
-      cwd = process.cwd(),
-      readFile = fs.readFileSync,
-      exists = fs.existsSync
-    } = {}) {
-      const resolved = path.isAbsolute(specPath) ? specPath : path.join(cwd, specPath);
-      try {
-        if (!exists(resolved)) {
-          return {
-            ok: false,
-            code: "AFTER_MISSING",
-            message: `Working-tree contract artifact not found: ${specPath}`
-          };
+      if (name === "MultiEdit" || name === "multi_edit" || name === "multiEdit") {
+        const edits = toolInput.edits || toolInput.Edits;
+        if (!Array.isArray(edits) || edits.length === 0) {
+          return { ok: false, reason: "MultiEdit tool_input.edits missing or empty" };
         }
-        const content = readFile(resolved, "utf8");
-        if (content == null || String(content).trim() === "") {
-          return {
-            ok: false,
-            code: "AFTER_EMPTY",
-            message: `Working-tree contract artifact is empty: ${specPath}`
-          };
+        let cur = diskBefore;
+        for (let i = 0; i < edits.length; i++) {
+          const e = edits[i] || {};
+          const oldS = e.old_string != null ? e.old_string : e.oldString;
+          const newS = e.new_string != null ? e.new_string : e.newString;
+          if (typeof oldS !== "string" || typeof newS !== "string") {
+            return { ok: false, reason: `MultiEdit edits[${i}] missing old_string/new_string` };
+          }
+          if (!cur.includes(oldS)) {
+            return { ok: false, reason: `MultiEdit edits[${i}] old_string not found in content` };
+          }
+          cur = cur.replace(oldS, newS);
         }
-        return { ok: true, content: String(content), path: resolved };
-      } catch (err) {
-        return {
-          ok: false,
-          code: "AFTER_READ_ERROR",
-          message: `Failed to read working-tree ${specPath}: ${err && err.message}`
-        };
+        return { ok: true, after: cur };
       }
+      return { ok: false, reason: `unsupported tool_name for content derive: ${name}` };
     }
-    function evaluatePublishPermission(result) {
-      if (!result || typeof result !== "object") {
-        return {
-          allow: false,
-          execution_action: null,
-          decision: null,
-          policy: "fail_closed:unreadable_response"
-        };
-      }
-      const env = result.decision_result && typeof result.decision_result === "object" ? result.decision_result : null;
-      let ea = null;
-      if (env && typeof env.execution_action === "string") ea = env.execution_action;
-      else if (typeof result.execution_action === "string") ea = result.execution_action;
-      const decision = env && env.decision || result.decision || result.omega_decision || null;
-      if (ea && CLOSED_ACTIONS.has(ea)) {
-        const allow = PERMIT_ACTIONS.has(ea);
-        return {
-          allow,
-          execution_action: ea,
-          decision: decision || null,
-          policy: allow ? `permit:execution_action=${ea}` : `block:execution_action=${ea}`
-        };
-      }
-      if (ea != null && ea !== "" && !CLOSED_ACTIONS.has(ea)) {
-        return {
-          allow: false,
-          execution_action: ea,
-          decision: decision || null,
-          policy: `block:unrecognised_execution_action=${ea}`
-        };
-      }
-      if (decision === "BLOCK" || decision === "REQUIRE_APPROVAL") {
-        return {
-          allow: false,
-          execution_action: null,
-          decision,
-          policy: `block:decision=${decision}`
-        };
+    function isV2DecisionBody(d, dr) {
+      if (dr && typeof dr === "object") return true;
+      if (d.preflight_mode != null && d.preflight_mode !== "") return true;
+      const ver = d.decision_spec_version;
+      return typeof ver === "string" && ver.startsWith("2.");
+    }
+    function allowLegacyDecisionMap(d, dr) {
+      return d.decision_spec_version === "1.0" && !isV2DecisionBody(d, dr);
+    }
+    function mapDecisionSeverity(result) {
+      const d = result && typeof result === "object" && !Array.isArray(result) ? result : {};
+      let ea = null;
+      const dr = d.decision_result;
+      if (dr && typeof dr === "object" && typeof dr.execution_action === "string" && dr.execution_action !== "") {
+        ea = dr.execution_action;
+      } else if (typeof d.execution_action === "string" && d.execution_action !== "") {
+        ea = d.execution_action;
       }
-      if (decision === "ALLOW" || decision === "WARN" || decision === "PASS") {
+      const hasDecision = d.omega_decision != null && d.omega_decision !== "" || d.decision != null && d.decision !== "" || dr && typeof dr === "object" && dr.execution_action;
+      if (d.error && !hasDecision && (ea == null || ea === "")) {
         return {
-          allow: true,
-          execution_action: null,
-          decision,
-          policy: `permit:decision=${decision}`
+          severity: "INDETERMINATE",
+          decision: null,
+          decisionId: null,
+          executionAction: null
         };
       }
-      const omega = result.omega_decision;
-      if (omega === "BLOCK" || omega === "REQUIRE_APPROVAL") {
-        return {
-          allow: false,
-          execution_action: null,
-          decision: omega,
-          policy: `block:omega_decision=${omega}`
-        };
+      let severity;
+      if (ea != null && ea !== "") {
+        if (!CLOSED_ACTIONS.has(ea)) {
+          severity = "UNKNOWN";
+        } else if (ea === "CONTINUE") {
+          severity = "ALLOW";
+        } else if (ea === "CONTINUE_WITH_MONITORING") {
+          severity = "MONITOR";
+        } else if (ea === "STOP") {
+          severity = "BLOCK";
+        } else {
+          severity = "REQUIRE_APPROVAL";
+        }
+      } else if (allowLegacyDecisionMap(d, dr)) {
+        const od = d.omega_decision || d.decision;
+        if (od == null || od === "") {
+          severity = "INDETERMINATE";
+        } else if (od === "BLOCK") severity = "BLOCK";
+        else if (od === "REQUIRE_APPROVAL") severity = "REQUIRE_APPROVAL";
+        else if (od === "WARN") severity = "WARN";
+        else severity = "ALLOW";
+      } else {
+        severity = "INDETERMINATE";
       }
+      const decision = dr && dr.decision || d.decision || d.omega_decision || null;
+      const decisionId = dr && dr.decision_id || d.decision_id || null;
       return {
-        allow: false,
-        execution_action: ea,
-        decision: decision || omega || null,
-        policy: "fail_closed:no_permission_signal"
+        severity,
+        decision: decision != null && decision !== "" ? String(decision) : null,
+        decisionId: decisionId != null ? String(decisionId) : null,
+        executionAction: ea
       };
     }
-    function extractReceiptRef(result) {
-      if (!result || typeof result !== "object") return null;
-      const env = result.decision_result;
-      if (env && env.receipt && typeof env.receipt.token === "string") {
-        return env.receipt.token.slice(0, 24) + (env.receipt.token.length > 24 ? "\u2026" : "");
-      }
-      if (env && typeof env.decision_id === "string") return env.decision_id;
-      if (typeof result.decision_id === "string") return result.decision_id;
-      if (typeof result.fingerprint === "string") return result.fingerprint;
-      if (env && typeof env.fingerprint === "string") return env.fingerprint;
-      return null;
-    }
-    async function defaultPreflight(before, after, { apiKey } = {}) {
-      const key = process.env.CODERIFTS_FORCE_LOCAL_PREFLIGHT ? null : apiKey != null ? apiKey : getApiKey();
-      if (key) {
-        return cloudDiff(before, after, key);
+    function renderDecisionWhy(result, opts = {}) {
+      const maxFixes = Number.isInteger(opts.maxFixes) ? opts.maxFixes : 5;
+      const maxLines = Number.isInteger(opts.maxLines) ? opts.maxLines : 13;
+      const d = result && typeof result === "object" && !Array.isArray(result) ? result : {};
+      const dr = d.decision_result && typeof d.decision_result === "object" ? d.decision_result : {};
+      const pick = (k) => dr[k] !== void 0 ? dr[k] : d[k];
+      const arr = (v) => Array.isArray(v) ? v : [];
+      const str = (v) => typeof v === "string" ? v.trim() : "";
+      const lines = [];
+      const reasonCodes = [];
+      for (const r of arr(pick("blocking_reasons"))) {
+        if (!r || typeof r !== "object") continue;
+        const code = str(r.code);
+        const message = str(r.message);
+        if (code) reasonCodes.push(code);
+        if (!code && !message) continue;
+        lines.push(`- ${code || "REASON"}${message ? `: ${message}` : ""}`);
       }
-      const yaml = require_js_yaml();
-      const { diffSpecs } = require_api2();
-      let oldSpec;
-      let newSpec;
-      try {
-        oldSpec = yaml.load(before);
-        newSpec = yaml.load(after);
-      } catch (e) {
-        const err = new Error(`Failed to parse specs: ${e.message}`);
-        err.code = "PREFLIGHT_UNREACHABLE";
-        throw err;
+      for (const r of arr(pick("degraded_reasons"))) {
+        if (!r || typeof r !== "object") continue;
+        const code = str(r.code);
+        const message = str(r.message);
+        if (!code && !message) continue;
+        lines.push(`- degraded: ${[code, message].filter(Boolean).join(": ")}`);
       }
-      let diffResult;
-      try {
-        diffResult = await diffSpecs({
-          sourceSpec: { content: JSON.stringify(oldSpec), location: "before.json", format: "openapi3" },
-          destinationSpec: { content: JSON.stringify(newSpec), location: "after.json", format: "openapi3" }
-        });
-      } catch (e) {
-        const err = new Error(`Local preflight engine error: ${e.message}`);
-        err.code = "PREFLIGHT_UNREACHABLE";
-        throw err;
+      const action = str(pick("required_action"));
+      if (action) lines.push(`- action: ${action}`);
+      const rt = pick("remediation_transaction");
+      const changes = arr(rt && typeof rt === "object" ? rt.required_changes : null).filter((c) => c && typeof c === "object");
+      const shown = changes.slice(0, maxFixes);
+      for (const c of shown) {
+        const target = str(c.target);
+        const instruction = str(c.instruction);
+        if (!instruction && !target) continue;
+        lines.push(`- fix${target ? ` (${target})` : ""}: ${instruction || str(c.precise_label)}`);
       }
-      const breaking = (diffResult.breakingDifferences || []).length;
-      const decision = breaking > 0 ? "BLOCK" : "ALLOW";
-      const execution_action = breaking > 0 ? "STOP" : "CONTINUE";
-      return {
-        decision,
-        omega_decision: decision,
-        execution_action,
-        decision_result: {
-          decision,
-          execution_action,
-          decision_id: `local-${Date.now()}`
-        },
-        breaking_changes: diffResult.breakingDifferences || [],
-        risk_score: Math.min(breaking * 15, 100)
-      };
+      if (changes.length > shown.length) lines.push(`- fix: +${changes.length - shown.length} more`);
+      return { lines: lines.slice(0, maxLines), reasonCodes };
     }
-    async function runPublishGate(options = {}, deps = {}) {
-      const cwd = deps.cwd || process.cwd();
-      const gitImpl = deps.gitImpl || defaultGit;
-      const readFile = deps.readFile || fs.readFileSync.bind(fs);
-      const exists = deps.exists || fs.existsSync.bind(fs);
-      const preflightFn = deps.preflightFn || defaultPreflight;
-      const log = deps.log || console.log.bind(console);
-      const logErr = deps.logErr || console.error.bind(console);
-      let specPath = options.spec;
-      if (!specPath) {
+    async function runClaudeHook(options = {}, deps = {}) {
+      const errLog = deps.errLog || ((m) => console.error(String(m)));
+      const readStdin = deps.readStdin || (() => {
         try {
-          specPath = gitImpl(["config", "coderifts.specPath"], cwd);
+          return fs.readFileSync(0, "utf8");
         } catch {
-          specPath = "";
+          return "";
         }
-      }
-      if (!specPath) specPath = "api/openapi.yaml";
-      try {
-        gitImpl(["rev-parse", "--is-inside-work-tree"], cwd);
-      } catch (err) {
-        const msg = "CodeRifts publish-gate: GIT_ERROR \u2014 not a git repository (or git unavailable). Cannot resolve before-spec without git. Fail-closed.";
-        logErr(chalk.red(msg));
-        return finish({
-          ok: false,
-          exitCode: 1,
-          code: "GIT_ERROR",
-          message: msg,
-          policy: "fail_closed:git_error"
-        }, { log, json: options.json });
-      }
-      const beforeRes = resolveBeforeSpec(specPath, {
-        gitImpl,
-        cwd,
-        readFile,
-        packageVersion: deps.packageVersion
       });
-      if (!beforeRes.ok) {
-        logErr(chalk.red(`CodeRifts publish-gate: ${beforeRes.code} \u2014 ${beforeRes.message}`));
-        return finish({
-          ok: false,
-          exitCode: 1,
-          code: beforeRes.code,
-          message: beforeRes.message,
-          policy: `fail_closed:${beforeRes.code}`,
-          tried: beforeRes.tried
-        }, { log, json: options.json });
-      }
-      const afterRes = resolveAfterSpec(specPath, { cwd, readFile, exists });
-      if (!afterRes.ok) {
-        logErr(chalk.red(`CodeRifts publish-gate: ${afterRes.code} \u2014 ${afterRes.message}`));
-        return finish({
-          ok: false,
-          exitCode: 1,
-          code: afterRes.code,
-          message: afterRes.message,
-          policy: `fail_closed:${afterRes.code}`
-        }, { log, json: options.json });
-      }
-      if (beforeRes.content === afterRes.content) {
-        const payload2 = {
-          ok: true,
-          exitCode: 0,
-          code: "UNCHANGED",
-          message: "Contract artifact unchanged vs baseline; publish permitted.",
-          policy: "permit:unchanged",
-          before_source: beforeRes.source,
-          execution_action: "CONTINUE",
-          receipt: null
-        };
-        if (!options.json) {
-          log(chalk.green("CodeRifts publish-gate: ALLOW (unchanged)"));
-          log(`  baseline: ${beforeRes.source}`);
-          log(`  spec:     ${specPath}`);
-        }
-        return finish(payload2, { log, json: options.json });
-      }
-      let result;
-      try {
-        result = await preflightFn(beforeRes.content, afterRes.content, {
-          apiKey: deps.apiKey,
-          cwd
-        });
-      } catch (err) {
-        const msg = `CodeRifts publish-gate: PREFLIGHT_UNREACHABLE \u2014 ${err && err.message}`;
-        logErr(chalk.red(msg));
-        return finish({
-          ok: false,
-          exitCode: 1,
-          code: "PREFLIGHT_UNREACHABLE",
-          message: msg,
-          policy: "fail_closed:preflight_unreachable"
-        }, { log, json: options.json });
-      }
-      const perm = evaluatePublishPermission(result);
-      const receipt = extractReceiptRef(result);
-      if (!perm.allow) {
-        const payload2 = {
-          ok: false,
-          exitCode: 1,
-          code: "BLOCK",
-          message: "Publish not permitted by execution_action / decision.",
-          policy: perm.policy,
-          execution_action: perm.execution_action,
-          decision: perm.decision,
-          before_source: beforeRes.source,
-          receipt,
-          fail_policy: "exit_1_on_block_or_resolver_error_or_unreachable"
+      const readFile = deps.readFile || ((p) => fs.readFileSync(p, "utf8"));
+      const exists = deps.exists || ((p) => fs.existsSync(p));
+      const authorize = deps.cloudAuthorizePreflight || cloudAuthorizePreflight;
+      const cwd = deps.cwd || process.cwd();
+      const env = deps.env || process.env;
+      const strict = isStrictMode(env);
+      const advisory = isAdvisoryMode(env);
+      const sessionId = hookSessionId(env);
+      const logEv = (partial) => {
+        appendGuardEventLog(env, {
+          at: (/* @__PURE__ */ new Date()).toISOString(),
+          sessionId,
+          trigger_source: HOOK_TRIGGER_SOURCE,
+          ...partial
+        }, { errLog, appendFileSync: deps.appendFileSync });
+      };
+      let tool = null;
+      let filePathKnown = null;
+      const emitTerminal = (r) => {
+        const extra = {
+          tool: tool || void 0,
+          path: filePathKnown || void 0,
+          decision: r.decision != null ? r.decision : void 0,
+          decisionId: r.decisionId != null ? r.decisionId : void 0
         };
-        if (!options.json) {
-          logErr("");
-          logErr(chalk.red("========================================"));
-          logErr(chalk.red("  CodeRifts: PUBLISH BLOCKED"));
-          logErr(chalk.red("========================================"));
-          logErr(`  Policy:            ${perm.policy}`);
-          logErr(`  execution_action:  ${perm.execution_action || "(none)"}`);
-          logErr(`  decision:          ${perm.decision || "(none)"}`);
-          logErr(`  baseline:          ${beforeRes.source}`);
-          logErr(`  fail policy:       exit 1 on BLOCK / resolver error / preflight unreachability`);
-          logErr(chalk.red("========================================"));
-          logErr("");
+        if (r.exitCode === 2) {
+          const reasons = Array.isArray(r.reasons) && r.reasons.length ? r.reasons : void 0;
+          logEv({
+            type: "hook_blocked",
+            exit: 2,
+            ...extra,
+            reasons,
+            cause: r.reason || r.site
+          });
+        } else if (r.exitCode === 0 && r.site && advisory && !strict) {
+          logEv({ type: "hook_advisory_passthrough", exit: 0, decision: r.decision || null, ...extra, cause: r.site });
+        } else {
+          const proof = r.reason === "allow" ? {
+            decision_id: r.decisionId != null ? r.decisionId : extra.decisionId || null,
+            fp_prefix: fingerprintPrefix(r.fingerprint) || null
+          } : void 0;
+          logEv({
+            type: "hook_continue",
+            exit: 0,
+            ...extra,
+            cause: r.reason,
+            ...proof ? { proof } : {}
+          });
         }
-        return finish(payload2, { log, json: options.json });
-      }
-      const payload = {
-        ok: true,
-        exitCode: 0,
-        code: "ALLOW",
-        message: "Publish permitted.",
-        policy: perm.policy,
-        execution_action: perm.execution_action,
-        decision: perm.decision,
-        before_source: beforeRes.source,
-        receipt
+        return r;
       };
-      if (!options.json) {
-        log(chalk.green("CodeRifts publish-gate: ALLOW"));
-        log(`  Policy:            ${perm.policy}`);
-        log(`  execution_action:  ${perm.execution_action || "(mapped from decision)"}`);
-        log(`  baseline:          ${beforeRes.source}`);
-        if (receipt) log(`  Receipt reference: ${receipt}`);
-        else log("  Receipt reference: (none issued on this path)");
-      }
-      return finish(payload, { log, json: options.json });
-    }
-    function finish(payload, { log, json }) {
-      if (json) {
-        log(JSON.stringify(payload, null, 2));
+      const apiKey = resolveApiKey({ ...deps, cwd, env });
+      if (!apiKey) {
+        logEv({ type: "preflight_unavailable", cause: "missing_api_key" });
+        return emitTerminal(failClosedOrAdvisory({
+          advisory,
+          strict,
+          site: "missing_api_key",
+          why: "no API key",
+          softMsg: "CodeRifts claude-hook: no API key (coderifts login / CODERIFTS_API_KEY / git config coderifts.apiKey) \u2014 allowing",
+          errLog
+        }));
       }
-      return payload;
-    }
-    module2.exports = {
-      runPublishGate,
-      resolveBeforeSpec,
-      resolveAfterSpec,
-      evaluatePublishPermission,
-      extractReceiptRef,
-      gitShow,
-      defaultGit,
-      PERMIT_ACTIONS,
-      CLOSED_ACTIONS
-    };
-  }
-});
-
-// src/registry-validation-core.js
-var require_registry_validation_core = __commonJS({
-  "src/registry-validation-core.js"(exports2, module2) {
-    "use strict";
-    var yaml = require_js_yaml();
-    function safeParse(content) {
-      if (!content) return null;
-      try {
-        const trimmed = content.trim();
-        if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
-          return JSON.parse(trimmed);
+      const PARSE_GAP_STDERR = "unparseable input \u2014 refusing (fail-closed); set CODERIFTS_ADVISORY=1 to soften";
+      const raw = typeof options.stdin === "string" ? options.stdin : readStdin();
+      const parsed = parseStdinJson(raw);
+      if (!parsed.ok) {
+        if (advisory && !strict) {
+          errLog(`CodeRifts claude-hook: ${parsed.reason} \u2014 allowing (CODERIFTS_ADVISORY)`);
+          return emitTerminal({ exitCode: 0, reason: "stdin_unparseable", site: "stdin_unparseable" });
         }
-        return yaml.load(trimmed);
-      } catch (_) {
-        return null;
-      }
-    }
-    function validateOpenApiSpec(parsed) {
-      if (!parsed || typeof parsed !== "object") {
-        return { valid: false, error: "Not a valid YAML or JSON object" };
+        errLog(`CodeRifts claude-hook: ${PARSE_GAP_STDERR}`);
+        return emitTerminal({ exitCode: 2, reason: "stdin_unparseable" });
       }
-      if (parsed.openapi) {
-        const ver = String(parsed.openapi);
-        if (ver.startsWith("3.")) {
-          return { valid: true, version: ver };
+      const { toolName, toolInput } = parsed;
+      tool = toolName;
+      const filePath = toolInput.file_path || toolInput.filePath || toolInput.path;
+      if (!filePath || typeof filePath !== "string") {
+        if (advisory && !strict) {
+          errLog("CodeRifts claude-hook: tool_input.file_path missing \u2014 allowing (CODERIFTS_ADVISORY)");
+          return emitTerminal({ exitCode: 0, reason: "missing_file_path", site: "missing_file_path" });
         }
-        return { valid: false, error: `Unsupported OpenAPI version: ${ver}` };
+        errLog(`CodeRifts claude-hook: ${PARSE_GAP_STDERR}`);
+        return emitTerminal({ exitCode: 2, reason: "missing_file_path" });
       }
-      if (parsed.swagger) {
-        const ver = String(parsed.swagger);
-        if (ver.startsWith("2.")) {
-          return { valid: true, version: ver };
-        }
-        return { valid: false, error: `Unsupported Swagger version: ${ver}` };
+      filePathKnown = filePath;
+      const specPath = resolveSpecPath({ ...deps, cwd });
+      if (!isSpecPath(filePath, specPath)) {
+        logEv({ type: "detection_skip", signals: ["not_spec_path"], tool, path: filePath });
+        return emitTerminal({ exitCode: 0, reason: "not_spec_path" });
       }
-      return { valid: false, error: "Missing required field: 'openapi' or 'swagger'" };
-    }
-    function extractEndpoints(parsed) {
-      const endpoints = [];
-      const paths = parsed.paths || {};
-      const httpMethods = ["get", "post", "put", "patch", "delete", "head", "options"];
-      for (const [path, pathItem] of Object.entries(paths)) {
-        if (!pathItem || typeof pathItem !== "object") continue;
-        for (const method of httpMethods) {
-          if (pathItem[method]) {
-            endpoints.push({
-              path,
-              method: method.toUpperCase(),
-              operationId: pathItem[method].operationId || ""
-            });
-          }
+      const absPath = path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
+      let diskBefore = "";
+      if (exists(absPath)) {
+        try {
+          diskBefore = readFile(absPath, "utf8");
+        } catch (e) {
+          logEv({ type: "preflight_unavailable", cause: "disk_unreadable", tool, path: filePath });
+          return emitTerminal(failClosedOrAdvisory({
+            advisory,
+            strict,
+            site: "disk_unreadable",
+            why: `cannot read contract file ${absPath}`,
+            softMsg: `CodeRifts claude-hook: cannot read ${absPath} \u2014 allowing (soft)`,
+            errLog
+          }));
         }
       }
-      return endpoints;
-    }
-    function extractSchemaNames(parsed) {
-      const schemas = [];
-      const components = parsed.components?.schemas || {};
-      for (const [name, schema] of Object.entries(components)) {
-        const hash = JSON.stringify(schema);
-        schemas.push({ name, hash });
+      const derived = deriveAfterContent(toolName, toolInput, diskBefore);
+      if (!derived.ok) {
+        logEv({ type: "preflight_unavailable", cause: "edit_apply_failed", tool, path: filePath });
+        return emitTerminal(failClosedOrAdvisory({
+          advisory,
+          strict,
+          site: "edit_apply_failed",
+          why: derived.reason,
+          softMsg: `CodeRifts claude-hook: ${derived.reason} \u2014 allowing (soft; never guess edit apply)`,
+          errLog
+        }));
       }
-      return schemas;
-    }
-    function extractDefinedScopes(parsed) {
-      const scopes = /* @__PURE__ */ new Set();
-      const schemes = parsed.components?.securitySchemes || {};
-      for (const scheme of Object.values(schemes)) {
-        if (scheme.type === "oauth2" && scheme.flows) {
-          for (const flow of Object.values(scheme.flows)) {
-            if (flow.scopes) {
-              for (const scope of Object.keys(flow.scopes)) {
-                scopes.add(scope);
-              }
-            }
-          }
-        }
+      if (diskBefore === derived.after) {
+        logEv({ type: "detection_skip", signals: ["identical"], tool, path: filePath });
+        return emitTerminal({ exitCode: 0, reason: "identical" });
       }
-      return scopes;
-    }
-    function extractUsedScopes(parsed) {
-      const scopes = /* @__PURE__ */ new Set();
-      if (Array.isArray(parsed.security)) {
-        for (const req of parsed.security) {
-          for (const scopeList of Object.values(req)) {
-            if (Array.isArray(scopeList)) {
-              for (const s of scopeList) scopes.add(s);
-            }
-          }
-        }
-      }
-      const paths = parsed.paths || {};
-      const httpMethods = ["get", "post", "put", "patch", "delete", "head", "options"];
-      for (const pathItem of Object.values(paths)) {
-        if (!pathItem || typeof pathItem !== "object") continue;
-        for (const method of httpMethods) {
-          const op = pathItem[method];
-          if (op?.security && Array.isArray(op.security)) {
-            for (const req of op.security) {
-              for (const scopeList of Object.values(req)) {
-                if (Array.isArray(scopeList)) {
-                  for (const s of scopeList) scopes.add(s);
-                }
-              }
-            }
-          }
-        }
-      }
-      return scopes;
-    }
-    function extractRefs(obj, refs = /* @__PURE__ */ new Set()) {
-      if (!obj || typeof obj !== "object") return refs;
-      if (Array.isArray(obj)) {
-        for (const item of obj) extractRefs(item, refs);
-        return refs;
-      }
-      for (const [key, value] of Object.entries(obj)) {
-        if (key === "$ref" && typeof value === "string") {
-          refs.add(value);
-        } else {
-          extractRefs(value, refs);
-        }
-      }
-      return refs;
-    }
-    function refResolves(parsed, ref) {
-      if (!ref.startsWith("#/")) return true;
-      const parts = ref.replace("#/", "").split("/");
-      let current = parsed;
-      for (const part of parts) {
-        if (!current || typeof current !== "object") return false;
-        current = current[part];
+      logEv({ type: "preflight_start", tool, path: filePath });
+      let result;
+      try {
+        result = await authorize(diskBefore, derived.after, apiKey, {
+          operation: "merge",
+          environment: "staging"
+        });
+      } catch (e) {
+        const msg = e && e.message ? String(e.message) : "request failed";
+        logEv({ type: "preflight_unavailable", cause: "api_unreachable", tool, path: filePath });
+        return emitTerminal(failClosedOrAdvisory({
+          advisory,
+          strict,
+          site: "api_unreachable",
+          why: `API unreachable: ${msg}`,
+          softMsg: `CodeRifts claude-hook: API unreachable (${msg}) \u2014 allowing (soft; availability must not brick the editor)`,
+          errLog
+        }));
       }
-      return current !== void 0;
-    }
-    function validateRegistry(specs) {
-      if (!Array.isArray(specs) || specs.length === 0) {
-        return { valid: true, issues: [], stats: { specs_count: 0, endpoints_count: 0, schemas_count: 0 } };
+      const mapped = mapDecisionSeverity(result);
+      const fingerprint = extractFingerprint(result);
+      const idPart = mapped.decisionId ? ` decision_id=${mapped.decisionId}` : "";
+      const decPart = mapped.decision ? ` decision=${mapped.decision}` : "";
+      const eaPart = mapped.executionAction ? ` execution_action=${mapped.executionAction}` : "";
+      const actionForLog = mapped.executionAction || (mapped.severity === "BLOCK" || mapped.severity === "UNKNOWN" || mapped.severity === "INDETERMINATE" ? "STOP" : mapped.severity === "REQUIRE_APPROVAL" ? "REQUEST_APPROVAL" : mapped.severity === "MONITOR" || mapped.severity === "WARN" ? "CONTINUE_WITH_MONITORING" : "CONTINUE");
+      logEv({
+        type: "preflight_result",
+        action: actionForLog,
+        decisionId: mapped.decisionId || void 0,
+        fingerprint,
+        tool,
+        path: filePath
+      });
+      if (mapped.severity === "INDETERMINATE") {
+        errLog(
+          "CodeRifts claude-hook: BLOCKED (indeterminate response \u2014 no execution_action and no decision; not permission)"
+        );
+        return emitTerminal({
+          exitCode: 2,
+          reason: "indeterminate",
+          severity: "INDETERMINATE",
+          decision: mapped.decision,
+          decisionId: mapped.decisionId
+        });
       }
-      const issues = [];
-      const parsedSpecs = [];
-      for (const { name, spec } of specs) {
-        const parsed = safeParse(spec);
-        if (!parsed) {
-          issues.push({
-            severity: "error",
-            type: "parse_error",
-            message: `Could not parse spec '${name}' as valid YAML or JSON`,
-            specs: [name]
-          });
-          continue;
-        }
-        const validation = validateOpenApiSpec(parsed);
-        if (!validation.valid) {
-          issues.push({
-            severity: "error",
-            type: "invalid_spec",
-            message: `Spec '${name}' is not a valid OpenAPI document: ${validation.error}`,
-            specs: [name]
-          });
-          continue;
-        }
-        parsedSpecs.push({ name, parsed });
+      if (mapped.severity === "BLOCK" || mapped.severity === "UNKNOWN") {
+        const why = renderDecisionWhy(result);
+        errLog(
+          [
+            `CodeRifts claude-hook: BLOCKED${decPart}${eaPart}${idPart}` + (mapped.severity === "UNKNOWN" ? " (unrecognised execution_action)" : ""),
+            ...why.lines
+          ].join("\n")
+        );
+        return emitTerminal({
+          exitCode: 2,
+          reason: mapped.severity === "UNKNOWN" ? "unknown_action" : "block",
+          severity: mapped.severity,
+          decision: mapped.decision,
+          decisionId: mapped.decisionId,
+          reasons: why.reasonCodes
+        });
       }
-      const endpointMap = /* @__PURE__ */ new Map();
-      for (const { name, parsed } of parsedSpecs) {
-        const endpoints = extractEndpoints(parsed);
-        for (const ep of endpoints) {
-          const key = `${ep.method} ${ep.path}`;
-          if (!endpointMap.has(key)) endpointMap.set(key, []);
-          endpointMap.get(key).push({ spec: name, operationId: ep.operationId });
-        }
+      if (mapped.severity === "REQUIRE_APPROVAL") {
+        const why = renderDecisionWhy(result);
+        errLog(
+          [
+            `CodeRifts claude-hook: BLOCKED approval_required${decPart}${eaPart}${idPart}`,
+            ...why.lines
+          ].join("\n")
+        );
+        return emitTerminal({
+          exitCode: 2,
+          reason: "approval_required",
+          severity: mapped.severity,
+          decision: mapped.decision,
+          decisionId: mapped.decisionId,
+          reasons: why.reasonCodes
+        });
       }
-      for (const [endpoint, owners] of endpointMap) {
-        if (owners.length > 1) {
-          const specNames = owners.map((o) => o.spec);
-          issues.push({
-            severity: "warning",
-            type: "endpoint_collision",
-            message: `Endpoint '${endpoint}' is defined in multiple specs: ${specNames.join(", ")}`,
-            specs: specNames
+      if (mapped.severity === "MONITOR" || mapped.severity === "WARN") {
+        const sinkWired = isMonitoringSinkWired({ env, deps, result });
+        if (!sinkWired) {
+          errLog(
+            `CodeRifts claude-hook: BLOCKED monitoring_unwired${decPart}${eaPart}${idPart} \u2014 CONTINUE_WITH_MONITORING requires CODERIFTS_MONITORING_SINK_WIRED=1 (host assertion; not delivery proof)`
+          );
+          return emitTerminal({
+            exitCode: 2,
+            reason: "monitoring_unwired",
+            severity: mapped.severity === "WARN" ? "MONITOR" : mapped.severity,
+            decision: mapped.decision,
+            decisionId: mapped.decisionId
           });
         }
+        errLog(renderAllowProofBlock({
+          decision: mapped.decision,
+          executionAction: mapped.executionAction,
+          decisionId: mapped.decisionId,
+          fingerprint
+        }));
+        return emitTerminal({
+          exitCode: 0,
+          reason: "allow",
+          severity: mapped.severity === "WARN" ? "MONITOR" : mapped.severity,
+          decision: mapped.decision,
+          decisionId: mapped.decisionId,
+          fingerprint
+        });
       }
-      const schemaMap = /* @__PURE__ */ new Map();
-      for (const { name, parsed } of parsedSpecs) {
-        const schemas = extractSchemaNames(parsed);
-        for (const s of schemas) {
-          if (!schemaMap.has(s.name)) schemaMap.set(s.name, []);
-          schemaMap.get(s.name).push({ spec: name, hash: s.hash });
-        }
-      }
-      for (const [schemaName, definitions] of schemaMap) {
-        if (definitions.length > 1) {
-          const uniqueHashes = new Set(definitions.map((d) => d.hash));
-          if (uniqueHashes.size > 1) {
-            const specNames = definitions.map((d) => d.spec);
-            issues.push({
-              severity: "warning",
-              type: "schema_conflict",
-              message: `Schema '${schemaName}' has conflicting definitions across specs: ${specNames.join(", ")}`,
-              specs: specNames
-            });
-          }
-        }
-      }
-      for (const { name, parsed } of parsedSpecs) {
-        const defined = extractDefinedScopes(parsed);
-        const used = extractUsedScopes(parsed);
-        for (const scope of used) {
-          if (!defined.has(scope)) {
-            issues.push({
-              severity: "warning",
-              type: "undefined_scope",
-              message: `Scope '${scope}' is used in '${name}' but not defined in securitySchemes`,
-              specs: [name]
-            });
-          }
-        }
-        for (const scope of defined) {
-          if (!used.has(scope)) {
-            issues.push({
-              severity: "info",
-              type: "unused_scope",
-              message: `Scope '${scope}' is defined in '${name}' but never used in any operation`,
-              specs: [name]
-            });
-          }
-        }
-      }
-      for (const { name, parsed } of parsedSpecs) {
-        const refs = extractRefs(parsed);
-        for (const ref of refs) {
-          if (!refResolves(parsed, ref)) {
-            issues.push({
-              severity: "error",
-              type: "unresolved_ref",
-              message: `$ref '${ref}' in '${name}' does not resolve`,
-              specs: [name]
-            });
-          }
-        }
-      }
-      let totalEndpoints = 0;
-      let totalSchemas = 0;
-      for (const { parsed } of parsedSpecs) {
-        totalEndpoints += extractEndpoints(parsed).length;
-        totalSchemas += extractSchemaNames(parsed).length;
-      }
-      const hasErrors = issues.some((i) => i.severity === "error");
-      return {
-        valid: !hasErrors,
-        issues,
-        stats: {
-          specs_count: parsedSpecs.length,
-          endpoints_count: totalEndpoints,
-          schemas_count: totalSchemas
-        }
-      };
+      errLog(renderAllowProofBlock({
+        decision: mapped.decision,
+        executionAction: mapped.executionAction,
+        decisionId: mapped.decisionId,
+        fingerprint
+      }));
+      return emitTerminal({
+        exitCode: 0,
+        reason: "allow",
+        severity: "ALLOW",
+        decision: mapped.decision,
+        decisionId: mapped.decisionId,
+        fingerprint
+      });
     }
     module2.exports = {
-      validateRegistry,
-      safeParse,
-      validateOpenApiSpec,
-      // Exported for testing
-      extractEndpoints,
-      extractSchemaNames,
-      extractDefinedScopes,
-      extractUsedScopes,
-      extractRefs,
-      refResolves
+      runClaudeHook,
+      parseStdinJson,
+      isSpecPath,
+      deriveAfterContent,
+      mapDecisionSeverity,
+      renderDecisionWhy,
+      resolveApiKey,
+      resolveSpecPath,
+      readGitConfig,
+      isEnvFlag,
+      isStrictMode,
+      isAdvisoryMode,
+      isMonitoringSinkWired,
+      failClosedOrAdvisory,
+      softOrStrictBlock,
+      DEFAULT_SPEC_PATH,
+      CLOSED_ACTIONS,
+      USAGE,
+      appendGuardEventLog,
+      extractFingerprint,
+      fingerprintPrefix,
+      renderAllowProofBlock,
+      HOOK_TRIGGER_SOURCE
     };
   }
 });
 
-// src/commands/registry-gate.js
-var require_registry_gate = __commonJS({
-  "src/commands/registry-gate.js"(exports2, module2) {
+// src/commands/deploy-gate.js
+var require_deploy_gate2 = __commonJS({
+  "src/commands/deploy-gate.js"(exports2, module2) {
     "use strict";
     var fs = require("fs");
     var path = require("path");
     var chalk = require_source();
-    var { matchGlob } = require_cjs3();
-    var {
-      validateRegistry,
-      safeParse,
-      validateOpenApiSpec
-    } = require_registry_validation_core();
+    var { deployGate } = require_cjs3();
+    var { renderJson } = require_json2();
+    var { renderDecisionWhy, isEnvFlag } = require_claude_hook();
     if (process.env.NO_COLOR) chalk.level = 0;
-    var SPEC_EXT = /* @__PURE__ */ new Set([".yaml", ".yml", ".json"]);
-    function walkSpecCandidates(rootDir, {
-      readdirSync = fs.readdirSync.bind(fs),
-      statSync = fs.statSync.bind(fs)
-    } = {}) {
-      const out = [];
-      function walk(absDir) {
-        let entries;
-        try {
-          entries = readdirSync(absDir, { withFileTypes: true });
-        } catch (err) {
-          const e = new Error(`Cannot read directory ${absDir}: ${err && err.message}`);
-          e.code = "GATE_ERROR";
-          e.path = absDir;
-          throw e;
-        }
-        for (const ent of entries) {
-          const name = ent.name;
-          if (name === "node_modules" || name.startsWith(".")) continue;
-          const abs = path.join(absDir, name);
-          let isDir = ent.isDirectory && ent.isDirectory();
-          let isFile = ent.isFile && ent.isFile();
-          if (!isDir && !isFile) {
-            try {
-              const st = statSync(abs);
-              isDir = st.isDirectory();
-              isFile = st.isFile();
-            } catch (err) {
-              const e = new Error(`Cannot stat ${abs}: ${err && err.message}`);
-              e.code = "GATE_ERROR";
-              e.path = abs;
-              throw e;
-            }
-          }
-          if (isDir) {
-            walk(abs);
-            continue;
-          }
-          if (isFile) {
-            const ext = path.extname(name).toLowerCase();
-            if (SPEC_EXT.has(ext)) out.push(abs);
-          }
-        }
-      }
-      walk(rootDir);
-      return out.sort();
+    var REPAIRABLE = /* @__PURE__ */ new Set(["env_mismatch", "stale_artifact", "operation_mismatch", "receipt_not_authorized", "fingerprint_mismatch", "body_hash_mismatch"]);
+    function enforceSignal(options) {
+      return options && options.enforce === true || String(process.env.CODERIFTS_DEPLOY_ENFORCE || "").toLowerCase() === "true";
     }
-    function relPosix(rootDir, absPath) {
-      let rel = path.relative(rootDir, absPath);
-      if (path.sep !== "/") rel = rel.split(path.sep).join("/");
-      return rel;
+    function isDeployAdvisory(env) {
+      const e = env || process.env;
+      return isEnvFlag(e, "CODERIFTS_DEPLOY_ADVISORY") || isEnvFlag(e, "CODERIFTS_ADVISORY");
     }
-    function readFileThreeState(absPath, readFileSync = fs.readFileSync.bind(fs)) {
-      try {
-        const content = readFileSync(absPath, "utf8");
-        return { ok: true, content: content == null ? "" : String(content) };
-      } catch (err) {
-        const msg = err && err.message ? String(err.message) : String(err);
-        return {
-          ok: false,
-          code: "GATE_ERROR",
-          message: `unreadable file: ${absPath} (${msg.slice(0, 200)})`,
-          path: absPath
-        };
+    function observeCDEnforcement(options = {}) {
+      const envVal = String(process.env.CODERIFTS_DEPLOY_ENFORCE || "").toLowerCase();
+      let enforcement;
+      if (enforceSignal(options)) enforcement = "ENFORCING";
+      else if (envVal === "unknown") enforcement = "UNKNOWN";
+      else enforcement = "ADVISORY";
+      const bypass_possible = String(process.env.CODERIFTS_DEPLOY_NO_BYPASS || "").toLowerCase() !== "true";
+      return {
+        enforcement,
+        bypass_possible,
+        step_is_required: enforcement === "ENFORCING",
+        required_step_name: "CodeRifts / deploy-gate",
+        attestation_source: "cli_flag"
+      };
+    }
+    function deployReportResiduals(state, enforcement_inescapable, enforcement, change_set_rebound) {
+      const out = [];
+      if (state !== "success") return out;
+      if (enforcement_inescapable !== true) {
+        if (enforcement === "ENFORCING") out.push("bypass_open");
+        else if (enforcement === "ADVISORY") out.push("deploy_gate_advisory");
+        else if (enforcement === "ABSENT") out.push("deploy_path_ungated");
+      }
+      if (change_set_rebound !== true) {
+        out.push("change_set_not_rebound");
       }
+      return out;
     }
-    function discoverRegistrySpecs(dir, {
-      glob = null,
-      readdirSync = fs.readdirSync.bind(fs),
-      readFileSync = fs.readFileSync.bind(fs),
-      statSync = fs.statSync.bind(fs)
-    } = {}) {
-      const rootDir = path.resolve(dir);
-      let candidates;
-      try {
-        candidates = walkSpecCandidates(rootDir, { readdirSync, statSync });
-      } catch (err) {
+    function deployCoverageInput(enforcement_state, inescapable_deploy) {
+      return { enforcement_state, inescapable_deploy: inescapable_deploy === true, applicability_attested: true };
+    }
+    function deployBind({ environment, artifact_id, receipt, observed_cd_enforcement, expected_fingerprint, expected_body_hash }) {
+      const attested_enforcement = observed_cd_enforcement && observed_cd_enforcement.enforcement || "UNKNOWN";
+      if (!receipt) {
         return {
-          ok: false,
-          code: err.code || "GATE_ERROR",
-          message: err.message || String(err),
-          path: err.path
+          deploy_check_status: "pending",
+          reason: "no_receipt",
+          must_re_preflight: true,
+          attested_enforcement,
+          gate: null,
+          report_residuals: [],
+          coverage_deploy_input: deployCoverageInput(attested_enforcement, false)
         };
       }
-      if (glob) {
-        candidates = candidates.filter((abs) => matchGlob(glob, relPosix(rootDir, abs)));
-      }
-      const specs = [];
-      let skippedNonSpec = 0;
-      for (const abs of candidates) {
-        const read = readFileThreeState(abs, readFileSync);
-        if (!read.ok) {
-          return {
-            ok: false,
-            code: "GATE_ERROR",
-            message: read.message,
-            path: read.path || abs
-          };
-        }
-        const name = relPosix(rootDir, abs);
-        const parsed = safeParse(read.content);
-        if (!parsed || typeof parsed !== "object") {
-          specs.push({ name, spec: read.content });
-          continue;
+      const requiredContext = {
+        operation: "deploy",
+        enforcement: {
+          enforcement: attested_enforcement,
+          // fail-closed: bypass is possible unless observation proved it disabled.
+          bypass_possible: !(observed_cd_enforcement && observed_cd_enforcement.bypass_possible === false)
         }
-        const shape = validateOpenApiSpec(parsed);
-        if (!shape.valid) {
-          if (shape.error && shape.error.includes("Missing required field: 'openapi' or 'swagger'")) {
-            skippedNonSpec += 1;
-            continue;
-          }
-          specs.push({ name, spec: read.content });
-          continue;
+      };
+      let change_set_rebound = false;
+      if (attested_enforcement === "ENFORCING") {
+        if (expected_fingerprint != null) {
+          requiredContext.expected_fingerprint = expected_fingerprint;
+          change_set_rebound = true;
         }
-        specs.push({ name, spec: read.content });
+        if (expected_body_hash != null) requiredContext.expected_body_hash = expected_body_hash;
       }
+      const gate = deployGate({ deployTarget: { environment, artifact_id }, receipt, requiredContext });
+      const enforcement_inescapable = attested_enforcement === "ENFORCING" && !!(observed_cd_enforcement && observed_cd_enforcement.bypass_possible === false);
+      const inescapable_deploy = gate.inescapable_deploy === true && change_set_rebound === true;
       return {
-        ok: true,
-        specs,
-        skippedNonSpec,
-        candidates: candidates.length,
-        rootDir
+        deploy_check_status: gate.state,
+        reason: gate.reason,
+        must_re_preflight: REPAIRABLE.has(gate.reason),
+        attested_enforcement,
+        gate: { deploy_allowed: gate.deploy_allowed, reason: gate.reason, inescapable_deploy },
+        report_residuals: deployReportResiduals(gate.state, enforcement_inescapable, attested_enforcement, change_set_rebound),
+        coverage_deploy_input: deployCoverageInput(attested_enforcement, inescapable_deploy)
       };
     }
-    function findingsFailGate(issues, { warnOnly = false, errorsOnly = false } = {}) {
-      if (warnOnly) return false;
-      for (const i of issues || []) {
-        if (i.severity === "error") return true;
-        if (i.severity === "warning" && !errorsOnly) return true;
+    function clampExit(deployCheckStatus, advisory) {
+      if (deployCheckStatus === "success") return 0;
+      if (advisory === true) return 0;
+      return 1;
+    }
+    var ADVISORY_LABEL = "ADVISORY MODE \u2014 this gate did not block";
+    var SOFTEN_HINT = "set CODERIFTS_DEPLOY_ADVISORY=1 to soften";
+    function renderPolicyStderr(bind, receipt, advisory) {
+      const lines = [
+        `CodeRifts deploy-gate: BLOCKED reason=${bind.reason} status=${bind.deploy_check_status}`
+      ];
+      if (receipt && typeof receipt === "object") {
+        const why = renderDecisionWhy(receipt);
+        for (const l of why.lines) lines.push(l);
       }
-      return false;
+      if (bind.must_re_preflight) {
+        lines.push("- action: re-preflight this { environment, artifact } \u2014 the receipt does not authorize it.");
+      }
+      lines.push(advisory ? ADVISORY_LABEL : SOFTEN_HINT);
+      return lines.join("\n");
     }
-    function countBySeverity(issues) {
-      const c = { error: 0, warning: 0, info: 0 };
-      for (const i of issues || []) {
+    function renderInfraStderr({ site, why, retryable = true, advisory = false }) {
+      const lines = [
+        `CodeRifts deploy-gate: INFRA ${site} \u2014 ${why}`,
+        `- retryable: ${retryable ? "true" : "false"}`,
+        "- this is not a policy BLOCK"
+      ];
+      lines.push(advisory ? ADVISORY_LABEL : SOFTEN_HINT);
+      return lines.join("\n");
+    }
+    function inspectReceiptFile(filePath) {
+      if (!filePath) return { kind: "absent", receipt: null };
+      const resolved = path.resolve(filePath);
+      if (!fs.existsSync(resolved)) return { kind: "missing_file", receipt: null };
+      try {
+        const parsed = JSON.parse(fs.readFileSync(resolved, "utf-8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+          return { kind: "malformed", receipt: null };
+        }
+        return { kind: "ok", receipt: parsed };
+      } catch (_) {
+        return { kind: "malformed", receipt: null };
+      }
+    }
+    function readReceiptFile(filePath) {
+      return inspectReceiptFile(filePath).receipt;
+    }
+    function extractDecisionIdFromReceipt(receipt) {
+      if (!receipt || typeof receipt !== "object") return null;
+      if (typeof receipt.decision_id === "string" && receipt.decision_id.trim()) {
+        return receipt.decision_id.trim();
+      }
+      const nested = receipt.decision_result;
+      if (nested && typeof nested === "object" && typeof nested.decision_id === "string" && nested.decision_id.trim()) {
+        return nested.decision_id.trim();
+      }
+      return null;
+    }
+    function formatOutcomeReportHint(decisionId) {
+      const id = String(decisionId);
+      return [
+        "# report the deploy outcome after your deploy step:",
+        `coderifts outcome <deploy_succeeded|deploy_failed|rolled_back> --decision ${id}`
+      ].join("\n");
+    }
+    function renderDeployGateTerminal(bind, enforce) {
+      const g = bind.gate;
+      const color = bind.deploy_check_status === "success" ? chalk.green : bind.deploy_check_status === "failure" ? chalk.red : chalk.yellow;
+      const lines = [];
+      lines.push("");
+      lines.push(chalk.bold(`  CodeRifts deploy-gate \u2014 ${color(bind.deploy_check_status.toUpperCase())}`));
+      lines.push(`  Reason:             ${bind.reason}`);
+      lines.push(`  Enforcement:        ${bind.attested_enforcement}`);
+      lines.push(`  inescapable_deploy: ${g ? g.inescapable_deploy : false}`);
+      if (bind.report_residuals.length) lines.push(`  Residuals:          ${bind.report_residuals.join(", ")}`);
+      if (bind.must_re_preflight) lines.push(chalk.yellow("  Action: re-preflight this { environment, artifact } \u2014 the receipt does not authorize it."));
+      lines.push("");
+      lines.push(enforce ? chalk.dim("  Attested ENFORCING (inescapable_deploy claim). Exit is fail-closed by default.") : chalk.dim("  Fail-closed default \u2014 a failing gate exits non-zero. " + SOFTEN_HINT + "."));
+      lines.push("");
+      return lines.join("\n");
+    }
+    async function runDeployGate(options = {}) {
+      const env = options.envObj || process.env;
+      const advisory = isDeployAdvisory(env);
+      const errLog = options.errLog || ((m) => console.error(String(m)));
+      const outLog = options.outLog || ((m) => console.log(String(m)));
+      const exitFn = options.exitFn || ((code2) => {
+        process.exit(code2);
+      });
+      const environment = options.env;
+      const artifactId = options.artifact;
+      if (!environment || !artifactId) {
+        errLog(renderInfraStderr({
+          site: "missing_inputs",
+          why: "--env and --artifact are required",
+          retryable: true,
+          advisory
+        }));
+        exitFn(advisory ? 0 : 1);
+        return { exitCode: advisory ? 0 : 1, failure_class: "infra" };
+      }
+      const enforce = enforceSignal(options);
+      const inspected = inspectReceiptFile(options.receipt);
+      if (inspected.kind === "malformed") {
+        errLog(renderInfraStderr({
+          site: "malformed_receipt",
+          why: `receipt file is not valid JSON: ${options.receipt}`,
+          retryable: true,
+          advisory
+        }));
+        exitFn(advisory ? 0 : 1);
+        return { exitCode: advisory ? 0 : 1, failure_class: "infra" };
+      }
+      const receipt = inspected.receipt;
+      const observed = observeCDEnforcement({ enforce });
+      const bind = deployBind({ environment, artifact_id: artifactId, receipt, observed_cd_enforcement: observed });
+      const code = clampExit(bind.deploy_check_status, advisory);
+      const decisionId = extractDecisionIdFromReceipt(receipt);
+      const failureClass = bind.deploy_check_status === "success" ? null : "policy";
+      if (bind.deploy_check_status !== "success") {
+        errLog(renderPolicyStderr(bind, receipt, advisory));
+      } else if (advisory) {
+        errLog(ADVISORY_LABEL);
+      }
+      if (options.json) {
+        outLog(renderJson({
+          command: "deploy-gate",
+          environment,
+          artifact_id: artifactId,
+          phase: advisory ? "advisory" : "fail_closed",
+          exit_code: code,
+          decision_id: decisionId,
+          failure_class: failureClass,
+          retryable: false,
+          ...bind
+        }));
+      } else {
+        outLog(renderDeployGateTerminal(bind, enforce));
+        if (decisionId) {
+          outLog(formatOutcomeReportHint(decisionId));
+          outLog("");
+        }
+      }
+      exitFn(code);
+      return { exitCode: code, failure_class: failureClass };
+    }
+    module2.exports = {
+      runDeployGate,
+      deployBind,
+      observeCDEnforcement,
+      clampExit,
+      readReceiptFile,
+      inspectReceiptFile,
+      extractDecisionIdFromReceipt,
+      formatOutcomeReportHint,
+      renderDeployGateTerminal,
+      renderPolicyStderr,
+      renderInfraStderr,
+      isDeployAdvisory,
+      ADVISORY_LABEL,
+      SOFTEN_HINT
+    };
+  }
+});
+
+// src/commands/publish-gate.js
+var require_publish_gate = __commonJS({
+  "src/commands/publish-gate.js"(exports2, module2) {
+    "use strict";
+    var fs = require("fs");
+    var path = require("path");
+    var { execFileSync } = require("child_process");
+    var chalk = require_source();
+    var { getApiKey } = require_config();
+    var { cloudDiff } = require_cloud();
+    if (process.env.NO_COLOR) chalk.level = 0;
+    var ZERO_SHA = "0000000000000000000000000000000000000000";
+    var CLOSED_ACTIONS = /* @__PURE__ */ new Set([
+      "CONTINUE",
+      "CONTINUE_WITH_MONITORING",
+      "REQUEST_APPROVAL",
+      "STOP"
+    ]);
+    var PERMIT_ACTIONS = /* @__PURE__ */ new Set(["CONTINUE", "CONTINUE_WITH_MONITORING"]);
+    function defaultGit(args, cwd) {
+      return execFileSync("git", args, {
+        cwd: cwd || process.cwd(),
+        encoding: "utf8",
+        maxBuffer: 16 * 1024 * 1024,
+        stdio: ["ignore", "pipe", "pipe"]
+      }).trim();
+    }
+    function gitShow(ref, filePath, { gitImpl = defaultGit, cwd } = {}) {
+      try {
+        const out = gitImpl(["show", `${ref}:${filePath}`], cwd);
+        return { ok: true, content: out == null ? "" : String(out) };
+      } catch (err) {
+        const msg = err && err.stderr ? String(err.stderr) : err && err.message || String(err);
+        return {
+          ok: false,
+          code: "GIT_ERROR",
+          message: `git error reading ${ref}:${filePath}: ${msg.slice(0, 300)}`
+        };
+      }
+    }
+    function readPackageVersion(cwd, readFile = fs.readFileSync) {
+      const pkgPath = path.join(cwd || process.cwd(), "package.json");
+      try {
+        const raw = readFile(pkgPath, "utf8");
+        const pkg2 = JSON.parse(raw);
+        return pkg2 && typeof pkg2.version === "string" ? pkg2.version : null;
+      } catch {
+        return null;
+      }
+    }
+    function resolveBeforeSpec(specPath, {
+      gitImpl = defaultGit,
+      cwd = process.cwd(),
+      readFile = fs.readFileSync,
+      packageVersion = null
+    } = {}) {
+      const version = packageVersion != null ? packageVersion : readPackageVersion(cwd, readFile);
+      const tried = [];
+      if (version) {
+        const tags = [`v${version}`, version];
+        for (const tag of tags) {
+          tried.push(`tag:${tag}`);
+          try {
+            gitImpl(["rev-parse", "--verify", `${tag}^{commit}`], cwd);
+          } catch {
+            continue;
+          }
+          const shown = gitShow(tag, specPath, { gitImpl, cwd });
+          if (!shown.ok) {
+            return {
+              ok: false,
+              code: shown.code || "GIT_ERROR",
+              message: shown.message,
+              tried
+            };
+          }
+          if (shown.content.trim() === "") {
+            return {
+              ok: false,
+              code: "EMPTY_BEFORE",
+              message: `Empty contract artifact at tag ${tag}:${specPath}. Refusing to treat empty before as NEW_ARTIFACT (would false-pass enforce).`,
+              tried
+            };
+          }
+          return { ok: true, content: shown.content, source: `tag:${tag}`, tried };
+        }
+      } else {
+        tried.push("package.json:version (missing)");
+      }
+      const bases = ["origin/main", "origin/master", "main", "master"];
+      for (const base of bases) {
+        tried.push(`merge-base:${base}`);
+        let mb;
+        try {
+          mb = gitImpl(["merge-base", "HEAD", base], cwd);
+        } catch {
+          continue;
+        }
+        if (!mb || mb === ZERO_SHA) continue;
+        const shown = gitShow(mb, specPath, { gitImpl, cwd });
+        if (!shown.ok) {
+          return {
+            ok: false,
+            code: shown.code || "GIT_ERROR",
+            message: shown.message,
+            tried
+          };
+        }
+        if (shown.content.trim() === "") {
+          return {
+            ok: false,
+            code: "EMPTY_BEFORE",
+            message: `Empty contract artifact at merge-base ${mb}:${specPath} (${base}). Refusing to treat empty before as NEW_ARTIFACT (would false-pass enforce).`,
+            tried
+          };
+        }
+        return {
+          ok: true,
+          content: shown.content,
+          source: `merge-base:${base}@${mb.slice(0, 12)}`,
+          tried
+        };
+      }
+      return {
+        ok: false,
+        code: "BEFORE_UNRESOLVED",
+        message: `Could not resolve a non-empty before-spec for ${specPath}. Tried: (a) git tag of package.json version, (b) merge-base with origin/main. Attempts: ${tried.join(", ")}. Fail-closed \u2014 will not publish without a baseline.`,
+        tried
+      };
+    }
+    function resolveAfterSpec(specPath, {
+      cwd = process.cwd(),
+      readFile = fs.readFileSync,
+      exists = fs.existsSync
+    } = {}) {
+      const resolved = path.isAbsolute(specPath) ? specPath : path.join(cwd, specPath);
+      try {
+        if (!exists(resolved)) {
+          return {
+            ok: false,
+            code: "AFTER_MISSING",
+            message: `Working-tree contract artifact not found: ${specPath}`
+          };
+        }
+        const content = readFile(resolved, "utf8");
+        if (content == null || String(content).trim() === "") {
+          return {
+            ok: false,
+            code: "AFTER_EMPTY",
+            message: `Working-tree contract artifact is empty: ${specPath}`
+          };
+        }
+        return { ok: true, content: String(content), path: resolved };
+      } catch (err) {
+        return {
+          ok: false,
+          code: "AFTER_READ_ERROR",
+          message: `Failed to read working-tree ${specPath}: ${err && err.message}`
+        };
+      }
+    }
+    function evaluatePublishPermission(result) {
+      if (!result || typeof result !== "object") {
+        return {
+          allow: false,
+          execution_action: null,
+          decision: null,
+          policy: "fail_closed:unreadable_response"
+        };
+      }
+      const env = result.decision_result && typeof result.decision_result === "object" ? result.decision_result : null;
+      let ea = null;
+      if (env && typeof env.execution_action === "string") ea = env.execution_action;
+      else if (typeof result.execution_action === "string") ea = result.execution_action;
+      const decision = env && env.decision || result.decision || result.omega_decision || null;
+      if (ea && CLOSED_ACTIONS.has(ea)) {
+        const allow = PERMIT_ACTIONS.has(ea);
+        return {
+          allow,
+          execution_action: ea,
+          decision: decision || null,
+          policy: allow ? `permit:execution_action=${ea}` : `block:execution_action=${ea}`
+        };
+      }
+      if (ea != null && ea !== "" && !CLOSED_ACTIONS.has(ea)) {
+        return {
+          allow: false,
+          execution_action: ea,
+          decision: decision || null,
+          policy: `block:unrecognised_execution_action=${ea}`
+        };
+      }
+      if (decision === "BLOCK" || decision === "REQUIRE_APPROVAL") {
+        return {
+          allow: false,
+          execution_action: null,
+          decision,
+          policy: `block:decision=${decision}`
+        };
+      }
+      if (decision === "ALLOW" || decision === "WARN" || decision === "PASS") {
+        return {
+          allow: true,
+          execution_action: null,
+          decision,
+          policy: `permit:decision=${decision}`
+        };
+      }
+      const omega = result.omega_decision;
+      if (omega === "BLOCK" || omega === "REQUIRE_APPROVAL") {
+        return {
+          allow: false,
+          execution_action: null,
+          decision: omega,
+          policy: `block:omega_decision=${omega}`
+        };
+      }
+      return {
+        allow: false,
+        execution_action: ea,
+        decision: decision || omega || null,
+        policy: "fail_closed:no_permission_signal"
+      };
+    }
+    function extractReceiptRef(result) {
+      if (!result || typeof result !== "object") return null;
+      const env = result.decision_result;
+      if (env && env.receipt && typeof env.receipt.token === "string") {
+        return env.receipt.token.slice(0, 24) + (env.receipt.token.length > 24 ? "\u2026" : "");
+      }
+      if (env && typeof env.decision_id === "string") return env.decision_id;
+      if (typeof result.decision_id === "string") return result.decision_id;
+      if (typeof result.fingerprint === "string") return result.fingerprint;
+      if (env && typeof env.fingerprint === "string") return env.fingerprint;
+      return null;
+    }
+    async function defaultPreflight(before, after, { apiKey } = {}) {
+      const key = process.env.CODERIFTS_FORCE_LOCAL_PREFLIGHT ? null : apiKey != null ? apiKey : getApiKey();
+      if (key) {
+        return cloudDiff(before, after, key);
+      }
+      const yaml = require_js_yaml();
+      const { diffSpecs } = require_api2();
+      let oldSpec;
+      let newSpec;
+      try {
+        oldSpec = yaml.load(before);
+        newSpec = yaml.load(after);
+      } catch (e) {
+        const err = new Error(`Failed to parse specs: ${e.message}`);
+        err.code = "PREFLIGHT_UNREACHABLE";
+        throw err;
+      }
+      let diffResult;
+      try {
+        diffResult = await diffSpecs({
+          sourceSpec: { content: JSON.stringify(oldSpec), location: "before.json", format: "openapi3" },
+          destinationSpec: { content: JSON.stringify(newSpec), location: "after.json", format: "openapi3" }
+        });
+      } catch (e) {
+        const err = new Error(`Local preflight engine error: ${e.message}`);
+        err.code = "PREFLIGHT_UNREACHABLE";
+        throw err;
+      }
+      const breaking = (diffResult.breakingDifferences || []).length;
+      const decision = breaking > 0 ? "BLOCK" : "ALLOW";
+      const execution_action = breaking > 0 ? "STOP" : "CONTINUE";
+      return {
+        decision,
+        omega_decision: decision,
+        execution_action,
+        decision_result: {
+          decision,
+          execution_action,
+          decision_id: `local-${Date.now()}`
+        },
+        breaking_changes: diffResult.breakingDifferences || [],
+        risk_score: Math.min(breaking * 15, 100)
+      };
+    }
+    async function runPublishGate(options = {}, deps = {}) {
+      const cwd = deps.cwd || process.cwd();
+      const gitImpl = deps.gitImpl || defaultGit;
+      const readFile = deps.readFile || fs.readFileSync.bind(fs);
+      const exists = deps.exists || fs.existsSync.bind(fs);
+      const preflightFn = deps.preflightFn || defaultPreflight;
+      const log = deps.log || console.log.bind(console);
+      const logErr = deps.logErr || console.error.bind(console);
+      let specPath = options.spec;
+      if (!specPath) {
+        try {
+          specPath = gitImpl(["config", "coderifts.specPath"], cwd);
+        } catch {
+          specPath = "";
+        }
+      }
+      if (!specPath) specPath = "api/openapi.yaml";
+      try {
+        gitImpl(["rev-parse", "--is-inside-work-tree"], cwd);
+      } catch (err) {
+        const msg = "CodeRifts publish-gate: GIT_ERROR \u2014 not a git repository (or git unavailable). Cannot resolve before-spec without git. Fail-closed.";
+        logErr(chalk.red(msg));
+        return finish({
+          ok: false,
+          exitCode: 1,
+          code: "GIT_ERROR",
+          message: msg,
+          policy: "fail_closed:git_error"
+        }, { log, json: options.json });
+      }
+      const beforeRes = resolveBeforeSpec(specPath, {
+        gitImpl,
+        cwd,
+        readFile,
+        packageVersion: deps.packageVersion
+      });
+      if (!beforeRes.ok) {
+        logErr(chalk.red(`CodeRifts publish-gate: ${beforeRes.code} \u2014 ${beforeRes.message}`));
+        return finish({
+          ok: false,
+          exitCode: 1,
+          code: beforeRes.code,
+          message: beforeRes.message,
+          policy: `fail_closed:${beforeRes.code}`,
+          tried: beforeRes.tried
+        }, { log, json: options.json });
+      }
+      const afterRes = resolveAfterSpec(specPath, { cwd, readFile, exists });
+      if (!afterRes.ok) {
+        logErr(chalk.red(`CodeRifts publish-gate: ${afterRes.code} \u2014 ${afterRes.message}`));
+        return finish({
+          ok: false,
+          exitCode: 1,
+          code: afterRes.code,
+          message: afterRes.message,
+          policy: `fail_closed:${afterRes.code}`
+        }, { log, json: options.json });
+      }
+      if (beforeRes.content === afterRes.content) {
+        const payload2 = {
+          ok: true,
+          exitCode: 0,
+          code: "UNCHANGED",
+          message: "Contract artifact unchanged vs baseline; publish permitted.",
+          policy: "permit:unchanged",
+          before_source: beforeRes.source,
+          execution_action: "CONTINUE",
+          receipt: null
+        };
+        if (!options.json) {
+          log(chalk.green("CodeRifts publish-gate: ALLOW (unchanged)"));
+          log(`  baseline: ${beforeRes.source}`);
+          log(`  spec:     ${specPath}`);
+        }
+        return finish(payload2, { log, json: options.json });
+      }
+      let result;
+      try {
+        result = await preflightFn(beforeRes.content, afterRes.content, {
+          apiKey: deps.apiKey,
+          cwd
+        });
+      } catch (err) {
+        const msg = `CodeRifts publish-gate: PREFLIGHT_UNREACHABLE \u2014 ${err && err.message}`;
+        logErr(chalk.red(msg));
+        return finish({
+          ok: false,
+          exitCode: 1,
+          code: "PREFLIGHT_UNREACHABLE",
+          message: msg,
+          policy: "fail_closed:preflight_unreachable"
+        }, { log, json: options.json });
+      }
+      const perm = evaluatePublishPermission(result);
+      const receipt = extractReceiptRef(result);
+      if (!perm.allow) {
+        const payload2 = {
+          ok: false,
+          exitCode: 1,
+          code: "BLOCK",
+          message: "Publish not permitted by execution_action / decision.",
+          policy: perm.policy,
+          execution_action: perm.execution_action,
+          decision: perm.decision,
+          before_source: beforeRes.source,
+          receipt,
+          fail_policy: "exit_1_on_block_or_resolver_error_or_unreachable"
+        };
+        if (!options.json) {
+          logErr("");
+          logErr(chalk.red("========================================"));
+          logErr(chalk.red("  CodeRifts: PUBLISH BLOCKED"));
+          logErr(chalk.red("========================================"));
+          logErr(`  Policy:            ${perm.policy}`);
+          logErr(`  execution_action:  ${perm.execution_action || "(none)"}`);
+          logErr(`  decision:          ${perm.decision || "(none)"}`);
+          logErr(`  baseline:          ${beforeRes.source}`);
+          logErr(`  fail policy:       exit 1 on BLOCK / resolver error / preflight unreachability`);
+          logErr(chalk.red("========================================"));
+          logErr("");
+        }
+        return finish(payload2, { log, json: options.json });
+      }
+      const payload = {
+        ok: true,
+        exitCode: 0,
+        code: "ALLOW",
+        message: "Publish permitted.",
+        policy: perm.policy,
+        execution_action: perm.execution_action,
+        decision: perm.decision,
+        before_source: beforeRes.source,
+        receipt
+      };
+      if (!options.json) {
+        log(chalk.green("CodeRifts publish-gate: ALLOW"));
+        log(`  Policy:            ${perm.policy}`);
+        log(`  execution_action:  ${perm.execution_action || "(mapped from decision)"}`);
+        log(`  baseline:          ${beforeRes.source}`);
+        if (receipt) log(`  Receipt reference: ${receipt}`);
+        else log("  Receipt reference: (none issued on this path)");
+      }
+      return finish(payload, { log, json: options.json });
+    }
+    function finish(payload, { log, json }) {
+      if (json) {
+        log(JSON.stringify(payload, null, 2));
+      }
+      return payload;
+    }
+    module2.exports = {
+      runPublishGate,
+      resolveBeforeSpec,
+      resolveAfterSpec,
+      evaluatePublishPermission,
+      extractReceiptRef,
+      gitShow,
+      defaultGit,
+      PERMIT_ACTIONS,
+      CLOSED_ACTIONS
+    };
+  }
+});
+
+// src/registry-validation-core.js
+var require_registry_validation_core = __commonJS({
+  "src/registry-validation-core.js"(exports2, module2) {
+    "use strict";
+    var yaml = require_js_yaml();
+    function safeParse(content) {
+      if (!content) return null;
+      try {
+        const trimmed = content.trim();
+        if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+          return JSON.parse(trimmed);
+        }
+        return yaml.load(trimmed);
+      } catch (_) {
+        return null;
+      }
+    }
+    function validateOpenApiSpec(parsed) {
+      if (!parsed || typeof parsed !== "object") {
+        return { valid: false, error: "Not a valid YAML or JSON object" };
+      }
+      if (parsed.openapi) {
+        const ver = String(parsed.openapi);
+        if (ver.startsWith("3.")) {
+          return { valid: true, version: ver };
+        }
+        return { valid: false, error: `Unsupported OpenAPI version: ${ver}` };
+      }
+      if (parsed.swagger) {
+        const ver = String(parsed.swagger);
+        if (ver.startsWith("2.")) {
+          return { valid: true, version: ver };
+        }
+        return { valid: false, error: `Unsupported Swagger version: ${ver}` };
+      }
+      return { valid: false, error: "Missing required field: 'openapi' or 'swagger'" };
+    }
+    function extractEndpoints(parsed) {
+      const endpoints = [];
+      const paths = parsed.paths || {};
+      const httpMethods = ["get", "post", "put", "patch", "delete", "head", "options"];
+      for (const [path, pathItem] of Object.entries(paths)) {
+        if (!pathItem || typeof pathItem !== "object") continue;
+        for (const method of httpMethods) {
+          if (pathItem[method]) {
+            endpoints.push({
+              path,
+              method: method.toUpperCase(),
+              operationId: pathItem[method].operationId || ""
+            });
+          }
+        }
+      }
+      return endpoints;
+    }
+    function extractSchemaNames(parsed) {
+      const schemas = [];
+      const components = parsed.components?.schemas || {};
+      for (const [name, schema] of Object.entries(components)) {
+        const hash = JSON.stringify(schema);
+        schemas.push({ name, hash });
+      }
+      return schemas;
+    }
+    function extractDefinedScopes(parsed) {
+      const scopes = /* @__PURE__ */ new Set();
+      const schemes = parsed.components?.securitySchemes || {};
+      for (const scheme of Object.values(schemes)) {
+        if (scheme.type === "oauth2" && scheme.flows) {
+          for (const flow of Object.values(scheme.flows)) {
+            if (flow.scopes) {
+              for (const scope of Object.keys(flow.scopes)) {
+                scopes.add(scope);
+              }
+            }
+          }
+        }
+      }
+      return scopes;
+    }
+    function extractUsedScopes(parsed) {
+      const scopes = /* @__PURE__ */ new Set();
+      if (Array.isArray(parsed.security)) {
+        for (const req of parsed.security) {
+          for (const scopeList of Object.values(req)) {
+            if (Array.isArray(scopeList)) {
+              for (const s of scopeList) scopes.add(s);
+            }
+          }
+        }
+      }
+      const paths = parsed.paths || {};
+      const httpMethods = ["get", "post", "put", "patch", "delete", "head", "options"];
+      for (const pathItem of Object.values(paths)) {
+        if (!pathItem || typeof pathItem !== "object") continue;
+        for (const method of httpMethods) {
+          const op = pathItem[method];
+          if (op?.security && Array.isArray(op.security)) {
+            for (const req of op.security) {
+              for (const scopeList of Object.values(req)) {
+                if (Array.isArray(scopeList)) {
+                  for (const s of scopeList) scopes.add(s);
+                }
+              }
+            }
+          }
+        }
+      }
+      return scopes;
+    }
+    function extractRefs(obj, refs = /* @__PURE__ */ new Set()) {
+      if (!obj || typeof obj !== "object") return refs;
+      if (Array.isArray(obj)) {
+        for (const item of obj) extractRefs(item, refs);
+        return refs;
+      }
+      for (const [key, value] of Object.entries(obj)) {
+        if (key === "$ref" && typeof value === "string") {
+          refs.add(value);
+        } else {
+          extractRefs(value, refs);
+        }
+      }
+      return refs;
+    }
+    function refResolves(parsed, ref) {
+      if (!ref.startsWith("#/")) return true;
+      const parts = ref.replace("#/", "").split("/");
+      let current = parsed;
+      for (const part of parts) {
+        if (!current || typeof current !== "object") return false;
+        current = current[part];
+      }
+      return current !== void 0;
+    }
+    function validateRegistry(specs) {
+      if (!Array.isArray(specs) || specs.length === 0) {
+        return { valid: true, issues: [], stats: { specs_count: 0, endpoints_count: 0, schemas_count: 0 } };
+      }
+      const issues = [];
+      const parsedSpecs = [];
+      for (const { name, spec } of specs) {
+        const parsed = safeParse(spec);
+        if (!parsed) {
+          issues.push({
+            severity: "error",
+            type: "parse_error",
+            message: `Could not parse spec '${name}' as valid YAML or JSON`,
+            specs: [name]
+          });
+          continue;
+        }
+        const validation = validateOpenApiSpec(parsed);
+        if (!validation.valid) {
+          issues.push({
+            severity: "error",
+            type: "invalid_spec",
+            message: `Spec '${name}' is not a valid OpenAPI document: ${validation.error}`,
+            specs: [name]
+          });
+          continue;
+        }
+        parsedSpecs.push({ name, parsed });
+      }
+      const endpointMap = /* @__PURE__ */ new Map();
+      for (const { name, parsed } of parsedSpecs) {
+        const endpoints = extractEndpoints(parsed);
+        for (const ep of endpoints) {
+          const key = `${ep.method} ${ep.path}`;
+          if (!endpointMap.has(key)) endpointMap.set(key, []);
+          endpointMap.get(key).push({ spec: name, operationId: ep.operationId });
+        }
+      }
+      for (const [endpoint, owners] of endpointMap) {
+        if (owners.length > 1) {
+          const specNames = owners.map((o) => o.spec);
+          issues.push({
+            severity: "warning",
+            type: "endpoint_collision",
+            message: `Endpoint '${endpoint}' is defined in multiple specs: ${specNames.join(", ")}`,
+            specs: specNames
+          });
+        }
+      }
+      const schemaMap = /* @__PURE__ */ new Map();
+      for (const { name, parsed } of parsedSpecs) {
+        const schemas = extractSchemaNames(parsed);
+        for (const s of schemas) {
+          if (!schemaMap.has(s.name)) schemaMap.set(s.name, []);
+          schemaMap.get(s.name).push({ spec: name, hash: s.hash });
+        }
+      }
+      for (const [schemaName, definitions] of schemaMap) {
+        if (definitions.length > 1) {
+          const uniqueHashes = new Set(definitions.map((d) => d.hash));
+          if (uniqueHashes.size > 1) {
+            const specNames = definitions.map((d) => d.spec);
+            issues.push({
+              severity: "warning",
+              type: "schema_conflict",
+              message: `Schema '${schemaName}' has conflicting definitions across specs: ${specNames.join(", ")}`,
+              specs: specNames
+            });
+          }
+        }
+      }
+      for (const { name, parsed } of parsedSpecs) {
+        const defined = extractDefinedScopes(parsed);
+        const used = extractUsedScopes(parsed);
+        for (const scope of used) {
+          if (!defined.has(scope)) {
+            issues.push({
+              severity: "warning",
+              type: "undefined_scope",
+              message: `Scope '${scope}' is used in '${name}' but not defined in securitySchemes`,
+              specs: [name]
+            });
+          }
+        }
+        for (const scope of defined) {
+          if (!used.has(scope)) {
+            issues.push({
+              severity: "info",
+              type: "unused_scope",
+              message: `Scope '${scope}' is defined in '${name}' but never used in any operation`,
+              specs: [name]
+            });
+          }
+        }
+      }
+      for (const { name, parsed } of parsedSpecs) {
+        const refs = extractRefs(parsed);
+        for (const ref of refs) {
+          if (!refResolves(parsed, ref)) {
+            issues.push({
+              severity: "error",
+              type: "unresolved_ref",
+              message: `$ref '${ref}' in '${name}' does not resolve`,
+              specs: [name]
+            });
+          }
+        }
+      }
+      let totalEndpoints = 0;
+      let totalSchemas = 0;
+      for (const { parsed } of parsedSpecs) {
+        totalEndpoints += extractEndpoints(parsed).length;
+        totalSchemas += extractSchemaNames(parsed).length;
+      }
+      const hasErrors = issues.some((i) => i.severity === "error");
+      return {
+        valid: !hasErrors,
+        issues,
+        stats: {
+          specs_count: parsedSpecs.length,
+          endpoints_count: totalEndpoints,
+          schemas_count: totalSchemas
+        }
+      };
+    }
+    module2.exports = {
+      validateRegistry,
+      safeParse,
+      validateOpenApiSpec,
+      // Exported for testing
+      extractEndpoints,
+      extractSchemaNames,
+      extractDefinedScopes,
+      extractUsedScopes,
+      extractRefs,
+      refResolves
+    };
+  }
+});
+
+// src/commands/registry-gate.js
+var require_registry_gate = __commonJS({
+  "src/commands/registry-gate.js"(exports2, module2) {
+    "use strict";
+    var fs = require("fs");
+    var path = require("path");
+    var chalk = require_source();
+    var { matchGlob } = require_cjs3();
+    var {
+      validateRegistry,
+      safeParse,
+      validateOpenApiSpec
+    } = require_registry_validation_core();
+    if (process.env.NO_COLOR) chalk.level = 0;
+    var SPEC_EXT = /* @__PURE__ */ new Set([".yaml", ".yml", ".json"]);
+    function walkSpecCandidates(rootDir, {
+      readdirSync = fs.readdirSync.bind(fs),
+      statSync = fs.statSync.bind(fs)
+    } = {}) {
+      const out = [];
+      function walk(absDir) {
+        let entries;
+        try {
+          entries = readdirSync(absDir, { withFileTypes: true });
+        } catch (err) {
+          const e = new Error(`Cannot read directory ${absDir}: ${err && err.message}`);
+          e.code = "GATE_ERROR";
+          e.path = absDir;
+          throw e;
+        }
+        for (const ent of entries) {
+          const name = ent.name;
+          if (name === "node_modules" || name.startsWith(".")) continue;
+          const abs = path.join(absDir, name);
+          let isDir = ent.isDirectory && ent.isDirectory();
+          let isFile = ent.isFile && ent.isFile();
+          if (!isDir && !isFile) {
+            try {
+              const st = statSync(abs);
+              isDir = st.isDirectory();
+              isFile = st.isFile();
+            } catch (err) {
+              const e = new Error(`Cannot stat ${abs}: ${err && err.message}`);
+              e.code = "GATE_ERROR";
+              e.path = abs;
+              throw e;
+            }
+          }
+          if (isDir) {
+            walk(abs);
+            continue;
+          }
+          if (isFile) {
+            const ext = path.extname(name).toLowerCase();
+            if (SPEC_EXT.has(ext)) out.push(abs);
+          }
+        }
+      }
+      walk(rootDir);
+      return out.sort();
+    }
+    function relPosix(rootDir, absPath) {
+      let rel = path.relative(rootDir, absPath);
+      if (path.sep !== "/") rel = rel.split(path.sep).join("/");
+      return rel;
+    }
+    function readFileThreeState(absPath, readFileSync = fs.readFileSync.bind(fs)) {
+      try {
+        const content = readFileSync(absPath, "utf8");
+        return { ok: true, content: content == null ? "" : String(content) };
+      } catch (err) {
+        const msg = err && err.message ? String(err.message) : String(err);
+        return {
+          ok: false,
+          code: "GATE_ERROR",
+          message: `unreadable file: ${absPath} (${msg.slice(0, 200)})`,
+          path: absPath
+        };
+      }
+    }
+    function discoverRegistrySpecs(dir, {
+      glob = null,
+      readdirSync = fs.readdirSync.bind(fs),
+      readFileSync = fs.readFileSync.bind(fs),
+      statSync = fs.statSync.bind(fs)
+    } = {}) {
+      const rootDir = path.resolve(dir);
+      let candidates;
+      try {
+        candidates = walkSpecCandidates(rootDir, { readdirSync, statSync });
+      } catch (err) {
+        return {
+          ok: false,
+          code: err.code || "GATE_ERROR",
+          message: err.message || String(err),
+          path: err.path
+        };
+      }
+      if (glob) {
+        candidates = candidates.filter((abs) => matchGlob(glob, relPosix(rootDir, abs)));
+      }
+      const specs = [];
+      let skippedNonSpec = 0;
+      for (const abs of candidates) {
+        const read = readFileThreeState(abs, readFileSync);
+        if (!read.ok) {
+          return {
+            ok: false,
+            code: "GATE_ERROR",
+            message: read.message,
+            path: read.path || abs
+          };
+        }
+        const name = relPosix(rootDir, abs);
+        const parsed = safeParse(read.content);
+        if (!parsed || typeof parsed !== "object") {
+          specs.push({ name, spec: read.content });
+          continue;
+        }
+        const shape = validateOpenApiSpec(parsed);
+        if (!shape.valid) {
+          if (shape.error && shape.error.includes("Missing required field: 'openapi' or 'swagger'")) {
+            skippedNonSpec += 1;
+            continue;
+          }
+          specs.push({ name, spec: read.content });
+          continue;
+        }
+        specs.push({ name, spec: read.content });
+      }
+      return {
+        ok: true,
+        specs,
+        skippedNonSpec,
+        candidates: candidates.length,
+        rootDir
+      };
+    }
+    function findingsFailGate(issues, { warnOnly = false, errorsOnly = false } = {}) {
+      if (warnOnly) return false;
+      for (const i of issues || []) {
+        if (i.severity === "error") return true;
+        if (i.severity === "warning" && !errorsOnly) return true;
+      }
+      return false;
+    }
+    function countBySeverity(issues) {
+      const c = { error: 0, warning: 0, info: 0 };
+      for (const i of issues || []) {
         if (i.severity === "error") c.error += 1;
         else if (i.severity === "warning") c.warning += 1;
         else if (i.severity === "info") c.info += 1;
@@ -99945,7 +100658,7 @@ var require_enforce = __commonJS({
     var DEPLOY_GUIDANCE = [
       "Deploy is declared-only on the server (never server-observed ENFORCING).",
       "Add a CD step that runs: coderifts deploy-gate --env <env> --artifact <id> --receipt <file> --enforce",
-      "  (phase-1 default is advisory; --enforce attests ENFORCING for the pipeline).",
+      "  (fail-closed by default; --enforce attests ENFORCING for inescapable_deploy. CODERIFTS_DEPLOY_ADVISORY=1 to soften.)",
       "Also set policy.require_source_binding: true in .coderifts.yml for the deploy declaration leg."
     ].join("\n");
     var CONTENT_GUIDANCE = [
@@ -101101,809 +101814,218 @@ var require_adopt = __commonJS({
       lines.push(chalk.bold("Per change set (counterfactual)"));
       lines.push(
         pad("REF", 12) + pad("PATH", 28) + pad("ACTION", 18) + pad("RISK", 6) + "DETECTORS"
-      );
-      lines.push("-".repeat(90));
-      for (const row of report.change_sets) {
-        const ref = (row.ref || "").slice(0, 10);
-        const pth = (row.path || "").slice(0, 26);
-        const act = row.execution_action || (row.error ? "ERROR" : "\u2014");
-        const risk = row.risk_score != null ? String(row.risk_score) : "\u2014";
-        const dets = (row.detectors_fired || []).map((d) => d.id).join(",") || "\u2014";
-        lines.push(pad(ref, 12) + pad(pth, 28) + pad(act, 18) + pad(risk, 6) + dets.slice(0, 40));
-      }
-      lines.push("");
-      lines.push(chalk.bold("Per-detector aggregate (default-flip evidence \u2014 not a recommendation)"));
-      if (!report.per_detector || report.per_detector.length === 0) {
-        lines.push(chalk.dim("(no detectors fired on any change set)"));
-      } else {
-        lines.push(pad("DETECTOR", 36) + pad("SEVERITY", 12) + "FIRE_COUNT");
-        lines.push("-".repeat(60));
-        for (const d of report.per_detector) {
-          lines.push(pad(d.id, 36) + pad(d.severity, 12) + String(d.fire_count));
-        }
-      }
-      lines.push("");
-      lines.push(chalk.dim("High fire_count \u2192 candidate false-positive noise (not safe to default-block without review)."));
-      lines.push(chalk.dim("Rare + CRITICAL/HIGH \u2192 safer default-block candidates. Human decides; no auto-flip."));
-      lines.push("");
-      return lines.join("\n");
-    }
-    function pad(s, n) {
-      const t = String(s || "");
-      if (t.length >= n) return `${t.slice(0, n - 1)} `;
-      return t + " ".repeat(n - t.length);
-    }
-    async function runAdopt(options = {}, deps = {}) {
-      const log = deps.log || console.log.bind(console);
-      const logErr = deps.logErr || console.error.bind(console);
-      const load = deps.loadCore || loadCore;
-      const collected = collectChangeSetsFromGit(options, deps);
-      if (!collected.ok) {
-        logErr(chalk.red(`CodeRifts adopt: ${collected.code} \u2014 ${collected.message}`));
-        return { ok: false, exitCode: 1, code: collected.code, message: collected.message };
-      }
-      let core;
-      try {
-        core = load();
-      } catch (err) {
-        logErr(chalk.red(`CodeRifts adopt: ${err.message}`));
-        return { ok: false, exitCode: 1, code: "CORE_LOAD_ERROR", message: err.message };
-      }
-      const runCore = () => core.buildCounterfactualReport(collected.changeSets, deps.config || {});
-      const report = options.json ? await withJsonQuietAnalyzerLogs(runCore) : await runCore();
-      if (options.json) {
-        log(JSON.stringify({
-          ...report,
-          meta: {
-            commit_count: collected.commit_count,
-            change_set_count: collected.changeSets.length
-          }
-        }, null, 2));
-      } else {
-        log(renderHuman(report, { commit_count: collected.commit_count }));
-      }
-      return {
-        ok: true,
-        exitCode: 0,
-        report,
-        meta: { commit_count: collected.commit_count }
-      };
-    }
-    module2.exports = {
-      runAdopt,
-      collectChangeSetsFromGit,
-      isContractPath,
-      withJsonQuietAnalyzerLogs,
-      renderHuman,
-      defaultGit,
-      SOURCE_CODE_EXT_RE
-    };
-  }
-});
-
-// src/commands/outcome.js
-var require_outcome = __commonJS({
-  "src/commands/outcome.js"(exports2, module2) {
-    "use strict";
-    var chalk = require_source();
-    var { getApiKey } = require_config();
-    var { cloudPostOutcome } = require_cloud();
-    if (process.env.NO_COLOR) chalk.level = 0;
-    var OUTCOME_KINDS = Object.freeze([
-      "deploy_succeeded",
-      "deploy_failed",
-      "rolled_back",
-      "consumer_break_reported",
-      "remediation_verified_working",
-      "false_positive_reported",
-      "other_reported"
-    ]);
-    var OUTCOME_KIND_SET = new Set(OUTCOME_KINDS);
-    var USAGE = [
-      "Usage: coderifts outcome <kind> --decision <decision_id> [--observed-at <ISO>] [--details <json>] [--json]",
-      "",
-      "Report a post-hoc observed outcome for a past decision_id to the CodeRifts cloud API.",
-      "This records the CALLER'S assertion (e.g. your deploy job knows success/failure) \u2014",
-      "the command does NOT itself verify that a deploy succeeded or failed.",
-      "",
-      "kind (required, closed set):",
-      `  ${OUTCOME_KINDS.join(", ")}`,
-      "",
-      "Requires a cloud API key (coderifts login or CODERIFTS_API_KEY).",
-      "POST /api/v1/outcomes \u2014 source is always reported (server-side); reporter is derived from the key."
-    ].join("\n");
-    function isValidOutcomeKind(kind) {
-      return typeof kind === "string" && OUTCOME_KIND_SET.has(kind);
-    }
-    function isValidObservedAt(iso) {
-      if (typeof iso !== "string" || !iso.trim()) return false;
-      const t = Date.parse(iso);
-      return Number.isFinite(t);
-    }
-    function parseDetails(raw) {
-      if (raw == null || raw === "") return { ok: true, details: null };
-      if (typeof raw !== "string") return { ok: false, error: "--details must be a JSON string" };
-      try {
-        const v = JSON.parse(raw);
-        if (v !== null && typeof v !== "object") {
-          return { ok: false, error: "--details must be a JSON object or array" };
-        }
-        return { ok: true, details: v };
-      } catch (e) {
-        return { ok: false, error: `--details is not valid JSON: ${e && e.message || "parse error"}` };
-      }
-    }
-    async function runOutcome(kind, options = {}, deps = {}) {
-      const getKey = deps.getApiKey || getApiKey;
-      const postOutcome = deps.cloudPostOutcome || cloudPostOutcome;
-      const log = deps.log || console.log;
-      const errLog = deps.errLog || console.error;
-      const nowIso = deps.nowIso || (() => (/* @__PURE__ */ new Date()).toISOString());
-      if (kind == null || String(kind).trim() === "") {
-        errLog(chalk.red("Error: missing outcome kind"));
-        errLog(USAGE);
-        return { exitCode: 1, error: "missing_kind" };
-      }
-      const outcomeKind = String(kind).trim();
-      if (!isValidOutcomeKind(outcomeKind)) {
-        errLog(chalk.red(`Error: invalid outcome kind '${outcomeKind}'`));
-        errLog(chalk.dim(`  Valid kinds: ${OUTCOME_KINDS.join(", ")}`));
-        return { exitCode: 1, error: "invalid_kind" };
-      }
-      const decisionId = options.decision != null ? String(options.decision).trim() : "";
-      if (!decisionId) {
-        errLog(chalk.red("Error: --decision <decision_id> is required"));
-        errLog(USAGE);
-        return { exitCode: 1, error: "missing_decision" };
-      }
-      let observedAt;
-      if (options.observedAt != null && String(options.observedAt).trim() !== "") {
-        observedAt = String(options.observedAt).trim();
-        if (!isValidObservedAt(observedAt)) {
-          errLog(chalk.red("Error: --observed-at must be a valid ISO-8601 timestamp"));
-          return { exitCode: 1, error: "invalid_observed_at" };
-        }
-      } else {
-        observedAt = nowIso();
-      }
-      const det = parseDetails(options.details);
-      if (!det.ok) {
-        errLog(chalk.red(`Error: ${det.error}`));
-        return { exitCode: 1, error: "invalid_details" };
-      }
-      const apiKey = getKey();
-      if (!apiKey) {
-        errLog(chalk.red("Error: no API key. Run `coderifts login` or set CODERIFTS_API_KEY."));
-        return { exitCode: 1, error: "missing_api_key" };
-      }
-      const body = {
-        decision_id: decisionId,
-        outcome_kind: outcomeKind,
-        observed_at: observedAt
-      };
-      if (det.details != null) body.details = det.details;
-      let response;
-      try {
-        response = await postOutcome(apiKey, body);
-      } catch (e) {
-        const msg = e && e.message ? String(e.message) : "request failed";
-        errLog(chalk.red(`Error: ${msg}`));
-        if (e && e.statusCode) errLog(chalk.dim(`  (HTTP ${e.statusCode})`));
-        if (e && e.code) errLog(chalk.dim(`  (${e.code})`));
-        return { exitCode: 1, error: msg, body };
-      }
-      if (options.json) {
-        log(JSON.stringify(response, null, 2));
-      } else {
-        const o = response && response.outcome ? response.outcome : response;
-        log(chalk.bold("CodeRifts outcome recorded"));
-        log(`  kind:        ${outcomeKind}`);
-        log(`  decision_id: ${decisionId}`);
-        log(`  observed_at: ${observedAt}`);
-        if (o && o.id) log(`  id:          ${o.id}`);
-        if (response && response.source) log(`  source:      ${response.source}`);
-        log(chalk.dim("  Caller assertion only \u2014 this command did not verify the deploy."));
-      }
-      return { exitCode: 0, response, body };
-    }
-    module2.exports = {
-      runOutcome,
-      isValidOutcomeKind,
-      isValidObservedAt,
-      parseDetails,
-      OUTCOME_KINDS,
-      USAGE
-    };
-  }
-});
-
-// src/commands/claude-hook.js
-var require_claude_hook = __commonJS({
-  "src/commands/claude-hook.js"(exports2, module2) {
-    "use strict";
-    var fs = require("fs");
-    var path = require("path");
-    var { execSync } = require("child_process");
-    var { getApiKey } = require_config();
-    var { cloudAuthorizePreflight } = require_cloud();
-    var DEFAULT_SPEC_PATH = "api/openapi.yaml";
-    var CLOSED_ACTIONS = /* @__PURE__ */ new Set([
-      "CONTINUE",
-      "CONTINUE_WITH_MONITORING",
-      "REQUEST_APPROVAL",
-      "STOP"
-    ]);
-    var USAGE = [
-      "Usage: coderifts claude-hook",
-      "",
-      "Claude Code PreToolUse hook: gates Write|Edit|MultiEdit when they touch the",
-      "configured contract spec path. Reads JSON context from STDIN.",
-      "",
-      "Exit map (Claude Code semantics \u2014 get this exactly right):",
-      "  2  BLOCK \u2014 tool call cancelled (BLOCK/STOP, REQUEST_APPROVAL, unrecognised action,",
-      "     governance could not run, CONTINUE_WITH_MONITORING without a wired sink)",
-      "  0  allow \u2014 CONTINUE, or CWM with a host-asserted monitoring sink, or non-contract skip",
-      "  1  NEVER used for security deny (Claude treats exit 1 as non-blocking; action proceeds)",
-      "",
-      "Fail-closed DEFAULT (exit 2, reason enforce_indeterminate) when governance could not run:",
-      "  no API key / API unreachable / disk unreadable / edit-apply failure on the spec path",
-      "  Absence of a key is not permission. Explicit opt-out: CODERIFTS_ADVISORY=1|true.",
-      "",
-      "Parse-gap DEFAULT (exit 2): unparseable stdin / missing file_path \u2014 refusing (fail-closed);",
-      "  set CODERIFTS_ADVISORY=1 to soften. JSONL hook_blocked cause stdin_unparseable|missing_file_path.",
-      "",
-      "Still exit 0 (nothing to govern): non-spec path, identical content.",
-      "",
-      "CONTINUE_WITH_MONITORING: allow only if the host asserts a sink",
-      "  (CODERIFTS_MONITORING_SINK_WIRED=1|true or git config coderifts.monitoringSinkWired).",
-      "  Host claim \u2014 not delivery proof (same class as GuardConfig.monitoringSinkWired).",
-      "",
-      "CODERIFTS_STRICT=1|true: same fail-closed as default; cannot be weakened by ADVISORY.",
-      "",
-      "Spec path (same source as git pre-push hook):",
-      "  git config coderifts.specPath  (default: api/openapi.yaml)",
-      "",
-      "Baseline at PreToolUse: before = current file on disk (pre-edit state \u2014 the tool has",
-      "not written yet). after = proposed content from tool_input (Write: content; Edit/MultiEdit:",
-      "old\u2192new applied to disk content).",
-      "",
-      "Push-time equivalent: coderifts hook install (git exit 1 on BLOCK)."
-    ].join("\n");
-    function isEnvFlag(env, name) {
-      const v = env && env[name];
-      if (v == null || v === "") return false;
-      const s = String(v).trim().toLowerCase();
-      return s === "1" || s === "true";
-    }
-    function isStrictMode(env = process.env) {
-      return isEnvFlag(env, "CODERIFTS_STRICT");
-    }
-    function isAdvisoryMode(env = process.env) {
-      return isEnvFlag(env, "CODERIFTS_ADVISORY");
-    }
-    function isMonitoringSinkWired({ env = process.env, deps = {}, result = null } = {}) {
-      if (deps && deps.monitoringSinkWired === true) return true;
-      if (isEnvFlag(env, "CODERIFTS_MONITORING_SINK_WIRED")) return true;
-      const git = readGitConfig("coderifts.monitoringSinkWired", deps);
-      if (git) {
-        const s = String(git).trim().toLowerCase();
-        if (s === "1" || s === "true") return true;
-      }
-      if (result && result.monitoringSinkWired === true) return true;
-      const dr = result && result.decision_result;
-      if (dr && typeof dr === "object" && dr.monitoringSinkWired === true) return true;
-      return false;
-    }
-    var HOOK_TRIGGER_SOURCE = "claude_hook";
-    function extractFingerprint(result) {
-      const d = result && typeof result === "object" && !Array.isArray(result) ? result : {};
-      const dr = d.decision_result && typeof d.decision_result === "object" ? d.decision_result : {};
-      const fp = dr.fingerprint || d.fingerprint || d.verdict_fingerprint || d.input_fingerprint;
-      return typeof fp === "string" && fp.length > 0 ? fp : void 0;
-    }
-    function hookSessionId(env) {
-      const fromEnv = env && env.CODERIFTS_SESSION_ID && String(env.CODERIFTS_SESSION_ID).trim();
-      if (fromEnv) return fromEnv;
-      if (!hookSessionId._gen) hookSessionId._gen = `hook-${process.pid}-${Date.now()}`;
-      return hookSessionId._gen;
-    }
-    function appendGuardEventLog(env, event, deps = {}) {
-      const p = env && env.CODERIFTS_GUARD_EVENT_LOG;
-      if (p == null || String(p).trim() === "") return;
-      const errLog = deps.errLog || ((m) => console.error(String(m)));
-      const append = deps.appendFileSync || ((file, data) => fs.appendFileSync(file, data));
-      try {
-        append(String(p).trim(), JSON.stringify(event) + "\n");
-      } catch (err) {
-        try {
-          errLog(`CodeRifts claude-hook: CODERIFTS_GUARD_EVENT_LOG write failed (${err && err.message})`);
-        } catch {
-        }
-      }
-    }
-    function failClosedOrAdvisory({ advisory, strict, site, softMsg, why, errLog }) {
-      if (advisory && !strict) {
-        errLog(`${softMsg} (CODERIFTS_ADVISORY)`);
-        return { exitCode: 0, reason: site, site };
-      }
-      if (strict) {
-        errLog(
-          `CodeRifts claude-hook: CODERIFTS_STRICT: governance could not run (${why}) \u2014 blocking. Set a key / restore network, or unset CODERIFTS_STRICT.`
-        );
-        return { exitCode: 2, reason: "enforce_indeterminate", site, strictBlocked: true };
-      }
-      errLog(
-        `CodeRifts claude-hook: governance could not run (${why}) \u2014 blocking. Set CODERIFTS_ADVISORY=1 to allow without governance (explicit opt-out).`
-      );
-      return { exitCode: 2, reason: "enforce_indeterminate", site };
-    }
-    function softOrStrictBlock({ strict, reason, softMsg, why, errLog }) {
-      return failClosedOrAdvisory({
-        advisory: false,
-        strict: !!strict,
-        site: reason,
-        softMsg,
-        why,
-        errLog
-      });
-    }
-    function readGitConfig(key, deps = {}) {
-      const run = deps.execSync || execSync;
-      const cwd = deps.cwd || process.cwd();
-      try {
-        const v = run(`git config ${key}`, { encoding: "utf8", cwd, stdio: ["ignore", "pipe", "pipe"] });
-        const t = String(v || "").trim();
-        return t || null;
-      } catch {
-        return null;
-      }
-    }
-    function resolveApiKey(deps = {}) {
-      const getKey = deps.getApiKey || getApiKey;
-      const fromLogin = getKey();
-      if (fromLogin) return fromLogin;
-      const env = deps.env || process.env;
-      const fromEnv = env.CODERIFTS_API_KEY && String(env.CODERIFTS_API_KEY).trim();
-      if (fromEnv) return fromEnv;
-      return readGitConfig("coderifts.apiKey", deps);
-    }
-    function resolveSpecPath(deps = {}) {
-      const fromGit = readGitConfig("coderifts.specPath", deps);
-      if (fromGit) return fromGit;
-      return DEFAULT_SPEC_PATH;
-    }
-    function parseStdinJson(raw) {
-      if (raw == null || String(raw).trim() === "") {
-        return { ok: false, reason: "empty stdin" };
-      }
-      let obj;
-      try {
-        obj = JSON.parse(String(raw));
-      } catch {
-        return { ok: false, reason: "stdin is not JSON" };
-      }
-      if (!obj || typeof obj !== "object" || Array.isArray(obj)) {
-        return { ok: false, reason: "stdin JSON is not an object" };
-      }
-      const toolName = obj.tool_name || obj.toolName || obj.name || null;
-      let toolInput = obj.tool_input || obj.toolInput || obj.input || null;
-      if (toolInput == null && obj.file_path) toolInput = obj;
-      if (!toolName || typeof toolName !== "string") {
-        return { ok: false, reason: "missing tool_name" };
-      }
-      if (!toolInput || typeof toolInput !== "object") {
-        return { ok: false, reason: "missing tool_input" };
-      }
-      return { ok: true, toolName: String(toolName), toolInput };
-    }
-    function isSpecPath(filePath, specPath) {
-      if (!filePath || !specPath) return false;
-      const fp = path.normalize(String(filePath).replace(/\\/g, "/"));
-      const sp = path.normalize(String(specPath).replace(/\\/g, "/"));
-      if (fp === sp) return true;
-      if (fp.endsWith("/" + sp) || fp.endsWith(sp)) return true;
-      const baseFp = path.basename(fp);
-      const baseSp = path.basename(sp);
-      if (baseFp === baseSp && (fp.endsWith(sp) || sp.endsWith(baseSp))) {
-        const tail = sp.split("/").filter(Boolean).join("/");
-        return fp.replace(/\\/g, "/").endsWith(tail);
-      }
-      return false;
-    }
-    function deriveAfterContent(toolName, toolInput, diskBefore) {
-      const name = String(toolName || "");
-      if (name === "Write" || name === "write") {
-        if (typeof toolInput.content !== "string") {
-          return { ok: false, reason: "Write tool_input.content missing or not a string" };
-        }
-        return { ok: true, after: toolInput.content };
-      }
-      if (name === "Edit" || name === "edit") {
-        const oldS = toolInput.old_string != null ? toolInput.old_string : toolInput.oldString;
-        const newS = toolInput.new_string != null ? toolInput.new_string : toolInput.newString;
-        if (typeof oldS !== "string" || typeof newS !== "string") {
-          return { ok: false, reason: "Edit tool_input.old_string/new_string missing" };
-        }
-        if (!diskBefore.includes(oldS)) {
-          return { ok: false, reason: "Edit old_string not found in disk content" };
-        }
-        return { ok: true, after: diskBefore.replace(oldS, newS) };
-      }
-      if (name === "MultiEdit" || name === "multi_edit" || name === "multiEdit") {
-        const edits = toolInput.edits || toolInput.Edits;
-        if (!Array.isArray(edits) || edits.length === 0) {
-          return { ok: false, reason: "MultiEdit tool_input.edits missing or empty" };
-        }
-        let cur = diskBefore;
-        for (let i = 0; i < edits.length; i++) {
-          const e = edits[i] || {};
-          const oldS = e.old_string != null ? e.old_string : e.oldString;
-          const newS = e.new_string != null ? e.new_string : e.newString;
-          if (typeof oldS !== "string" || typeof newS !== "string") {
-            return { ok: false, reason: `MultiEdit edits[${i}] missing old_string/new_string` };
-          }
-          if (!cur.includes(oldS)) {
-            return { ok: false, reason: `MultiEdit edits[${i}] old_string not found in content` };
-          }
-          cur = cur.replace(oldS, newS);
+      );
+      lines.push("-".repeat(90));
+      for (const row of report.change_sets) {
+        const ref = (row.ref || "").slice(0, 10);
+        const pth = (row.path || "").slice(0, 26);
+        const act = row.execution_action || (row.error ? "ERROR" : "\u2014");
+        const risk = row.risk_score != null ? String(row.risk_score) : "\u2014";
+        const dets = (row.detectors_fired || []).map((d) => d.id).join(",") || "\u2014";
+        lines.push(pad(ref, 12) + pad(pth, 28) + pad(act, 18) + pad(risk, 6) + dets.slice(0, 40));
+      }
+      lines.push("");
+      lines.push(chalk.bold("Per-detector aggregate (default-flip evidence \u2014 not a recommendation)"));
+      if (!report.per_detector || report.per_detector.length === 0) {
+        lines.push(chalk.dim("(no detectors fired on any change set)"));
+      } else {
+        lines.push(pad("DETECTOR", 36) + pad("SEVERITY", 12) + "FIRE_COUNT");
+        lines.push("-".repeat(60));
+        for (const d of report.per_detector) {
+          lines.push(pad(d.id, 36) + pad(d.severity, 12) + String(d.fire_count));
         }
-        return { ok: true, after: cur };
       }
-      return { ok: false, reason: `unsupported tool_name for content derive: ${name}` };
-    }
-    function isV2DecisionBody(d, dr) {
-      if (dr && typeof dr === "object") return true;
-      if (d.preflight_mode != null && d.preflight_mode !== "") return true;
-      const ver = d.decision_spec_version;
-      return typeof ver === "string" && ver.startsWith("2.");
+      lines.push("");
+      lines.push(chalk.dim("High fire_count \u2192 candidate false-positive noise (not safe to default-block without review)."));
+      lines.push(chalk.dim("Rare + CRITICAL/HIGH \u2192 safer default-block candidates. Human decides; no auto-flip."));
+      lines.push("");
+      return lines.join("\n");
     }
-    function allowLegacyDecisionMap(d, dr) {
-      return d.decision_spec_version === "1.0" && !isV2DecisionBody(d, dr);
+    function pad(s, n) {
+      const t = String(s || "");
+      if (t.length >= n) return `${t.slice(0, n - 1)} `;
+      return t + " ".repeat(n - t.length);
     }
-    function mapDecisionSeverity(result) {
-      const d = result && typeof result === "object" && !Array.isArray(result) ? result : {};
-      let ea = null;
-      const dr = d.decision_result;
-      if (dr && typeof dr === "object" && typeof dr.execution_action === "string" && dr.execution_action !== "") {
-        ea = dr.execution_action;
-      } else if (typeof d.execution_action === "string" && d.execution_action !== "") {
-        ea = d.execution_action;
+    async function runAdopt(options = {}, deps = {}) {
+      const log = deps.log || console.log.bind(console);
+      const logErr = deps.logErr || console.error.bind(console);
+      const load = deps.loadCore || loadCore;
+      const collected = collectChangeSetsFromGit(options, deps);
+      if (!collected.ok) {
+        logErr(chalk.red(`CodeRifts adopt: ${collected.code} \u2014 ${collected.message}`));
+        return { ok: false, exitCode: 1, code: collected.code, message: collected.message };
       }
-      const hasDecision = d.omega_decision != null && d.omega_decision !== "" || d.decision != null && d.decision !== "" || dr && typeof dr === "object" && dr.execution_action;
-      if (d.error && !hasDecision && (ea == null || ea === "")) {
-        return {
-          severity: "INDETERMINATE",
-          decision: null,
-          decisionId: null,
-          executionAction: null
-        };
+      let core;
+      try {
+        core = load();
+      } catch (err) {
+        logErr(chalk.red(`CodeRifts adopt: ${err.message}`));
+        return { ok: false, exitCode: 1, code: "CORE_LOAD_ERROR", message: err.message };
       }
-      let severity;
-      if (ea != null && ea !== "") {
-        if (!CLOSED_ACTIONS.has(ea)) {
-          severity = "UNKNOWN";
-        } else if (ea === "CONTINUE") {
-          severity = "ALLOW";
-        } else if (ea === "CONTINUE_WITH_MONITORING") {
-          severity = "MONITOR";
-        } else if (ea === "STOP") {
-          severity = "BLOCK";
-        } else {
-          severity = "REQUIRE_APPROVAL";
-        }
-      } else if (allowLegacyDecisionMap(d, dr)) {
-        const od = d.omega_decision || d.decision;
-        if (od == null || od === "") {
-          severity = "INDETERMINATE";
-        } else if (od === "BLOCK") severity = "BLOCK";
-        else if (od === "REQUIRE_APPROVAL") severity = "REQUIRE_APPROVAL";
-        else if (od === "WARN") severity = "WARN";
-        else severity = "ALLOW";
+      const runCore = () => core.buildCounterfactualReport(collected.changeSets, deps.config || {});
+      const report = options.json ? await withJsonQuietAnalyzerLogs(runCore) : await runCore();
+      if (options.json) {
+        log(JSON.stringify({
+          ...report,
+          meta: {
+            commit_count: collected.commit_count,
+            change_set_count: collected.changeSets.length
+          }
+        }, null, 2));
       } else {
-        severity = "INDETERMINATE";
+        log(renderHuman(report, { commit_count: collected.commit_count }));
       }
-      const decision = dr && dr.decision || d.decision || d.omega_decision || null;
-      const decisionId = dr && dr.decision_id || d.decision_id || null;
       return {
-        severity,
-        decision: decision != null && decision !== "" ? String(decision) : null,
-        decisionId: decisionId != null ? String(decisionId) : null,
-        executionAction: ea
+        ok: true,
+        exitCode: 0,
+        report,
+        meta: { commit_count: collected.commit_count }
       };
     }
-    function renderDecisionWhy(result, opts = {}) {
-      const maxFixes = Number.isInteger(opts.maxFixes) ? opts.maxFixes : 5;
-      const maxLines = Number.isInteger(opts.maxLines) ? opts.maxLines : 13;
-      const d = result && typeof result === "object" && !Array.isArray(result) ? result : {};
-      const dr = d.decision_result && typeof d.decision_result === "object" ? d.decision_result : {};
-      const pick = (k) => dr[k] !== void 0 ? dr[k] : d[k];
-      const arr = (v) => Array.isArray(v) ? v : [];
-      const str = (v) => typeof v === "string" ? v.trim() : "";
-      const lines = [];
-      const reasonCodes = [];
-      for (const r of arr(pick("blocking_reasons"))) {
-        if (!r || typeof r !== "object") continue;
-        const code = str(r.code);
-        const message = str(r.message);
-        if (code) reasonCodes.push(code);
-        if (!code && !message) continue;
-        lines.push(`- ${code || "REASON"}${message ? `: ${message}` : ""}`);
-      }
-      for (const r of arr(pick("degraded_reasons"))) {
-        if (!r || typeof r !== "object") continue;
-        const code = str(r.code);
-        const message = str(r.message);
-        if (!code && !message) continue;
-        lines.push(`- degraded: ${[code, message].filter(Boolean).join(": ")}`);
-      }
-      const action = str(pick("required_action"));
-      if (action) lines.push(`- action: ${action}`);
-      const rt = pick("remediation_transaction");
-      const changes = arr(rt && typeof rt === "object" ? rt.required_changes : null).filter((c) => c && typeof c === "object");
-      const shown = changes.slice(0, maxFixes);
-      for (const c of shown) {
-        const target = str(c.target);
-        const instruction = str(c.instruction);
-        if (!instruction && !target) continue;
-        lines.push(`- fix${target ? ` (${target})` : ""}: ${instruction || str(c.precise_label)}`);
-      }
-      if (changes.length > shown.length) lines.push(`- fix: +${changes.length - shown.length} more`);
-      return { lines: lines.slice(0, maxLines), reasonCodes };
+    module2.exports = {
+      runAdopt,
+      collectChangeSetsFromGit,
+      isContractPath,
+      withJsonQuietAnalyzerLogs,
+      renderHuman,
+      defaultGit,
+      SOURCE_CODE_EXT_RE
+    };
+  }
+});
+
+// src/commands/outcome.js
+var require_outcome = __commonJS({
+  "src/commands/outcome.js"(exports2, module2) {
+    "use strict";
+    var chalk = require_source();
+    var { getApiKey } = require_config();
+    var { cloudPostOutcome } = require_cloud();
+    if (process.env.NO_COLOR) chalk.level = 0;
+    var OUTCOME_KINDS = Object.freeze([
+      "deploy_succeeded",
+      "deploy_failed",
+      "rolled_back",
+      "consumer_break_reported",
+      "remediation_verified_working",
+      "false_positive_reported",
+      "other_reported"
+    ]);
+    var OUTCOME_KIND_SET = new Set(OUTCOME_KINDS);
+    var USAGE = [
+      "Usage: coderifts outcome <kind> --decision <decision_id> [--observed-at <ISO>] [--details <json>] [--json]",
+      "",
+      "Report a post-hoc observed outcome for a past decision_id to the CodeRifts cloud API.",
+      "This records the CALLER'S assertion (e.g. your deploy job knows success/failure) \u2014",
+      "the command does NOT itself verify that a deploy succeeded or failed.",
+      "",
+      "kind (required, closed set):",
+      `  ${OUTCOME_KINDS.join(", ")}`,
+      "",
+      "Requires a cloud API key (coderifts login or CODERIFTS_API_KEY).",
+      "POST /api/v1/outcomes \u2014 source is always reported (server-side); reporter is derived from the key."
+    ].join("\n");
+    function isValidOutcomeKind(kind) {
+      return typeof kind === "string" && OUTCOME_KIND_SET.has(kind);
     }
-    async function runClaudeHook(options = {}, deps = {}) {
-      const errLog = deps.errLog || ((m) => console.error(String(m)));
-      const readStdin = deps.readStdin || (() => {
-        try {
-          return fs.readFileSync(0, "utf8");
-        } catch {
-          return "";
-        }
-      });
-      const readFile = deps.readFile || ((p) => fs.readFileSync(p, "utf8"));
-      const exists = deps.exists || ((p) => fs.existsSync(p));
-      const authorize = deps.cloudAuthorizePreflight || cloudAuthorizePreflight;
-      const cwd = deps.cwd || process.cwd();
-      const env = deps.env || process.env;
-      const strict = isStrictMode(env);
-      const advisory = isAdvisoryMode(env);
-      const sessionId = hookSessionId(env);
-      const logEv = (partial) => {
-        appendGuardEventLog(env, {
-          at: (/* @__PURE__ */ new Date()).toISOString(),
-          sessionId,
-          trigger_source: HOOK_TRIGGER_SOURCE,
-          ...partial
-        }, { errLog, appendFileSync: deps.appendFileSync });
-      };
-      let tool = null;
-      let filePathKnown = null;
-      const emitTerminal = (r) => {
-        const extra = {
-          tool: tool || void 0,
-          path: filePathKnown || void 0,
-          decision: r.decision != null ? r.decision : void 0,
-          decisionId: r.decisionId != null ? r.decisionId : void 0
-        };
-        if (r.exitCode === 2) {
-          const reasons = Array.isArray(r.reasons) && r.reasons.length ? r.reasons : void 0;
-          logEv({
-            type: "hook_blocked",
-            exit: 2,
-            ...extra,
-            reasons,
-            cause: r.reason || r.site
-          });
-        } else if (r.exitCode === 0 && r.site && advisory && !strict) {
-          logEv({ type: "hook_advisory_passthrough", exit: 0, decision: r.decision || null, ...extra, cause: r.site });
-        } else {
-          logEv({ type: "hook_continue", exit: 0, ...extra, cause: r.reason });
+    function isValidObservedAt(iso) {
+      if (typeof iso !== "string" || !iso.trim()) return false;
+      const t = Date.parse(iso);
+      return Number.isFinite(t);
+    }
+    function parseDetails(raw) {
+      if (raw == null || raw === "") return { ok: true, details: null };
+      if (typeof raw !== "string") return { ok: false, error: "--details must be a JSON string" };
+      try {
+        const v = JSON.parse(raw);
+        if (v !== null && typeof v !== "object") {
+          return { ok: false, error: "--details must be a JSON object or array" };
         }
-        return r;
-      };
-      const apiKey = resolveApiKey({ ...deps, cwd, env });
-      if (!apiKey) {
-        logEv({ type: "preflight_unavailable", cause: "missing_api_key" });
-        return emitTerminal(failClosedOrAdvisory({
-          advisory,
-          strict,
-          site: "missing_api_key",
-          why: "no API key",
-          softMsg: "CodeRifts claude-hook: no API key (coderifts login / CODERIFTS_API_KEY / git config coderifts.apiKey) \u2014 allowing",
-          errLog
-        }));
+        return { ok: true, details: v };
+      } catch (e) {
+        return { ok: false, error: `--details is not valid JSON: ${e && e.message || "parse error"}` };
       }
-      const PARSE_GAP_STDERR = "unparseable input \u2014 refusing (fail-closed); set CODERIFTS_ADVISORY=1 to soften";
-      const raw = typeof options.stdin === "string" ? options.stdin : readStdin();
-      const parsed = parseStdinJson(raw);
-      if (!parsed.ok) {
-        if (advisory && !strict) {
-          errLog(`CodeRifts claude-hook: ${parsed.reason} \u2014 allowing (CODERIFTS_ADVISORY)`);
-          return emitTerminal({ exitCode: 0, reason: "stdin_unparseable", site: "stdin_unparseable" });
-        }
-        errLog(`CodeRifts claude-hook: ${PARSE_GAP_STDERR}`);
-        return emitTerminal({ exitCode: 2, reason: "stdin_unparseable" });
+    }
+    async function runOutcome(kind, options = {}, deps = {}) {
+      const getKey = deps.getApiKey || getApiKey;
+      const postOutcome = deps.cloudPostOutcome || cloudPostOutcome;
+      const log = deps.log || console.log;
+      const errLog = deps.errLog || console.error;
+      const nowIso = deps.nowIso || (() => (/* @__PURE__ */ new Date()).toISOString());
+      if (kind == null || String(kind).trim() === "") {
+        errLog(chalk.red("Error: missing outcome kind"));
+        errLog(USAGE);
+        return { exitCode: 1, error: "missing_kind" };
       }
-      const { toolName, toolInput } = parsed;
-      tool = toolName;
-      const filePath = toolInput.file_path || toolInput.filePath || toolInput.path;
-      if (!filePath || typeof filePath !== "string") {
-        if (advisory && !strict) {
-          errLog("CodeRifts claude-hook: tool_input.file_path missing \u2014 allowing (CODERIFTS_ADVISORY)");
-          return emitTerminal({ exitCode: 0, reason: "missing_file_path", site: "missing_file_path" });
-        }
-        errLog(`CodeRifts claude-hook: ${PARSE_GAP_STDERR}`);
-        return emitTerminal({ exitCode: 2, reason: "missing_file_path" });
+      const outcomeKind = String(kind).trim();
+      if (!isValidOutcomeKind(outcomeKind)) {
+        errLog(chalk.red(`Error: invalid outcome kind '${outcomeKind}'`));
+        errLog(chalk.dim(`  Valid kinds: ${OUTCOME_KINDS.join(", ")}`));
+        return { exitCode: 1, error: "invalid_kind" };
       }
-      filePathKnown = filePath;
-      const specPath = resolveSpecPath({ ...deps, cwd });
-      if (!isSpecPath(filePath, specPath)) {
-        logEv({ type: "detection_skip", signals: ["not_spec_path"], tool, path: filePath });
-        return emitTerminal({ exitCode: 0, reason: "not_spec_path" });
+      const decisionId = options.decision != null ? String(options.decision).trim() : "";
+      if (!decisionId) {
+        errLog(chalk.red("Error: --decision <decision_id> is required"));
+        errLog(USAGE);
+        return { exitCode: 1, error: "missing_decision" };
       }
-      const absPath = path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
-      let diskBefore = "";
-      if (exists(absPath)) {
-        try {
-          diskBefore = readFile(absPath, "utf8");
-        } catch (e) {
-          logEv({ type: "preflight_unavailable", cause: "disk_unreadable", tool, path: filePath });
-          return emitTerminal(failClosedOrAdvisory({
-            advisory,
-            strict,
-            site: "disk_unreadable",
-            why: `cannot read contract file ${absPath}`,
-            softMsg: `CodeRifts claude-hook: cannot read ${absPath} \u2014 allowing (soft)`,
-            errLog
-          }));
+      let observedAt;
+      if (options.observedAt != null && String(options.observedAt).trim() !== "") {
+        observedAt = String(options.observedAt).trim();
+        if (!isValidObservedAt(observedAt)) {
+          errLog(chalk.red("Error: --observed-at must be a valid ISO-8601 timestamp"));
+          return { exitCode: 1, error: "invalid_observed_at" };
         }
+      } else {
+        observedAt = nowIso();
       }
-      const derived = deriveAfterContent(toolName, toolInput, diskBefore);
-      if (!derived.ok) {
-        logEv({ type: "preflight_unavailable", cause: "edit_apply_failed", tool, path: filePath });
-        return emitTerminal(failClosedOrAdvisory({
-          advisory,
-          strict,
-          site: "edit_apply_failed",
-          why: derived.reason,
-          softMsg: `CodeRifts claude-hook: ${derived.reason} \u2014 allowing (soft; never guess edit apply)`,
-          errLog
-        }));
+      const det = parseDetails(options.details);
+      if (!det.ok) {
+        errLog(chalk.red(`Error: ${det.error}`));
+        return { exitCode: 1, error: "invalid_details" };
       }
-      if (diskBefore === derived.after) {
-        logEv({ type: "detection_skip", signals: ["identical"], tool, path: filePath });
-        return emitTerminal({ exitCode: 0, reason: "identical" });
+      const apiKey = getKey();
+      if (!apiKey) {
+        errLog(chalk.red("Error: no API key. Run `coderifts login` or set CODERIFTS_API_KEY."));
+        return { exitCode: 1, error: "missing_api_key" };
       }
-      logEv({ type: "preflight_start", tool, path: filePath });
-      let result;
+      const body = {
+        decision_id: decisionId,
+        outcome_kind: outcomeKind,
+        observed_at: observedAt
+      };
+      if (det.details != null) body.details = det.details;
+      let response;
       try {
-        result = await authorize(diskBefore, derived.after, apiKey, {
-          operation: "merge",
-          environment: "staging"
-        });
+        response = await postOutcome(apiKey, body);
       } catch (e) {
         const msg = e && e.message ? String(e.message) : "request failed";
-        logEv({ type: "preflight_unavailable", cause: "api_unreachable", tool, path: filePath });
-        return emitTerminal(failClosedOrAdvisory({
-          advisory,
-          strict,
-          site: "api_unreachable",
-          why: `API unreachable: ${msg}`,
-          softMsg: `CodeRifts claude-hook: API unreachable (${msg}) \u2014 allowing (soft; availability must not brick the editor)`,
-          errLog
-        }));
-      }
-      const mapped = mapDecisionSeverity(result);
-      const fingerprint = extractFingerprint(result);
-      const idPart = mapped.decisionId ? ` decision_id=${mapped.decisionId}` : "";
-      const decPart = mapped.decision ? ` decision=${mapped.decision}` : "";
-      const eaPart = mapped.executionAction ? ` execution_action=${mapped.executionAction}` : "";
-      const actionForLog = mapped.executionAction || (mapped.severity === "BLOCK" || mapped.severity === "UNKNOWN" || mapped.severity === "INDETERMINATE" ? "STOP" : mapped.severity === "REQUIRE_APPROVAL" ? "REQUEST_APPROVAL" : mapped.severity === "MONITOR" || mapped.severity === "WARN" ? "CONTINUE_WITH_MONITORING" : "CONTINUE");
-      logEv({
-        type: "preflight_result",
-        action: actionForLog,
-        decisionId: mapped.decisionId || void 0,
-        fingerprint,
-        tool,
-        path: filePath
-      });
-      if (mapped.severity === "INDETERMINATE") {
-        errLog(
-          "CodeRifts claude-hook: BLOCKED (indeterminate response \u2014 no execution_action and no decision; not permission)"
-        );
-        return emitTerminal({
-          exitCode: 2,
-          reason: "indeterminate",
-          severity: "INDETERMINATE",
-          decision: mapped.decision,
-          decisionId: mapped.decisionId
-        });
-      }
-      if (mapped.severity === "BLOCK" || mapped.severity === "UNKNOWN") {
-        const why = renderDecisionWhy(result);
-        errLog(
-          [
-            `CodeRifts claude-hook: BLOCKED${decPart}${eaPart}${idPart}` + (mapped.severity === "UNKNOWN" ? " (unrecognised execution_action)" : ""),
-            ...why.lines
-          ].join("\n")
-        );
-        return emitTerminal({
-          exitCode: 2,
-          reason: mapped.severity === "UNKNOWN" ? "unknown_action" : "block",
-          severity: mapped.severity,
-          decision: mapped.decision,
-          decisionId: mapped.decisionId,
-          reasons: why.reasonCodes
-        });
-      }
-      if (mapped.severity === "REQUIRE_APPROVAL") {
-        const why = renderDecisionWhy(result);
-        errLog(
-          [
-            `CodeRifts claude-hook: BLOCKED approval_required${decPart}${eaPart}${idPart}`,
-            ...why.lines
-          ].join("\n")
-        );
-        return emitTerminal({
-          exitCode: 2,
-          reason: "approval_required",
-          severity: mapped.severity,
-          decision: mapped.decision,
-          decisionId: mapped.decisionId,
-          reasons: why.reasonCodes
-        });
+        errLog(chalk.red(`Error: ${msg}`));
+        if (e && e.statusCode) errLog(chalk.dim(`  (HTTP ${e.statusCode})`));
+        if (e && e.code) errLog(chalk.dim(`  (${e.code})`));
+        return { exitCode: 1, error: msg, body };
       }
-      if (mapped.severity === "MONITOR" || mapped.severity === "WARN") {
-        const sinkWired = isMonitoringSinkWired({ env, deps, result });
-        if (!sinkWired) {
-          errLog(
-            `CodeRifts claude-hook: BLOCKED monitoring_unwired${decPart}${eaPart}${idPart} \u2014 CONTINUE_WITH_MONITORING requires CODERIFTS_MONITORING_SINK_WIRED=1 (host assertion; not delivery proof)`
-          );
-          return emitTerminal({
-            exitCode: 2,
-            reason: "monitoring_unwired",
-            severity: mapped.severity === "WARN" ? "MONITOR" : mapped.severity,
-            decision: mapped.decision,
-            decisionId: mapped.decisionId
-          });
-        }
-        return emitTerminal({
-          exitCode: 0,
-          reason: "allow",
-          severity: mapped.severity === "WARN" ? "MONITOR" : mapped.severity,
-          decision: mapped.decision,
-          decisionId: mapped.decisionId
-        });
+      if (options.json) {
+        log(JSON.stringify(response, null, 2));
+      } else {
+        const o = response && response.outcome ? response.outcome : response;
+        log(chalk.bold("CodeRifts outcome recorded"));
+        log(`  kind:        ${outcomeKind}`);
+        log(`  decision_id: ${decisionId}`);
+        log(`  observed_at: ${observedAt}`);
+        if (o && o.id) log(`  id:          ${o.id}`);
+        if (response && response.source) log(`  source:      ${response.source}`);
+        log(chalk.dim("  Caller assertion only \u2014 this command did not verify the deploy."));
       }
-      return emitTerminal({
-        exitCode: 0,
-        reason: "allow",
-        severity: "ALLOW",
-        decision: mapped.decision,
-        decisionId: mapped.decisionId
-      });
+      return { exitCode: 0, response, body };
     }
     module2.exports = {
-      runClaudeHook,
-      parseStdinJson,
-      isSpecPath,
-      deriveAfterContent,
-      mapDecisionSeverity,
-      renderDecisionWhy,
-      resolveApiKey,
-      resolveSpecPath,
-      readGitConfig,
-      isEnvFlag,
-      isStrictMode,
-      isAdvisoryMode,
-      isMonitoringSinkWired,
-      failClosedOrAdvisory,
-      softOrStrictBlock,
-      DEFAULT_SPEC_PATH,
-      CLOSED_ACTIONS,
-      USAGE,
-      appendGuardEventLog,
-      extractFingerprint,
-      HOOK_TRIGGER_SOURCE
+      runOutcome,
+      isValidOutcomeKind,
+      isValidObservedAt,
+      parseDetails,
+      OUTCOME_KINDS,
+      USAGE
     };
   }
 });
@@ -103796,7 +103918,7 @@ program.command("diff <old-spec> <new-spec>").description("Compare two OpenAPI s
   const { diff } = require_diff();
   await diff(oldSpec, newSpec, options);
 });
-program.command("deploy-gate").description("Gate a deploy on the current { environment, artifact } using a preflight receipt (phase-1 advisory)").option("--env <environment>", "Target environment (e.g. production, staging)").option("--artifact <artifact_id>", "Immutable artifact identity being deployed (content digest or commit SHA)").option("--receipt <file>", "Path to the deploy-scoped receipt JSON produced by preflight").option("--json", "Output the binding result as JSON").option("--enforce", "Treat the step as enforcing: attest ENFORCING and exit non-zero on a gate failure").action(async (options) => {
+program.command("deploy-gate").description("Gate a deploy on the current { environment, artifact } using a preflight receipt (fail-closed by default; CODERIFTS_DEPLOY_ADVISORY=1 to soften)").option("--env <environment>", "Target environment (e.g. production, staging)").option("--artifact <artifact_id>", "Immutable artifact identity being deployed (content digest or commit SHA)").option("--receipt <file>", "Path to the deploy-scoped receipt JSON produced by preflight").option("--json", "Output the binding result as JSON").option("--enforce", "Accepted silently (exit is fail-closed by default). Still attests ENFORCING for inescapable_deploy.").action(async (options) => {
   const { runDeployGate } = require_deploy_gate2();
   await runDeployGate(options);
 });