coderifts 4.2.1 → 4.3.0

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 4.3.0
+
+**Behaviour change (minor-worthy)** — `coderifts deploy-gate` is fail-closed
+by default. Same hook pattern as P0-3 (`claude-hook`): a deterministic wall
+plus first-message WHY beats an ambiguous advisory (853 evidence).
+
+### Changed
+- **`deploy-gate` default is fail-closed.** Missing / invalid / expired
+  receipt, scope mismatch, or deny-class → **exit 1**. stderr prints WHY
+  (gate reason + `renderDecisionWhy` when a decision body exists) and
+  `set CODERIFTS_DEPLOY_ADVISORY=1 to soften`. Pending `no_receipt` is a
+  policy fail, not an allow.
+- **`--enforce` / `CODERIFTS_DEPLOY_ENFORCE=true` is a silent no-op for
+  exit** (default is already fail-closed). It still attests ENFORCING for
+  the `inescapable_deploy` claim.
+- **Infra-failure is distinct from policy BLOCK.** Missing `--env` /
+  `--artifact` or malformed receipt JSON → `INFRA <site> — <why>` plus
+  `retryable: true` and `this is not a policy BLOCK`. Still fail-closed
+  by default. There is no network verify step in this command.
+
+### Added
+- **`CODERIFTS_DEPLOY_ADVISORY=1|true`** (also `CODERIFTS_ADVISORY=1|true`)
+  is the explicit exception: print the verdict, always print
+  `ADVISORY MODE — this gate did not block`, exit 0. Softens both policy
+  and infra failures.
+
+### Migration
+- Pipelines that relied on phase-1 advisory (deny exits 0 unless
+  `--enforce`) will now **fail the deploy step** on a failing chain.
+  Explicit opt-out: `CODERIFTS_DEPLOY_ADVISORY=1`. `--enforce` remains
+  accepted so existing workflow YAML does not break.
+
 ## 4.2.1
 
 ### Added

package/README.md

@@ -98,15 +98,29 @@ On success the command prints a **receipt reference** when the preflight path is
 ### `coderifts deploy-gate`
 
 Gate a **deploy** on the current `{ environment, artifact }` using a preflight
-receipt (phase-1 advisory). The CD sibling of `publish-gate` / the merge-gate
-App check. Composes the validated `deployGate` from `@coderifts/agent-guard` —
-the CLI only binds env + artifact + receipt + observed CD enforcement. No
-scoring is reimplemented here.
+receipt. Fail-closed by default (842 / hook pattern). The CD sibling of
+`publish-gate` / the merge-gate App check. Composes the validated `deployGate`
+from `@coderifts/agent-guard` — the CLI only binds env + artifact + receipt +
+observed CD enforcement. No scoring is reimplemented here.
 
-Phase 1 **reports** and exits **0** even on a gate deny, unless the step is
-marked enforcing (`--enforce` or `CODERIFTS_DEPLOY_ENFORCE=true`), in which
-case a failure exits **1**. Missing `--env` / `--artifact` is a usage error
-(exit **1**). No receipt → pending (never a fabricated allow).
+**Default:** a failing chain (missing / invalid / expired receipt, scope
+mismatch, deny-class) exits **1**. stderr prints WHY (gate reason + decision
+body when present) and `set CODERIFTS_DEPLOY_ADVISORY=1 to soften`.
+
+**Advisory opt-out:** `CODERIFTS_DEPLOY_ADVISORY=1|true` (also
+`CODERIFTS_ADVISORY=1|true`) prints the verdict, always prints
+`ADVISORY MODE — this gate did not block`, and exits **0**.
+
+**`--enforce` / `CODERIFTS_DEPLOY_ENFORCE=true`:** accepted silently (no-op
+for exit — default is already fail-closed). Still attests ENFORCING for the
+`inescapable_deploy` claim.
+
+**Infra vs policy:** missing `--env` / `--artifact` or malformed receipt JSON
+prints distinct `INFRA` wording plus `retryable: true` and
+`this is not a policy BLOCK`. Still fail-closed by default; advisory softens
+it too. A missing receipt is a **policy** fail (`no_receipt`), not infra.
+
+Happy path (receipt authorizes this env+artifact) exits **0**.
 
 | Flag | Description | Default |
 |------|-------------|---------|
@@ -114,11 +128,11 @@ case a failure exits **1**. Missing `--env` / `--artifact` is a usage error
 | `--artifact <artifact_id>` | Immutable artifact identity (content digest or commit SHA) | required |
 | `--receipt <file>` | Path to the deploy-scoped receipt JSON from preflight | none |
 | `--json` | Binding result as JSON | `false` |
-| `--enforce` | Attest ENFORCING and exit non-zero on a gate failure | `false` |
+| `--enforce` | Accepted silently (exit already fail-closed). Still attests ENFORCING. | `false` |
 
 ```bash
 coderifts deploy-gate --env production --artifact "$SHA" --receipt receipt.json
-coderifts deploy-gate --env production --artifact "$SHA" --receipt receipt.json --enforce
+CODERIFTS_DEPLOY_ADVISORY=1 coderifts deploy-gate --env production --artifact "$SHA" --receipt receipt.json
 ```
 
 ### `coderifts outcome <kind>`
@@ -510,17 +524,18 @@ Two honest modes:
 | `CODERIFTS_API_KEY` | API key (alternative to `coderifts login`) |
 | `CODERIFTS_OASDIFF_BIN` | Explicit path to the `oasdiff` binary (overrides auto-detect) |
 | `CODERIFTS_STRICT` | `claude-hook`: `1` or `true` pins fail-closed (cannot be weakened by `CODERIFTS_ADVISORY`). Default is already fail-closed. |
-| `CODERIFTS_ADVISORY` | `claude-hook`: `1` or `true` is the **explicit** soft-allow opt-out on “governance could not run” sites. Absence of a key is not this flag. |
+| `CODERIFTS_ADVISORY` | `claude-hook`: `1` or `true` is the **explicit** soft-allow opt-out on “governance could not run” sites. Absence of a key is not this flag. Also accepted by `deploy-gate` as the same opt-out as `CODERIFTS_DEPLOY_ADVISORY`. |
 | `CODERIFTS_MONITORING_SINK_WIRED` | `claude-hook`: `1` or `true` host-asserts a monitoring sink so `CONTINUE_WITH_MONITORING` may exit 0. Not delivery proof. |
-| `CODERIFTS_DEPLOY_ENFORCE` | `deploy-gate`: `true` marks the step enforcing (same as `--enforce`); `unknown` is explicitly unobservable (never assume ENFORCING) |
+| `CODERIFTS_DEPLOY_ADVISORY` | `deploy-gate`: `1` or `true` is the **explicit** opt-out — print the verdict, print `ADVISORY MODE — this gate did not block`, exit 0. |
+| `CODERIFTS_DEPLOY_ENFORCE` | `deploy-gate`: `true` attests ENFORCING (same as `--enforce`; no-op for exit — default is already fail-closed); `unknown` is explicitly unobservable (never assume ENFORCING) |
 | `NO_COLOR` | Disable colored output |
 
 ## Exit Codes
 
 | Code | Meaning |
 |------|---------|
-| `0` | Success: no breaking changes (or below threshold); advisory `deploy-gate`; `lock --check` unchanged; `adopt` / `status` / `outcome` success |
-| `1` | Breaking changes (CI mode), analysis/usage/API failure, or `deploy-gate` deny **when enforcing** |
+| `0` | Success: no breaking changes (or below threshold); `deploy-gate` allow, or advisory opt-out; `lock --check` unchanged; `adopt` / `status` / `outcome` success |
+| `1` | Breaking changes (CI mode), analysis/usage/API failure, or `deploy-gate` policy/infra fail (fail-closed default) |
 | `2` | `claude-hook` BLOCK (Claude Code cancel); `lock --check` unreachable / missing locked or live |
 | `3` | `lock --check` drift detected (monitor only — does not block the package) |
 

package/bin/coderifts.js

@@ -25,18 +25,18 @@ program
     await diff(oldSpec, newSpec, options);
   });
 
-// ── deploy-gate command (deploy-gate #8, phase-1 ADVISORY) ──
-// Gates a deploy on the current { environment, artifact } via a preflight receipt. Phase 1 is
-// advisory: it reports but exits 0 even on deny unless the step is marked --enforce /
-// CODERIFTS_DEPLOY_ENFORCE=true. Composes the validated pure deployGate (@coderifts/agent-guard).
+// ── deploy-gate command (deploy-gate #8) ──
+// Gates a deploy on the current { environment, artifact } via a preflight receipt.
+// DEFAULT fail-closed (842 / hook pattern). CODERIFTS_DEPLOY_ADVISORY=1 is the explicit
+// opt-out. --enforce is accepted silently (no-op for exit; still attests ENFORCING).
 program
   .command('deploy-gate')
-  .description('Gate a deploy on the current { environment, artifact } using a preflight receipt (phase-1 advisory)')
+  .description('Gate a deploy on the current { environment, artifact } using a preflight receipt (fail-closed by default; CODERIFTS_DEPLOY_ADVISORY=1 to soften)')
   .option('--env <environment>', 'Target environment (e.g. production, staging)')
   .option('--artifact <artifact_id>', 'Immutable artifact identity being deployed (content digest or commit SHA)')
   .option('--receipt <file>', 'Path to the deploy-scoped receipt JSON produced by preflight')
   .option('--json', 'Output the binding result as JSON')
-  .option('--enforce', 'Treat the step as enforcing: attest ENFORCING and exit non-zero on a gate failure')
+  .option('--enforce', 'Accepted silently (exit is fail-closed by default). Still attests ENFORCING for inescapable_deploy.')
   .action(async (options) => {
     const { runDeployGate } = require('../src/commands/deploy-gate');
     await runDeployGate(options);