coderifts 4.4.0 → 4.4.1

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 4.4.1
+
+**Sequencing:** `@coderifts/agent-guard` **9.0.0** is the verifier of record
+for `deploy-gate` (TOKEN mode). Publish **guard 9.0.0 first**, then this CLI.
+4.4.0 against 9.0.0 would DENY `unverified_receipt_view` (unstamped computed
+view).
+
+### Changed
+- **TOKEN mode.** `deployBind` passes `{ token, decision_result, registry |
+  pinnedKeyPem }` to `deployGate`. The CLI never sends an unstamped
+  `currently_authorized` view. The §154 matrix view path is stamped with
+  `asVerifiedDeployReceiptView` (`view_spec: 'deploy-receipt-view.v1'`).
+- **One verdict, one WHY.** Guard 9.0.0 is the cause. The app kernel still
+  verifies for 842 rendering (corroboration + envelope `blocking_reasons`)
+  but does not produce a second deny. `authz_reason` equals the gate
+  `reason`. JSON `causes_agree` is true when kernel maps to the same cause.
+- **`MIN_GUARD_MAJOR` 8 → 9.** Dependency range `^9.0.0`.
+
+### Migration
+- Requires `@coderifts/agent-guard@9.0.0`. Local test against unpublished
+  9.0.0: install the packed tarball into `node_modules` while keeping the
+  declared range `^9.0.0` (`file:` is rejected by `assert-guard-major` at
+  publish).
+
 ## 4.4.0
 
 **Behaviour change (breaking for anyone relying on a forged receipt file)** —

package/README.md

@@ -101,13 +101,17 @@ Gate a **deploy** on the current `{ environment, artifact }` using a **signed**
 preflight receipt. Fail-closed by default (842 / hook pattern). The CD sibling of
 `publish-gate` / the merge-gate App check.
 
-The CLI **verifies locally** (Ed25519 against the key registry, kid status /
-retired-window, body-hash over the decision envelope, expiry with ID104
-leeway, intended-context bind of operation / environment / artifact /
-fingerprint). Crypto is the app kernel (`verifyReceipt` +
-`evaluateVerifyAuthorization`) — not reimplemented here. Then it binds the
-**computed** receipt view into the validated `deployGate` from
-`@coderifts/agent-guard`. No scoring is reimplemented.
+**Verification contract split (4.4.1 / guard 9.0.0):**
+
+- **Verdict:** `@coderifts/agent-guard` `deployGate` **TOKEN mode** is the
+  verifier of record. The CLI passes `{ token, decision_result, registry |
+  pinnedKeyPem }` — it never sends an unstamped `currently_authorized` view.
+- **WHY (842):** the CLI still runs the app kernel (`verifyReceipt` +
+  `evaluateVerifyAuthorization`) to corroborate `verify_status` and to print
+  envelope `blocking_reasons`. That is **not** a second verdict: one cause
+  (the gate `reason`), one WHY.
+
+Crypto is not reimplemented in the CLI. No scoring is reimplemented.
 
 **`--receipt` contract:** the file MUST carry the signed chain receipt token
 (`token` / `chain_receipt` / `receipt.token` / `decision_result.receipt.token`)