coderifts 4.4.1 → 4.7.0

package/dist/cli.js

@@ -3028,7 +3028,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "4.4.1",
+      version: "4.7.0",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -207461,18 +207461,31 @@ var require_deploy_gate2 = __commonJS({
       return isEnvFlag(e, "CODERIFTS_DEPLOY_ADVISORY") || isEnvFlag(e, "CODERIFTS_ADVISORY");
     }
     function observeCDEnforcement(options = {}) {
+      const evidence = options.providerEvidence;
+      const hostClaimNoBypass = String(process.env.CODERIFTS_DEPLOY_NO_BYPASS || "").toLowerCase() === "true";
+      if (evidence && evidence.inescapable_deploy === true) {
+        return {
+          enforcement: "ENFORCING",
+          bypass_possible: false,
+          step_is_required: true,
+          required_step_name: "CodeRifts / deploy-gate",
+          attestation_source: "provider_query",
+          host_claim_no_bypass: hostClaimNoBypass
+        };
+      }
       const envVal = String(process.env.CODERIFTS_DEPLOY_ENFORCE || "").toLowerCase();
       let enforcement;
       if (enforceSignal(options)) enforcement = "ENFORCING";
       else if (envVal === "unknown") enforcement = "UNKNOWN";
       else enforcement = "ADVISORY";
-      const bypass_possible = String(process.env.CODERIFTS_DEPLOY_NO_BYPASS || "").toLowerCase() !== "true";
       return {
         enforcement,
-        bypass_possible,
+        bypass_possible: true,
+        // host NO_BYPASS is a claim, not queried evidence
         step_is_required: enforcement === "ENFORCING",
         required_step_name: "CodeRifts / deploy-gate",
-        attestation_source: "cli_flag"
+        attestation_source: "cli_flag",
+        host_claim_no_bypass: hostClaimNoBypass
       };
     }
     function deployReportResiduals(state, enforcement_inescapable, enforcement, change_set_rebound) {
@@ -207795,7 +207808,7 @@ var require_deploy_gate2 = __commonJS({
       if (bind.report_residuals.length) lines.push(`  Residuals:          ${bind.report_residuals.join(", ")}`);
       if (bind.must_re_preflight) lines.push(chalk.yellow("  Action: re-preflight this { environment, artifact } \u2014 the receipt does not authorize it."));
       lines.push("");
-      lines.push(enforce ? chalk.dim("  Attested ENFORCING (inescapable_deploy claim). Exit is fail-closed by default.") : chalk.dim("  Fail-closed default \u2014 a failing gate exits non-zero. " + SOFTEN_HINT + "."));
+      lines.push(enforce ? chalk.dim("  Attested ENFORCING via --enforce (host claim). inescapable_deploy requires queried pipeline protection (`coderifts enforce --check`). Exit is fail-closed by default.") : chalk.dim("  Fail-closed default \u2014 a failing gate exits non-zero. " + SOFTEN_HINT + "."));
       lines.push("");
       return lines.join("\n");
     }
@@ -208972,6 +208985,1555 @@ var require_registry_gate = __commonJS({
   }
 });
 
+// src/agent-host-files.embedded.js
+var require_agent_host_files_embedded = __commonJS({
+  "src/agent-host-files.embedded.js"(exports2, module2) {
+    "use strict";
+    var AGENT_HOST_PATHS = Object.freeze([
+      "AGENTS.md",
+      "CLAUDE.md",
+      ".cursor/rules/coderifts.mdc",
+      ".github/copilot-instructions.md",
+      "coderifts-langgraph-policy.js",
+      "openai-agent-instructions.md",
+      ".claude/settings.json",
+      ".cursor/hooks.json"
+    ]);
+    var AGENT_HOST_FILES = Object.freeze({
+      "AGENTS.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent rules\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      "CLAUDE.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      ".cursor/rules/coderifts.mdc": '---\ndescription: CodeRifts API governance \u2014 when to preflight and how to branch\nglobs:\nalwaysApply: true\n---\n\n<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      ".github/copilot-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts instructions for GitHub Copilot\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      "coderifts-langgraph-policy.js": '// GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js\n// System policy string for a LangGraph (or similar) agent. Content is generated;\n// identical rule sentences to AGENTS.md / other formats.\n\'use strict\';\n\nmodule.exports = "Call `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\\n\\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\\n\\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\\n\\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\\n\\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not \\"proceed with caution\\" without monitoring.\\n\\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\\n\\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\\n\\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\\n\\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\\n\\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\\n\\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\\n\\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\\n\\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\\n\\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\\n\\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\\n\\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\\n\\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\\n\\nWith a proven tenant\u2194repo binding you may request `derivation:\\"server\\"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\\n\\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say \\"authorized, commit not proven\\".";\n',
+      "openai-agent-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent instructions\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      ".claude/settings.json": '{\n  "hooks": {\n    "PreToolUse": [\n      {\n        "matcher": "Write|Edit|MultiEdit",\n        "hooks": [\n          {\n            "type": "command",\n            "command": "coderifts claude-hook",\n            "timeout": 60\n          }\n        ]\n      }\n    ]\n  }\n}\n',
+      ".cursor/hooks.json": '{\n  "version": 1,\n  "hooks": {\n    "preToolUse": [\n      {\n        "command": "coderifts cursor-hook",\n        "matcher": "Write|Delete",\n        "timeout": 60,\n        "failClosed": true\n      }\n    ]\n  }\n}\n'
+    });
+    module2.exports = { AGENT_HOST_FILES, AGENT_HOST_PATHS };
+  }
+});
+
+// src/commands/agent-setup.js
+var require_agent_setup = __commonJS({
+  "src/commands/agent-setup.js"(exports2, module2) {
+    "use strict";
+    var fs = require("fs");
+    var path = require("path");
+    var chalk = require_source();
+    var { AGENT_HOST_FILES, AGENT_HOST_PATHS } = require_agent_host_files_embedded();
+    if (process.env.NO_COLOR) chalk.level = 0;
+    var USAGE = `Usage: coderifts agent-setup [--out <dir>] [--check] [--force]
+
+  --out <dir>   Target directory (default: current working directory)
+  --check       Exit 0 if on-disk files match embedded content; exit 1 on drift
+  --force       Overwrite existing files (default: skip collisions)
+  Unknown flags exit 1 (never silently ignored).
+`;
+    function parseAgentSetupArgs(argv) {
+      const args = argv.slice(2);
+      let out = null;
+      let check = false;
+      let force = false;
+      let i = 0;
+      while (i < args.length && !String(args[i]).startsWith("-")) i += 1;
+      while (i < args.length) {
+        const a = args[i];
+        if (a === "--out") {
+          const v = args[i + 1];
+          if (v == null || v.startsWith("-")) {
+            return { out, check, force, error: `agent-setup: --out requires a path
+${USAGE}` };
+          }
+          out = path.resolve(v);
+          i += 2;
+          continue;
+        }
+        if (a === "--check") {
+          check = true;
+          i += 1;
+          continue;
+        }
+        if (a === "--force") {
+          force = true;
+          i += 1;
+          continue;
+        }
+        if (a.startsWith("-")) {
+          return { out, check, force, error: `agent-setup: unrecognized argument: ${a}
+${USAGE}` };
+        }
+        return { out, check, force, error: `agent-setup: unrecognized argument: ${a}
+${USAGE}` };
+      }
+      return { out, check, force };
+    }
+    function runAgentSetup(options = {}, deps = {}) {
+      const log = deps.log || console.log.bind(console);
+      const logErr = deps.logErr || console.error.bind(console);
+      const doExit = deps.exit !== false;
+      const cwd = deps.cwd || process.cwd();
+      const exists = deps.exists || fs.existsSync.bind(fs);
+      const readFile = deps.readFile || ((p) => fs.readFileSync(p, "utf8"));
+      const writeFile = deps.writeFile || ((p, c) => {
+        fs.mkdirSync(path.dirname(p), { recursive: true });
+        fs.writeFileSync(p, c, "utf8");
+      });
+      let outDir = options.out ? path.resolve(String(options.out)) : cwd;
+      let check = !!options.check;
+      let force = !!options.force;
+      if (deps.argv) {
+        const parsed = parseAgentSetupArgs(deps.argv);
+        if (parsed.error) {
+          logErr(parsed.error.trimEnd());
+          if (doExit) process.exit(1);
+          return { exitCode: 1, code: "USAGE", message: parsed.error };
+        }
+        if (parsed.out) outDir = parsed.out;
+        check = parsed.check;
+        force = parsed.force;
+      }
+      const files = deps.files || AGENT_HOST_FILES;
+      const relPaths = deps.paths || AGENT_HOST_PATHS;
+      if (check) {
+        let stale = false;
+        for (const rel of relPaths) {
+          const fp = path.join(outDir, rel);
+          const expected = files[rel];
+          if (!exists(fp)) {
+            logErr(chalk.red(`agent-setup --check: missing ${rel}`));
+            stale = true;
+            continue;
+          }
+          const onDisk = readFile(fp);
+          if (onDisk !== expected) {
+            logErr(chalk.red(`agent-setup --check: drift ${rel}`));
+            stale = true;
+          }
+        }
+        if (stale) {
+          logErr("Run: coderifts agent-setup --out " + outDir + " --force");
+          if (doExit) process.exit(1);
+          return { exitCode: 1, code: "DRIFT", outDir };
+        }
+        log(chalk.green(`agent-setup: up to date (${outDir}, ${relPaths.length} files)`));
+        if (doExit) process.exit(0);
+        return { exitCode: 0, code: "UP_TO_DATE", outDir };
+      }
+      const summary = writeAgentHostFiles({
+        outDir,
+        force,
+        files,
+        paths: relPaths,
+        exists,
+        writeFile,
+        dryRun: !!options.dryRun
+      });
+      if (!options.json) {
+        log(chalk.bold("CodeRifts agent-setup"));
+        log(`  target: ${outDir}`);
+        for (const rel of summary.written) {
+          const tag = summary.forced.includes(rel) ? "overwrote" : "wrote";
+          log(chalk.green(`  ${tag}:   ${rel}`));
+        }
+        for (const rel of summary.skipped) {
+          log(chalk.yellow(`  skipped: ${rel} (exists; use --force to overwrite)`));
+        }
+        log("");
+        log(chalk.dim(`  ${summary.written.length} written, ${summary.skipped.length} skipped`));
+        log("");
+        for (const line of AGENT_SETUP_WARN_TELEMETRY_LINES) {
+          log(line);
+        }
+        if (summary.skipped.includes(".claude/settings.json")) {
+          for (const line of AGENT_SETUP_HOOK_SKIP_LINES) {
+            log(line);
+          }
+        } else if (summary.written.includes(".claude/settings.json")) {
+          for (const line of AGENT_SETUP_HOOK_WIRE_LINES) {
+            log(line);
+          }
+        }
+      }
+      if (doExit) process.exit(0);
+      return { exitCode: 0, code: "OK", outDir, ...summary };
+    }
+    var AGENT_SETUP_WARN_TELEMETRY_LINES = Object.freeze([
+      chalk.bold("  Execution-state recheck (guard@8): DEFAULT ON"),
+      chalk.dim("  requireExecutionStateMatch absent/true \u2192 enforce: mismatch \u2192 EXECUTION_STATE_DRIFT"),
+      chalk.dim("  (factory does not run); missing fingerprint/artifacts \u2192 EXECUTION_STATE_UNMEASURABLE (STOP)."),
+      chalk.dim("  Opt-down: requireExecutionStateMatch: 'warn' (emit, then run unenforced on mismatch)"),
+      chalk.dim("  or false (no recheck \u2014 v7 proceed-on-drift). Must be set explicitly."),
+      chalk.dim("  Warn emits (then PROCEEDS \u2014 never blocks in warn mode):"),
+      chalk.dim("    \xB7 real drift \u2192 execution_state_drift_observed (loud)"),
+      chalk.dim("    \xB7 missing artifacts/fingerprint \u2192 execution_state_unmeasurable (quiet)"),
+      chalk.dim("  Merge gate block is separate: coderifts setup-required-check --apply")
+    ]);
+    var AGENT_SETUP_HOOK_WIRE_LINES = Object.freeze([
+      chalk.bold("  Claude Code hook (.claude/settings.json): fail-closed PreToolUse"),
+      chalk.dim("  matcher Write|Edit|MultiEdit \u2192 coderifts claude-hook (exit 2 = BLOCK)."),
+      chalk.dim("  Missing key / API down / unreadable spec \u2192 exit 2 (enforce_indeterminate), not ALLOW."),
+      chalk.dim("  Opt-out: CODERIFTS_ADVISORY=1|true restores soft-allow when governance could not run."),
+      chalk.dim("  CODERIFTS_STRICT=1 cannot be weakened by ADVISORY.")
+    ]);
+    var AGENT_SETUP_HOOK_SKIP_LINES = Object.freeze([
+      chalk.yellow("  .claude/settings.json exists \u2014 left unchanged (installer does not merge)."),
+      chalk.dim("  --force replaces the ENTIRE file (not just the PreToolUse hook)."),
+      chalk.dim("  To wire fail-closed: add PreToolUse \u2192 coderifts claude-hook by hand, or --force."),
+      chalk.dim("  Opt-out if wired: CODERIFTS_ADVISORY=1|true. CODERIFTS_STRICT cannot weaken.")
+    ]);
+    function writeAgentHostFiles(opts = {}) {
+      const outDir = opts.outDir;
+      const force = !!opts.force;
+      const files = opts.files || AGENT_HOST_FILES;
+      const relPaths = opts.paths || AGENT_HOST_PATHS;
+      const exists = opts.exists || fs.existsSync.bind(fs);
+      const writeFile = opts.writeFile || ((p, c) => {
+        fs.mkdirSync(path.dirname(p), { recursive: true });
+        fs.writeFileSync(p, c, "utf8");
+      });
+      const dryRun = !!opts.dryRun;
+      const summary = { written: [], skipped: [], forced: [] };
+      for (const rel of relPaths) {
+        const fp = path.join(outDir, rel);
+        if (exists(fp) && !force) {
+          summary.skipped.push(rel);
+          continue;
+        }
+        if (exists(fp) && force) summary.forced.push(rel);
+        if (!dryRun) writeFile(fp, files[rel]);
+        summary.written.push(rel);
+      }
+      return summary;
+    }
+    module2.exports = {
+      runAgentSetup,
+      parseAgentSetupArgs,
+      writeAgentHostFiles,
+      AGENT_HOST_FILES,
+      AGENT_HOST_PATHS,
+      USAGE,
+      AGENT_SETUP_WARN_TELEMETRY_LINES,
+      AGENT_SETUP_HOOK_WIRE_LINES,
+      AGENT_SETUP_HOOK_SKIP_LINES
+    };
+  }
+});
+
+// src/commands/hook.js
+var require_hook = __commonJS({
+  "src/commands/hook.js"(exports2, module2) {
+    "use strict";
+    var fs = require("fs");
+    var path = require("path");
+    var os = require("os");
+    var { execSync } = require("child_process");
+    var HOOK_MARKER = "# CodeRifts pre-push hook";
+    var PRE_PUSH_SCRIPT = `#!/bin/sh
+${HOOK_MARKER}
+# Checks API spec changes before pushing.
+# The pre-push hook receives lines on stdin:
+#   <local ref> <local sha> <remote ref> <remote sha>
+#
+# Re-install after CLI upgrades: coderifts hook install
+#
+# Exit map (fail-closed when configured):
+#   CODERIFTS_SKIP=1          \u2192 exit 0 (explicit loud override)
+#   no apiKey                 \u2192 exit 0 soft (not configured)
+#   BLOCK / STOP / UNKNOWN    \u2192 exit 1
+#   INDETERMINATE (no decision obtainable) \u2192 exit 1
+#   ALLOW / analysis clean    \u2192 exit 0
+#   REQUIRE_APPROVAL / WARN   \u2192 warn, exit 0
+
+# Explicit escape hatch \u2014 never the default on error; human must set this.
+if [ "\${CODERIFTS_SKIP:-}" = "1" ]; then
+  echo "CodeRifts: CODERIFTS_SKIP=1 set \u2014 push allowed (explicit override)." >&2
+  exit 0
+fi
+
+CODERIFTS_API_KEY=$(git config coderifts.apiKey)
+SPEC_PATH=$(git config coderifts.specPath || echo "api/openapi.yaml")
+ZERO="0000000000000000000000000000000000000000"
+
+if [ -z "$CODERIFTS_API_KEY" ]; then
+  echo "CodeRifts: No API key configured. Run: git config coderifts.apiKey <your-key>"
+  exit 0  # Don't block if not configured
+fi
+
+# --- helpers: three-state git blob read (present | absent | error) ---
+# Sets: BLOB_KIND, BLOB_CONTENT, BLOB_ERR. Never maps unreadable \u2192 empty string.
+git_blob_at() {
+  _ref="$1"
+  _path="$2"
+  BLOB_CONTENT=""
+  BLOB_ERR=""
+  BLOB_KIND=""
+  if ! git rev-parse --verify "$_ref^{commit}" >/dev/null 2>&1; then
+    BLOB_KIND=error
+    BLOB_ERR="GIT_ERROR: cannot resolve ref $_ref"
+    return 1
+  fi
+  _errf=$(mktemp 2>/dev/null || echo "/tmp/coderifts-hook-err.$$")
+  if BLOB_CONTENT=$(git show "$_ref:$_path" 2>"$_errf"); then
+    BLOB_KIND=present
+    rm -f "$_errf"
+    return 0
+  fi
+  _err=$(cat "$_errf" 2>/dev/null)
+  rm -f "$_errf"
+  case "$_err" in
+    *"does not exist in"*|*"exists on disk, but not in"*)
+      BLOB_KIND=absent
+      BLOB_CONTENT=""
+      return 0
+      ;;
+  esac
+  BLOB_KIND=error
+  BLOB_ERR="GIT_ERROR: git show $_ref:$_path failed"
+  return 1
+}
+
+# New-branch baseline: merge-base with default branch (not empty before).
+# Prints merge-base SHA on success; nonzero if none can be resolved.
+resolve_new_branch_base_ref() {
+  _local="$1"
+  for _cand in origin/HEAD origin/main origin/master main master; do
+    _mb=$(git merge-base "$_local" "$_cand" 2>/dev/null) || continue
+    if [ -n "$_mb" ] && [ "$_mb" != "$ZERO" ]; then
+      echo "$_mb"
+      return 0
+    fi
+  done
+  return 1
+}
+
+# Read stdin lines provided by git pre-push
+while read LOCAL_REF LOCAL_SHA REMOTE_REF REMOTE_SHA; do
+  # Skip delete pushes
+  if [ "$LOCAL_SHA" = "$ZERO" ]; then
+    continue
+  fi
+
+  # after = local (about-to-be-pushed) commit \u2014 three-state
+  if ! git_blob_at "$LOCAL_SHA" "$SPEC_PATH"; then
+    echo "CodeRifts: $BLOB_ERR (after=$SPEC_PATH at $LOCAL_SHA). Fail-closed."
+    exit 1
+  fi
+  if [ "$BLOB_KIND" = "absent" ]; then
+    continue  # Spec doesn't exist in local commit, skip
+  fi
+  HEAD_SPEC=$BLOB_CONTENT
+
+  # before = remote tip, or for new branch (zero remote SHA) a merge-base baseline
+  if [ "$REMOTE_SHA" = "$ZERO" ]; then
+    BASE_REF=$(resolve_new_branch_base_ref "$LOCAL_SHA") || {
+      echo "CodeRifts: GIT_ERROR \u2014 cannot resolve merge-base baseline for new branch (tried origin/HEAD, origin/main, origin/master, main, master). Fail-closed."
+      exit 1
+    }
+  else
+    BASE_REF=$REMOTE_SHA
+  fi
+
+  if ! git_blob_at "$BASE_REF" "$SPEC_PATH"; then
+    echo "CodeRifts: $BLOB_ERR (before=$SPEC_PATH at $BASE_REF). Fail-closed \u2014 not treating as new spec."
+    exit 1
+  fi
+  if [ "$BLOB_KIND" = "absent" ]; then
+    # Honest NEW_ARTIFACT: path genuinely not at baseline
+    echo "CodeRifts: New artifact (spec absent at baseline $BASE_REF:$SPEC_PATH); allowing push."
+    continue
+  fi
+  BASE_SPEC=$BLOB_CONTENT
+
+  # If specs are identical, nothing to check
+  if [ "$BASE_SPEC" = "$HEAD_SPEC" ]; then
+    continue
+  fi
+
+  echo "CodeRifts: Checking API spec changes (baseline $BASE_REF)..."
+
+  # Capture body + HTTP status separately (fail-closed on non-2xx when configured).
+  _CR_BODY=$(mktemp 2>/dev/null || echo "/tmp/coderifts-hook-body.$$")
+  _CR_HTTP=$(curl -sS -o "$_CR_BODY" -w "%{http_code}" -X POST https://app.coderifts.com/api/v1/diff \\
+    -H "Authorization: Bearer $CODERIFTS_API_KEY" \\
+    -H "Content-Type: application/json" \\
+    -d "{\\"before\\": $(echo "$BASE_SPEC" | python3 -c 'import sys,json; print(json.dumps(sys.stdin.read()))'), \\"after\\": $(echo "$HEAD_SPEC" | python3 -c 'import sys,json; print(json.dumps(sys.stdin.read()))')}" 2>/dev/null) || _CR_HTTP="000"
+  RESULT=$(cat "$_CR_BODY" 2>/dev/null)
+  rm -f "$_CR_BODY"
+
+  # (a) HTTP non-2xx (incl. transport fail \u2192 000) \u2192 configured-but-indeterminate
+  case "$_CR_HTTP" in
+    2??) ;;
+    *)
+      echo "CodeRifts could not obtain a decision (HTTP \${_CR_HTTP:-000}); push blocked \u2014 set CODERIFTS_SKIP=1 to override intentionally" >&2
+      exit 1
+      ;;
+  esac
+
+  # Prefer closed-set execution_action; omega_decision only when action is absent.
+  # Indeterminate classes \u2192 INDETERMINATE (fail closed), never default ALLOW.
+  # Severity: BLOCK/STOP \u2192 exit 1; REQUIRE_APPROVAL/WARN \u2192 warn; unknown action \u2192 halt;
+  #           INDETERMINATE / empty \u2192 exit 1 (configured-but-indeterminate).
+  DECISION=$(echo "$RESULT" | python3 -c '
+import sys, json
+raw = sys.stdin.read()
+if raw is None or not str(raw).strip():
+    print("INDETERMINATE")
+    raise SystemExit(0)
+try:
+    d = json.loads(raw)
+except Exception:
+    # (b) 2xx but unparseable JSON
+    print("INDETERMINATE")
+    raise SystemExit(0)
+if not isinstance(d, dict):
+    print("INDETERMINATE")
+    raise SystemExit(0)
+# API error body without a decision (e.g. {"error":"internal_error"} / server_error)
+if d.get("error") and not (
+    d.get("omega_decision") or d.get("decision")
+    or d.get("execution_action")
+    or (isinstance(d.get("decision_result"), dict) and d["decision_result"].get("execution_action"))
+):
+    print("INDETERMINATE")
+    raise SystemExit(0)
+ea = None
+dr = d.get("decision_result")
+if isinstance(dr, dict) and isinstance(dr.get("execution_action"), str):
+    ea = dr["execution_action"]
+elif isinstance(d.get("execution_action"), str):
+    ea = d["execution_action"]
+closed = {"CONTINUE", "CONTINUE_WITH_MONITORING", "REQUEST_APPROVAL", "STOP"}
+if ea is not None and ea != "":
+    if ea not in closed:
+        print("UNKNOWN")
+        raise SystemExit(0)
+    if ea in ("CONTINUE", "CONTINUE_WITH_MONITORING"):
+        print("ALLOW")
+    elif ea == "STOP":
+        print("BLOCK")
+    else:
+        print("REQUIRE_APPROVAL")
+    raise SystemExit(0)
+# (c) parsed but no execution_action AND no decision \u2014 do NOT default ALLOW
+od = d.get("omega_decision") or d.get("decision")
+if od is None or od == "":
+    print("INDETERMINATE")
+    raise SystemExit(0)
+print(od)
+' 2>/dev/null)
+  # (d) empty DECISION (python missing / crash with empty stdout) \u2192 fail closed
+  if [ -z "$DECISION" ]; then
+    DECISION="INDETERMINATE"
+  fi
+  OMEGA=$(echo "$RESULT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('omega_api',0))" 2>/dev/null)
+  BREAKING=$(echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(len(d.get('breaking_changes',[])))" 2>/dev/null)
+
+  if [ "$DECISION" = "INDETERMINATE" ]; then
+    echo "CodeRifts could not obtain a decision (indeterminate response); push blocked \u2014 set CODERIFTS_SKIP=1 to override intentionally" >&2
+    exit 1
+  fi
+
+  if [ "$DECISION" = "UNKNOWN" ]; then
+    echo ""
+    echo "========================================"
+    echo "  CodeRifts: PUSH BLOCKED"
+    echo "========================================"
+    echo "  Reason: unrecognised execution_action is not permission"
+    echo "  Fail-closed (unknown present action)."
+    echo "========================================"
+    echo ""
+    echo "Set CODERIFTS_SKIP=1 to override intentionally (or git push --no-verify)."
+    exit 1
+  fi
+
+  if [ "$DECISION" = "BLOCK" ]; then
+    echo ""
+    echo "========================================"
+    echo "  CodeRifts: PUSH BLOCKED"
+    echo "========================================"
+    echo "  Risk score:       $OMEGA/100"
+    echo "  Breaking changes: $BREAKING"
+    echo "  Decision:         BLOCK"
+    echo "========================================"
+    echo ""
+    echo "Fix breaking changes, set CODERIFTS_SKIP=1 to override intentionally, or use --no-verify."
+    exit 1
+  fi
+
+  if [ "$DECISION" = "REQUIRE_APPROVAL" ] || [ "$DECISION" = "WARN" ]; then
+    echo "CodeRifts: WARNING \u2014 $DECISION \u2014 Risk: $OMEGA/100, Breaking: $BREAKING"
+  fi
+done
+
+exit 0
+`;
+    function findGitDir(startDir) {
+      let dir = startDir || process.cwd();
+      while (dir !== path.dirname(dir)) {
+        const gitDir = path.join(dir, ".git");
+        if (fs.existsSync(gitDir) && fs.statSync(gitDir).isDirectory()) {
+          return gitDir;
+        }
+        dir = path.dirname(dir);
+      }
+      return null;
+    }
+    function getHookPath(gitDir) {
+      return path.join(gitDir, "hooks", "pre-push");
+    }
+    function isCodeRiftsHook(hookPath) {
+      if (!fs.existsSync(hookPath)) return false;
+      const content = fs.readFileSync(hookPath, "utf-8");
+      return content.includes(HOOK_MARKER);
+    }
+    var CLAUDE_MATCHER = "Write|Edit|MultiEdit";
+    var CLAUDE_HOOK_BIN = "coderifts claude-hook";
+    function claudeSettingsPath({ global: isGlobal, cwd } = {}) {
+      if (isGlobal) return path.join(os.homedir(), ".claude", "settings.json");
+      return path.join(cwd || process.cwd(), ".claude", "settings.json");
+    }
+    function claudeHookCommand(logPath) {
+      if (!logPath) return CLAUDE_HOOK_BIN;
+      const abs = path.resolve(String(logPath));
+      return `CODERIFTS_GUARD_EVENT_LOG=${abs} CODERIFTS_SESSION_ID=coderifts-claude-hook ${CLAUDE_HOOK_BIN}`;
+    }
+    function isOurPreToolUseEntry(entry, command) {
+      if (!entry || typeof entry !== "object") return false;
+      if (entry.matcher !== CLAUDE_MATCHER) return false;
+      const hooks = Array.isArray(entry.hooks) ? entry.hooks : [];
+      return hooks.some((h) => h && h.type === "command" && String(h.command || "") === command);
+    }
+    function installClaudeHook(opts = {}) {
+      const cwd = opts.cwd || process.cwd();
+      const home = opts.homeDir || os.homedir();
+      const dest = opts.global ? path.join(home, ".claude", "settings.json") : path.join(cwd, ".claude", "settings.json");
+      const command = claudeHookCommand(opts.logPath);
+      const say = (...a) => {
+        if (!opts.silent) console.log(...a);
+      };
+      const block = {
+        matcher: CLAUDE_MATCHER,
+        hooks: [{ type: "command", command, timeout: 60 }]
+      };
+      let existing = {};
+      let hadFile = false;
+      if (fs.existsSync(dest)) {
+        hadFile = true;
+        let raw;
+        try {
+          raw = fs.readFileSync(dest, "utf8");
+        } catch (err) {
+          const message = `Error: cannot read ${dest} (${err && err.message}) \u2014 refusing to write.`;
+          console.error(message);
+          process.exitCode = 1;
+          return { exitCode: 1, code: "READ_FAILED", path: dest, message };
+        }
+        if (String(raw).trim() !== "") {
+          try {
+            existing = JSON.parse(raw);
+          } catch (err) {
+            const message = `Error: ${dest} is not valid JSON \u2014 refusing (no write). Fix or remove the file, then re-run.`;
+            console.error(message);
+            process.exitCode = 1;
+            return { exitCode: 1, code: "PARSE_FAILED", path: dest, message };
+          }
+          if (!existing || typeof existing !== "object" || Array.isArray(existing)) {
+            const message = `Error: ${dest} JSON root is not an object \u2014 refusing (no write).`;
+            console.error(message);
+            process.exitCode = 1;
+            return { exitCode: 1, code: "PARSE_FAILED", path: dest, message };
+          }
+        }
+      }
+      const hooksRoot = existing.hooks && typeof existing.hooks === "object" && !Array.isArray(existing.hooks) ? { ...existing.hooks } : {};
+      const pre = Array.isArray(hooksRoot.PreToolUse) ? hooksRoot.PreToolUse.slice() : [];
+      if (pre.some((e) => isOurPreToolUseEntry(e, command))) {
+        say(`Claude Code hook already installed at ${dest} (no-op).`);
+        return { exitCode: 0, code: "NOOP", path: dest, wrote: false };
+      }
+      if (opts.dryRun) {
+        return { exitCode: 0, code: "WOULD_WRITE", path: dest, wrote: false, wouldWrite: true, hadFile };
+      }
+      const nextPre = pre.concat([block]);
+      const next = {
+        ...existing,
+        hooks: { ...hooksRoot, PreToolUse: nextPre }
+      };
+      const serialized = `${JSON.stringify(next, null, 2)}
+`;
+      let backedUp;
+      if (hadFile) {
+        backedUp = `${dest}.bak`;
+        fs.copyFileSync(dest, backedUp);
+      }
+      fs.mkdirSync(path.dirname(dest), { recursive: true });
+      fs.writeFileSync(dest, serialized, "utf8");
+      say(`Claude Code PreToolUse hook written to ${dest}`);
+      if (backedUp) say(`Backup: ${backedUp}`);
+      say("matcher Write|Edit|MultiEdit \u2192 coderifts claude-hook (exit 2 = BLOCK).");
+      return { exitCode: 0, code: "OK", path: dest, backedUp, wrote: true };
+    }
+    var CURSOR_HOOK_BIN = "coderifts cursor-hook";
+    var CURSOR_MATCHER = "Write|Delete";
+    function cursorHooksPath({ global: isGlobal, cwd } = {}) {
+      if (isGlobal) return path.join(os.homedir(), ".cursor", "hooks.json");
+      return path.join(cwd || process.cwd(), ".cursor", "hooks.json");
+    }
+    function cursorHookCommand(logPath) {
+      if (!logPath) return CURSOR_HOOK_BIN;
+      const abs = path.resolve(String(logPath));
+      return `CODERIFTS_GUARD_EVENT_LOG=${abs} CODERIFTS_SESSION_ID=coderifts-cursor-hook ${CURSOR_HOOK_BIN}`;
+    }
+    function isOurCursorEntry(entry, command) {
+      if (!entry || typeof entry !== "object") return false;
+      return String(entry.command || "") === command;
+    }
+    function installCursorHook(opts = {}) {
+      const cwd = opts.cwd || process.cwd();
+      const home = opts.homeDir || os.homedir();
+      const dest = opts.global ? path.join(home, ".cursor", "hooks.json") : path.join(cwd, ".cursor", "hooks.json");
+      const command = cursorHookCommand(opts.logPath);
+      const say = (...a) => {
+        if (!opts.silent) console.log(...a);
+      };
+      const block = {
+        command,
+        matcher: CURSOR_MATCHER,
+        timeout: 60,
+        failClosed: true
+      };
+      let existing = {};
+      let hadFile = false;
+      if (fs.existsSync(dest)) {
+        hadFile = true;
+        let raw;
+        try {
+          raw = fs.readFileSync(dest, "utf8");
+        } catch (err) {
+          const message = `Error: cannot read ${dest} (${err && err.message}) \u2014 refusing to write.`;
+          console.error(message);
+          process.exitCode = 1;
+          return { exitCode: 1, code: "READ_FAILED", path: dest, message };
+        }
+        if (String(raw).trim() !== "") {
+          try {
+            existing = JSON.parse(raw);
+          } catch (_) {
+            const message = `Error: ${dest} is not valid JSON \u2014 refusing (no write). Fix or remove the file, then re-run.`;
+            console.error(message);
+            process.exitCode = 1;
+            return { exitCode: 1, code: "PARSE_FAILED", path: dest, message };
+          }
+          if (!existing || typeof existing !== "object" || Array.isArray(existing)) {
+            const message = `Error: ${dest} JSON root is not an object \u2014 refusing (no write).`;
+            console.error(message);
+            process.exitCode = 1;
+            return { exitCode: 1, code: "PARSE_FAILED", path: dest, message };
+          }
+        }
+      }
+      const hooksRoot = existing.hooks && typeof existing.hooks === "object" && !Array.isArray(existing.hooks) ? { ...existing.hooks } : {};
+      const pre = Array.isArray(hooksRoot.preToolUse) ? hooksRoot.preToolUse.slice() : [];
+      if (pre.some((e) => isOurCursorEntry(e, command))) {
+        say(`Cursor hook already installed at ${dest} (no-op).`);
+        return { exitCode: 0, code: "NOOP", path: dest, wrote: false };
+      }
+      if (opts.dryRun) {
+        return { exitCode: 0, code: "WOULD_WRITE", path: dest, wrote: false, wouldWrite: true, hadFile };
+      }
+      const next = {
+        ...existing,
+        version: Number.isFinite(existing.version) ? existing.version : 1,
+        hooks: { ...hooksRoot, preToolUse: pre.concat([block]) }
+      };
+      const serialized = `${JSON.stringify(next, null, 2)}
+`;
+      let backedUp;
+      if (hadFile) {
+        backedUp = `${dest}.bak`;
+        fs.copyFileSync(dest, backedUp);
+      }
+      fs.mkdirSync(path.dirname(dest), { recursive: true });
+      fs.writeFileSync(dest, serialized, "utf8");
+      say(`Cursor preToolUse hook written to ${dest}`);
+      if (backedUp) say(`Backup: ${backedUp}`);
+      say(`matcher ${CURSOR_MATCHER} \u2192 ${CURSOR_HOOK_BIN} (deny = {"permission":"deny"} + exit 2; failClosed:true).`);
+      return { exitCode: 0, code: "OK", path: dest, backedUp, wrote: true };
+    }
+    function install(options = {}) {
+      if (options.global && !options.claude && !options.cursor) {
+        console.error("Error: --global requires --claude or --cursor (writes ~/.claude/settings.json or ~/.cursor/hooks.json).");
+        process.exitCode = 1;
+        return { exitCode: 1, code: "USAGE" };
+      }
+      if (options.cursor) {
+        const r = installCursorHook({
+          global: !!options.global,
+          logPath: options.log,
+          cwd: options.cwd,
+          homeDir: options.homeDir
+        });
+        if (r.exitCode !== 0) return r;
+      }
+      if (options.claude) {
+        const r = installClaudeHook({
+          global: !!options.global,
+          logPath: options.log,
+          cwd: options.cwd,
+          homeDir: options.homeDir
+        });
+        if (r.exitCode !== 0) return r;
+      }
+      const gitDir = findGitDir(options.cwd);
+      if (!gitDir) {
+        if (options.claude || options.cursor) {
+          console.log("Not inside a Git repository \u2014 skipped pre-push hook.");
+          return { exitCode: 0, code: "OK" };
+        }
+        console.error("Error: Not inside a Git repository.");
+        process.exitCode = 1;
+        return { exitCode: 1, code: "NO_GIT" };
+      }
+      const hooksDir = path.join(gitDir, "hooks");
+      if (!fs.existsSync(hooksDir)) {
+        fs.mkdirSync(hooksDir, { recursive: true });
+      }
+      const hookPath = getHookPath(gitDir);
+      if (fs.existsSync(hookPath) && !isCodeRiftsHook(hookPath)) {
+        console.error("Error: A pre-push hook already exists and was not created by CodeRifts.");
+        console.error("Remove it manually or back it up before installing.");
+        process.exitCode = 1;
+        return;
+      }
+      fs.writeFileSync(hookPath, PRE_PUSH_SCRIPT, { mode: 493 });
+      console.log("CodeRifts pre-push hook installed.");
+      console.log("");
+      console.log("Configure your API key:");
+      console.log("  git config coderifts.apiKey <your-key>");
+      console.log("");
+      console.log("Optionally set spec path (default: api/openapi.yaml):");
+      console.log("  git config coderifts.specPath path/to/openapi.yaml");
+      console.log("");
+      console.log("After upgrading the coderifts CLI, re-run this command so the installed");
+      console.log("hook matches the package (already-installed hooks are not auto-updated):");
+      console.log("  coderifts hook install");
+      console.log("");
+      console.log("Agent-using repo? Run: coderifts agent-setup");
+    }
+    function uninstall() {
+      const gitDir = findGitDir();
+      if (!gitDir) {
+        console.error("Error: Not inside a Git repository.");
+        process.exitCode = 1;
+        return;
+      }
+      const hookPath = getHookPath(gitDir);
+      if (!fs.existsSync(hookPath)) {
+        console.log("No pre-push hook found. Nothing to uninstall.");
+        return;
+      }
+      if (!isCodeRiftsHook(hookPath)) {
+        console.error("Error: The existing pre-push hook was not created by CodeRifts. Skipping.");
+        process.exitCode = 1;
+        return;
+      }
+      fs.unlinkSync(hookPath);
+      console.log("CodeRifts pre-push hook removed.");
+    }
+    function status() {
+      const gitDir = findGitDir();
+      if (!gitDir) {
+        console.error("Error: Not inside a Git repository.");
+        process.exitCode = 1;
+        return;
+      }
+      const hookPath = getHookPath(gitDir);
+      const installed = isCodeRiftsHook(hookPath);
+      console.log(`Hook: ${installed ? "installed" : "not installed"}`);
+      if (installed) {
+        try {
+          const apiKey = execSync("git config coderifts.apiKey", { encoding: "utf-8", cwd: path.dirname(gitDir) }).trim();
+          console.log(`API key: ${apiKey ? "configured" : "not configured"}`);
+        } catch {
+          console.log("API key: not configured");
+        }
+        try {
+          const specPath = execSync("git config coderifts.specPath", { encoding: "utf-8", cwd: path.dirname(gitDir) }).trim();
+          console.log(`Spec path: ${specPath || "api/openapi.yaml (default)"}`);
+        } catch {
+          console.log("Spec path: api/openapi.yaml (default)");
+        }
+        try {
+          fs.accessSync(hookPath, fs.constants.X_OK);
+          console.log("Executable: yes");
+        } catch {
+          console.log("Executable: no (run: chmod +x " + hookPath + ")");
+        }
+      }
+    }
+    module2.exports = {
+      install,
+      uninstall,
+      status,
+      PRE_PUSH_SCRIPT,
+      HOOK_MARKER,
+      findGitDir,
+      isCodeRiftsHook,
+      installClaudeHook,
+      claudeSettingsPath,
+      claudeHookCommand,
+      CLAUDE_MATCHER,
+      installCursorHook,
+      cursorHooksPath,
+      cursorHookCommand,
+      CURSOR_MATCHER
+    };
+  }
+});
+
+// src/mcp-repo-config.js
+var require_mcp_repo_config = __commonJS({
+  "src/mcp-repo-config.js"(exports2, module2) {
+    "use strict";
+    var fs = require("fs");
+    var path = require("path");
+    var MCP_URL = "https://app.coderifts.com/mcp";
+    var SERVER_NAME = "coderifts";
+    var MCP_HOSTS = Object.freeze({
+      claude: Object.freeze({
+        id: "claude",
+        relPath: ".mcp.json",
+        label: "Claude Code",
+        // Measured: type+url required. url-without-type is a config error.
+        entry: Object.freeze({
+          type: "http",
+          url: MCP_URL,
+          headers: Object.freeze({
+            Authorization: "Bearer ${CODERIFTS_API_KEY}"
+          })
+        }),
+        shapeNote: "mcpServers.coderifts type=http url (not httpUrl; type is required)"
+      }),
+      cursor: Object.freeze({
+        id: "cursor",
+        relPath: ".cursor/mcp.json",
+        label: "Cursor",
+        // Measured: url only — Cursor docs do not use type for remote HTTP.
+        entry: Object.freeze({
+          url: MCP_URL,
+          headers: Object.freeze({
+            Authorization: "Bearer ${env:CODERIFTS_API_KEY}"
+          })
+        }),
+        shapeNote: "mcpServers.coderifts url (no type \u2014 Cursor remote form)"
+      })
+    });
+    function deepEqual(a, b) {
+      if (a === b) return true;
+      try {
+        return JSON.stringify(a) === JSON.stringify(b);
+      } catch {
+        return false;
+      }
+    }
+    function planMcpMerge(existing, entry) {
+      const hadFile = existing != null;
+      const base = existing && typeof existing === "object" && !Array.isArray(existing) ? existing : {};
+      const servers = base.mcpServers && typeof base.mcpServers === "object" && !Array.isArray(base.mcpServers) ? base.mcpServers : {};
+      const current = Object.prototype.hasOwnProperty.call(servers, SERVER_NAME) ? servers[SERVER_NAME] : void 0;
+      if (deepEqual(current, entry)) {
+        return { action: "skip", next: null, reason: "already present, identical" };
+      }
+      const next = {
+        ...base,
+        mcpServers: {
+          ...servers,
+          [SERVER_NAME]: entry
+        }
+      };
+      if (!hadFile) {
+        return { action: "create", next, reason: "created" };
+      }
+      const reason = current === void 0 ? "added mcpServers.coderifts; preserved other servers" : "updated mcpServers.coderifts; preserved other servers";
+      return { action: "merge", next, reason };
+    }
+    function serializeMcp(doc) {
+      return `${JSON.stringify(doc, null, 2)}
+`;
+    }
+    function writeHostMcpConfig(opts) {
+      const host = MCP_HOSTS[opts.host];
+      if (!host) {
+        return { action: "error", relPath: "", reason: `unknown host ${opts.host}`, exitCode: 1 };
+      }
+      const outDir = opts.outDir;
+      const dest = path.join(outDir, host.relPath);
+      const exists = opts.exists || fs.existsSync.bind(fs);
+      const readFile = opts.readFile || ((p) => fs.readFileSync(p, "utf8"));
+      const writeFile = opts.writeFile || ((p, c) => {
+        fs.mkdirSync(path.dirname(p), { recursive: true });
+        fs.writeFileSync(p, c, "utf8");
+      });
+      const copyFile = opts.copyFile || ((a, b) => fs.copyFileSync(a, b));
+      const dryRun = !!opts.dryRun;
+      let existing = null;
+      if (exists(dest)) {
+        let raw;
+        try {
+          raw = readFile(dest);
+        } catch (err) {
+          const message = `Error: cannot read ${host.relPath} (${err && err.message}) \u2014 refusing to write.`;
+          return {
+            action: "error",
+            relPath: host.relPath,
+            reason: "read failed",
+            exitCode: 1,
+            message,
+            code: "READ_FAILED"
+          };
+        }
+        if (String(raw).trim() !== "") {
+          let parsed;
+          try {
+            parsed = JSON.parse(raw);
+          } catch {
+            const message = `Error: ${host.relPath} is not valid JSON \u2014 refusing (no write). Fix or remove the file, then re-run.`;
+            return {
+              action: "error",
+              relPath: host.relPath,
+              reason: "not valid JSON",
+              exitCode: 1,
+              message,
+              code: "PARSE_FAILED"
+            };
+          }
+          if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            const message = `Error: ${host.relPath} JSON root is not an object \u2014 refusing (no write).`;
+            return {
+              action: "error",
+              relPath: host.relPath,
+              reason: "JSON root is not an object",
+              exitCode: 1,
+              message,
+              code: "PARSE_FAILED"
+            };
+          }
+          existing = parsed;
+        } else {
+          existing = {};
+        }
+      }
+      const plan = planMcpMerge(existing, host.entry);
+      if (plan.action === "skip") {
+        return { action: "skip", relPath: host.relPath, reason: plan.reason, exitCode: 0 };
+      }
+      if (dryRun) {
+        return {
+          action: plan.action,
+          relPath: host.relPath,
+          reason: plan.reason,
+          backedUp: plan.action === "merge" ? `${host.relPath}.bak` : void 0,
+          exitCode: 0,
+          dryRun: true
+        };
+      }
+      let backedUp;
+      if (plan.action === "merge" && exists(dest)) {
+        backedUp = `${dest}.bak`;
+        copyFile(dest, backedUp);
+      }
+      writeFile(dest, serializeMcp(plan.next));
+      return {
+        action: plan.action,
+        relPath: host.relPath,
+        reason: plan.reason,
+        backedUp: backedUp ? `${host.relPath}.bak` : void 0,
+        exitCode: 0
+      };
+    }
+    function mcpConfigPresent(outDir, hostId, deps = {}) {
+      const host = MCP_HOSTS[hostId];
+      if (!host) return false;
+      const exists = deps.exists || fs.existsSync.bind(fs);
+      const readFile = deps.readFile || ((p) => fs.readFileSync(p, "utf8"));
+      const fp = path.join(outDir, host.relPath);
+      if (!exists(fp)) return false;
+      try {
+        const doc = JSON.parse(readFile(fp));
+        return planMcpMerge(doc, host.entry).action === "skip";
+      } catch {
+        return false;
+      }
+    }
+    module2.exports = {
+      MCP_URL,
+      SERVER_NAME,
+      MCP_HOSTS,
+      planMcpMerge,
+      serializeMcp,
+      writeHostMcpConfig,
+      mcpConfigPresent
+    };
+  }
+});
+
+// src/contract-gate-workflow.js
+var require_contract_gate_workflow = __commonJS({
+  "src/contract-gate-workflow.js"(exports2, module2) {
+    "use strict";
+    var fs = require("fs");
+    var path = require("path");
+    var WORKFLOW_REL = ".github/workflows/coderifts.yml";
+    var GATE_ACTION = "coderifts/contract-gate@v0";
+    var ENFORCEMENT_DOC = "https://github.com/coderifts/contract-gate/blob/main/ENFORCEMENT.md";
+    var WORKFLOW_BODY = `# Written by \`coderifts init --agents\`. Re-run is a no-op when this file already exists.
+#
+# This workflow POSTS the Check Run named exactly:
+#   CodeRifts / contract-gate
+# It does NOT enable branch protection and it does NOT make that check required.
+# Turn the check on in repo settings to enforce (${ENFORCEMENT_DOC}).
+#
+# Copied from the gate repo example (examples/contract-gate.yml) \u2014 action at @v0.
+name: CodeRifts Contract Gate
+
+# Run on EVERY pull request. Do NOT add paths: filters \u2014 a required check that
+# never runs leaves the PR mergeable (see ENFORCEMENT.md, "fail-closed on absence").
+on:
+  pull_request:
+
+permissions:
+  checks: write
+  contents: read
+
+jobs:
+  contract-gate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # REQUIRED: the gate derives the change set from git diff base...head.
+          fetch-depth: 0
+
+      - uses: ${GATE_ACTION}
+        with:
+          api-key: \${{ secrets.CODERIFTS_API_KEY }}
+          # api-url: https://app.coderifts.com   # override only for self-hosted
+          #
+          # Optional \u2014 require a signed CWM delivery attestation (guard \u22659.2.0).
+          # Honest default: false (commented). Uncomment the three lines to enforce.
+          # require-verified-monitoring: 'true'
+          # monitoring-attestation: \${{ vars.CODERIFTS_MONITORING_ATTESTATION }}
+          # monitoring-keyring: \${{ github.workspace }}/.coderifts/monitoring-keys.json
+`;
+    function writeContractGateWorkflow(opts = {}) {
+      const outDir = opts.outDir;
+      const dest = path.join(outDir, WORKFLOW_REL);
+      const exists = opts.exists || fs.existsSync.bind(fs);
+      const readFile = opts.readFile || ((p) => fs.readFileSync(p, "utf8"));
+      const writeFile = opts.writeFile || ((p, c) => {
+        fs.mkdirSync(path.dirname(p), { recursive: true });
+        fs.writeFileSync(p, c, "utf8");
+      });
+      const dryRun = !!opts.dryRun;
+      if (exists(dest)) {
+        let onDisk = "";
+        try {
+          onDisk = readFile(dest);
+        } catch {
+          onDisk = "";
+        }
+        const reason = onDisk === WORKFLOW_BODY ? "already present, identical" : "exists; installer does not clobber workflows";
+        return { action: "skip", relPath: WORKFLOW_REL, reason, exitCode: 0 };
+      }
+      if (dryRun) {
+        return { action: "create", relPath: WORKFLOW_REL, reason: "created", exitCode: 0, dryRun: true };
+      }
+      writeFile(dest, WORKFLOW_BODY);
+      return { action: "create", relPath: WORKFLOW_REL, reason: "created", exitCode: 0 };
+    }
+    function workflowPresent(outDir, deps = {}) {
+      const exists = deps.exists || fs.existsSync.bind(fs);
+      const readFile = deps.readFile || ((p) => fs.readFileSync(p, "utf8"));
+      const fp = path.join(outDir, WORKFLOW_REL);
+      if (!exists(fp)) return false;
+      try {
+        return readFile(fp).includes(GATE_ACTION);
+      } catch {
+        return false;
+      }
+    }
+    module2.exports = {
+      WORKFLOW_REL,
+      WORKFLOW_BODY,
+      GATE_ACTION,
+      ENFORCEMENT_DOC,
+      writeContractGateWorkflow,
+      workflowPresent
+    };
+  }
+});
+
+// src/commands/init-agents.js
+var require_init_agents = __commonJS({
+  "src/commands/init-agents.js"(exports2, module2) {
+    "use strict";
+    var fs = require("fs");
+    var path = require("path");
+    var chalk = require_source();
+    var { writeAgentHostFiles, AGENT_HOST_FILES } = require_agent_setup();
+    var { installClaudeHook, installCursorHook } = require_hook();
+    var {
+      MCP_HOSTS,
+      writeHostMcpConfig,
+      mcpConfigPresent
+    } = require_mcp_repo_config();
+    var {
+      WORKFLOW_REL,
+      GATE_ACTION,
+      ENFORCEMENT_DOC,
+      writeContractGateWorkflow,
+      workflowPresent
+    } = require_contract_gate_workflow();
+    if (process.env.NO_COLOR) chalk.level = 0;
+    var USAGE = `Usage: coderifts init --agents [--hosts=claude,cursor,all] [--no-hook] [--no-workflow] [--dry-run] [--check] [--out <dir>]
+
+  Wire this repository for governed agent work in ONE command:
+    1. repo-level MCP config (per host: .mcp.json / .cursor/mcp.json)
+    2. generated agent rule files (reuses agent-setup)
+    3. host hook (Claude Code today; Cursor when hook install --cursor is present)
+    4. .github/workflows/coderifts.yml (coderifts/contract-gate@v0)
+
+  --hosts <list>   claude, cursor, or all (default: all)
+  --no-hook        Skip host hook install
+  --no-workflow    Skip writing the CI workflow
+  --dry-run        Print the plan without writing
+  --check          Report which of the four pieces are present (no write)
+  --out <dir>      Target directory (default: cwd)
+  Unknown flags exit 1 (never silently ignored).
+`;
+    var SHARED_RULE = "AGENTS.md";
+    var HOST_RULES = Object.freeze({
+      claude: Object.freeze(["CLAUDE.md"]),
+      cursor: Object.freeze([".cursor/rules/coderifts.mdc"])
+    });
+    var EXTRA_RULES_ON_ALL = Object.freeze([
+      ".github/copilot-instructions.md",
+      "coderifts-langgraph-policy.js",
+      "openai-agent-instructions.md"
+    ]);
+    var NEXT_MANUAL_STEP_LINES = Object.freeze([
+      "  Next manual step",
+      "    Add CODERIFTS_API_KEY to the repository secrets (Settings \u2192 Secrets and variables \u2192 Actions).",
+      "    The CLI never writes a key anywhere."
+    ]);
+    var HONESTY_LINES = Object.freeze([
+      "  This command does NOT",
+      `    \xB7 enable branch protection \u2014 ${ENFORCEMENT_DOC}`,
+      "    \xB7 make raw host tools inescapable (host convention, not a package guarantee)",
+      '    \xB7 enforce the workflow until "CodeRifts / contract-gate" is a required check in repo settings',
+      "    \xB7 write Gemini MCP config (Gemini uses httpUrl at extension level, not a repo file)"
+    ]);
+    function parseHosts(raw) {
+      if (raw == null || raw === true || String(raw).trim() === "") {
+        return { hosts: ["claude", "cursor"], allRules: true };
+      }
+      const parts = String(raw).split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
+      if (parts.length === 0) {
+        return { hosts: ["claude", "cursor"], allRules: true, error: `init --agents: --hosts requires a value
+${USAGE}` };
+      }
+      const allowed = /* @__PURE__ */ new Set(["claude", "cursor", "all"]);
+      for (const p of parts) {
+        if (!allowed.has(p)) {
+          return {
+            hosts: [],
+            allRules: false,
+            error: `init --agents: unknown host "${p}" (use claude, cursor, all)
+${USAGE}`
+          };
+        }
+      }
+      if (parts.includes("all")) {
+        return { hosts: ["claude", "cursor"], allRules: true };
+      }
+      const hosts = [];
+      for (const p of parts) {
+        if (!hosts.includes(p)) hosts.push(p);
+      }
+      return { hosts, allRules: false };
+    }
+    function agentFlagsRequireAgents(options = {}) {
+      return !!(options.check || options.dryRun || options.out || options.hosts != null && String(options.hosts) !== "all" || options.hook === false || options.workflow === false || options.noHook === true || options.noWorkflow === true);
+    }
+    var AGENT_FLAGS_REQUIRE_AGENTS = "Error: --check/--dry-run/--out/--hosts/--no-hook/--no-workflow require --agents";
+    var AGENTS_NO_TEMPLATE = "Error: init --agents does not take a template. Did you mean `coderifts init --agents` (not `coderifts init agent`)?";
+    function rulePathsForHosts(hosts, allRules) {
+      const out = [SHARED_RULE];
+      for (const h of hosts) {
+        const extra = HOST_RULES[h] || [];
+        for (const rel of extra) {
+          if (!out.includes(rel)) out.push(rel);
+        }
+      }
+      if (allRules) {
+        for (const rel of EXTRA_RULES_ON_ALL) {
+          if (!out.includes(rel)) out.push(rel);
+        }
+      }
+      return out;
+    }
+    function hookRelForHost(hostId) {
+      return hostId === "cursor" ? ".cursor/hooks.json" : ".claude/settings.json";
+    }
+    function hookNoteForHost(hostId) {
+      return hostId === "cursor" ? "preToolUse \u2192 coderifts cursor-hook" : "PreToolUse \u2192 coderifts claude-hook";
+    }
+    function wantHook(options) {
+      if (options.noHook === true) return false;
+      if (options.hook === false) return false;
+      return true;
+    }
+    function wantWorkflow(options) {
+      if (options.noWorkflow === true) return false;
+      if (options.workflow === false) return false;
+      return true;
+    }
+    function padVerb(verb) {
+      return String(verb).padEnd(7, " ");
+    }
+    function formatActionLine(action, relPath, note) {
+      const verb = padVerb(action);
+      const extra = note ? `  (${note})` : "";
+      return `    ${verb}  ${relPath}${extra}`;
+    }
+    function checkInitAgents(options = {}, deps = {}) {
+      const outDir = options.out ? path.resolve(String(options.out)) : deps.cwd || process.cwd();
+      const parsed = parseHosts(options.hosts);
+      const hosts = parsed.hosts;
+      const allRules = parsed.allRules;
+      const fsDeps = {
+        exists: deps.exists || fs.existsSync.bind(fs),
+        readFile: deps.readFile || ((p) => fs.readFileSync(p, "utf8"))
+      };
+      const mcpPresent = [];
+      const mcpMissing = [];
+      for (const h of hosts) {
+        const rel = MCP_HOSTS[h].relPath;
+        if (mcpConfigPresent(outDir, h, fsDeps)) mcpPresent.push(rel);
+        else mcpMissing.push(rel);
+      }
+      const rulePaths = rulePathsForHosts(hosts, allRules);
+      const rulesPresent = [];
+      const rulesMissing = [];
+      for (const rel of rulePaths) {
+        if (fsDeps.exists(path.join(outDir, rel))) rulesPresent.push(rel);
+        else rulesMissing.push(rel);
+      }
+      const hooksPresent = [];
+      const hooksMissing = [];
+      const hooksWanted = wantHook(options);
+      if (hooksWanted) {
+        for (const h of hosts) {
+          const rel = hookRelForHost(h);
+          const installer = h === "cursor" ? installCursorHook : installClaudeHook;
+          const r = installer({ cwd: outDir, silent: true, dryRun: true });
+          if (r && r.code === "NOOP") hooksPresent.push(rel);
+          else hooksMissing.push(rel);
+        }
+      }
+      const workflowWanted = wantWorkflow(options);
+      const wfPresent = workflowWanted && workflowPresent(outDir, fsDeps);
+      const pieces = {
+        mcp: { present: mcpPresent, missing: mcpMissing },
+        rules: { present: rulesPresent, missing: rulesMissing },
+        hooks: {
+          wanted: hooksWanted,
+          present: hooksPresent,
+          missing: hooksMissing
+        },
+        workflow: {
+          wanted: workflowWanted,
+          present: wfPresent,
+          missing: workflowWanted && !wfPresent ? [WORKFLOW_REL] : []
+        }
+      };
+      const missingCount = mcpMissing.length + rulesMissing.length + hooksMissing.length + (workflowWanted && !wfPresent ? 1 : 0);
+      return {
+        exitCode: missingCount === 0 ? 0 : 1,
+        pieces,
+        allPresent: missingCount === 0,
+        outDir,
+        hosts
+      };
+    }
+    function printCheck(result, log) {
+      const { pieces, outDir, hosts, allPresent } = result;
+      log(chalk.bold("CodeRifts init --agents --check"));
+      log(`  target: ${outDir}`);
+      log(`  hosts:  ${hosts.join(", ")}`);
+      log("");
+      const mcpStatus = pieces.mcp.missing.length === 0 ? "present" : "missing";
+      const mcpDetail = pieces.mcp.missing.length === 0 ? pieces.mcp.present.join(", ") : pieces.mcp.missing.join(", ");
+      log(`  MCP config:    ${mcpStatus}  (${mcpDetail})`);
+      const rulesStatus = pieces.rules.missing.length === 0 ? "present" : "missing";
+      const rulesDetail = pieces.rules.missing.length === 0 ? `${pieces.rules.present.length} files` : pieces.rules.missing.join(", ");
+      log(`  Agent rules:   ${rulesStatus}  (${rulesDetail})`);
+      if (!pieces.hooks.wanted) {
+        log("  Host hooks:    skipped  (--no-hook)");
+      } else {
+        const hookStatus = pieces.hooks.missing.length === 0 ? "present" : "missing";
+        const hookDetail = pieces.hooks.missing.length === 0 ? pieces.hooks.present.join(", ") : pieces.hooks.missing.join(", ");
+        log(`  Host hooks:    ${hookStatus}  (${hookDetail})`);
+      }
+      if (!pieces.workflow.wanted) {
+        log("  CI workflow:   skipped  (--no-workflow)");
+      } else {
+        log(pieces.workflow.present ? `  CI workflow:   present  (${WORKFLOW_REL})` : `  CI workflow:   missing  (${WORKFLOW_REL})`);
+      }
+      log("");
+      if (allPresent) log(chalk.green("  All four pieces present."));
+      else log(chalk.yellow("  Incomplete \u2014 run: coderifts init --agents"));
+    }
+    function runInitAgents(options = {}, deps = {}) {
+      const log = deps.log || console.log.bind(console);
+      const logErr = deps.logErr || console.error.bind(console);
+      const doExit = deps.exit !== false;
+      const outDir = options.out ? path.resolve(String(options.out)) : deps.cwd || process.cwd();
+      const dryRun = !!options.dryRun;
+      const fsDeps = {
+        exists: deps.exists || fs.existsSync.bind(fs),
+        readFile: deps.readFile || ((p) => fs.readFileSync(p, "utf8")),
+        writeFile: deps.writeFile || ((p, c) => {
+          fs.mkdirSync(path.dirname(p), { recursive: true });
+          fs.writeFileSync(p, c, "utf8");
+        }),
+        copyFile: deps.copyFile || ((a, b) => fs.copyFileSync(a, b))
+      };
+      const parsed = parseHosts(options.hosts);
+      if (parsed.error) {
+        logErr(parsed.error.trimEnd());
+        if (doExit) process.exit(1);
+        return { exitCode: 1, code: "USAGE", message: parsed.error };
+      }
+      const hosts = parsed.hosts;
+      const allRules = parsed.allRules;
+      if (options.check) {
+        const result2 = checkInitAgents({ ...options, out: outDir, hosts: options.hosts }, { ...deps, cwd: outDir });
+        printCheck(result2, log);
+        if (doExit) process.exit(result2.exitCode);
+        return { ...result2, code: result2.allPresent ? "UP_TO_DATE" : "INCOMPLETE" };
+      }
+      const items = [];
+      let fatal;
+      for (const h of hosts) {
+        const r = writeHostMcpConfig({
+          host: h,
+          outDir,
+          dryRun,
+          ...fsDeps
+        });
+        if (r.exitCode !== 0) {
+          fatal = r;
+          break;
+        }
+        items.push({
+          section: "mcp",
+          action: r.action,
+          relPath: r.relPath,
+          note: r.action === "skip" ? r.reason : `${MCP_HOSTS[h].shapeNote}${r.action === "merge" ? "; other servers preserved" : ""}`,
+          backedUp: r.backedUp
+        });
+      }
+      if (fatal) {
+        printPartialAndError(items, fatal, { outDir, hosts, dryRun, log, logErr });
+        if (doExit) process.exit(1);
+        return { exitCode: 1, code: fatal.code || "ERROR", message: fatal.message, items };
+      }
+      const rulePaths = rulePathsForHosts(hosts, allRules);
+      const ruleSummary = writeAgentHostFiles({
+        outDir,
+        force: false,
+        files: AGENT_HOST_FILES,
+        paths: rulePaths,
+        exists: fsDeps.exists,
+        writeFile: fsDeps.writeFile,
+        dryRun
+      });
+      for (const rel of ruleSummary.written) {
+        items.push({ section: "rules", action: "create", relPath: rel, note: "generated agent-host rule" });
+      }
+      for (const rel of ruleSummary.skipped) {
+        items.push({ section: "rules", action: "skip", relPath: rel, note: "exists; installer does not overwrite" });
+      }
+      if (!wantHook(options)) {
+        for (const h of hosts) {
+          items.push({
+            section: "hooks",
+            action: "skip",
+            relPath: hookRelForHost(h),
+            note: "--no-hook"
+          });
+        }
+      } else {
+        for (const h of hosts) {
+          const installer = h === "cursor" ? installCursorHook : installClaudeHook;
+          const r = installer({
+            cwd: outDir,
+            silent: true,
+            dryRun
+          });
+          if (r.exitCode !== 0) {
+            fatal = r;
+            break;
+          }
+          const rel = hookRelForHost(h);
+          if (r.code === "NOOP") {
+            items.push({ section: "hooks", action: "skip", relPath: rel, note: "already installed" });
+          } else if (r.backedUp || r.hadFile) {
+            items.push({
+              section: "hooks",
+              action: "merge",
+              relPath: rel,
+              note: hookNoteForHost(h),
+              backedUp: r.backedUp ? `${rel}.bak` : dryRun ? `${rel}.bak` : void 0
+            });
+          } else {
+            items.push({ section: "hooks", action: "create", relPath: rel, note: hookNoteForHost(h) });
+          }
+        }
+      }
+      if (fatal) {
+        printPartialAndError(items, fatal, { outDir, hosts, dryRun, log, logErr });
+        if (doExit) process.exit(1);
+        return { exitCode: 1, code: fatal.code || "ERROR", message: fatal.message, items };
+      }
+      if (!wantWorkflow(options)) {
+        items.push({ section: "workflow", action: "skip", relPath: WORKFLOW_REL, note: "--no-workflow" });
+      } else {
+        const r = writeContractGateWorkflow({ outDir, dryRun, ...fsDeps });
+        items.push({
+          section: "workflow",
+          action: r.action,
+          relPath: r.relPath,
+          note: r.action === "create" ? `${GATE_ACTION}` : r.reason
+        });
+      }
+      const created = items.filter((i) => i.action === "create").length;
+      const merged = items.filter((i) => i.action === "merge").length;
+      const skipped = items.filter((i) => i.action === "skip").length;
+      const unchanged = created === 0 && merged === 0;
+      const summaryLines = buildSummaryLines({
+        outDir,
+        hosts,
+        dryRun,
+        items,
+        created,
+        merged,
+        skipped,
+        unchanged
+      });
+      for (const line of summaryLines) log(line);
+      const result = {
+        exitCode: 0,
+        code: unchanged ? "NOOP" : "OK",
+        outDir,
+        hosts,
+        dryRun,
+        created,
+        merged,
+        skipped,
+        items,
+        summary: summaryLines.join("\n")
+      };
+      if (doExit) process.exit(0);
+      return result;
+    }
+    function buildSummaryLines({ outDir, hosts, dryRun, items, created, merged, skipped, unchanged }) {
+      const lines = [];
+      lines.push(chalk.bold("CodeRifts init --agents"));
+      lines.push(`  target: ${outDir}`);
+      lines.push(`  hosts:  ${hosts.join(", ")}`);
+      if (dryRun) {
+        lines.push("");
+        lines.push(chalk.yellow("  DRY-RUN \u2014 no files written"));
+      }
+      lines.push("");
+      const sections = [
+        ["mcp", "MCP config"],
+        ["rules", "Agent rules"],
+        ["hooks", "Host hooks"],
+        ["workflow", "CI workflow"]
+      ];
+      for (const [key, title] of sections) {
+        lines.push(`  ${title}`);
+        const group = items.filter((i) => i.section === key);
+        for (const it of group) {
+          const verb = it.action === "create" ? "created" : it.action === "merge" ? "merged" : "skipped";
+          const color = it.action === "skip" ? chalk.yellow : chalk.green;
+          lines.push(color(formatActionLine(verb, it.relPath, it.note)));
+          if (it.backedUp) {
+            lines.push(chalk.dim(formatActionLine("backup", it.backedUp, "")));
+          }
+        }
+      }
+      lines.push("");
+      lines.push(chalk.dim(`  ${created} created, ${merged} merged, ${skipped} skipped`));
+      if (unchanged && !dryRun) {
+        lines.push(chalk.dim("  Re-run changed nothing."));
+      }
+      if (items.some((i) => i.backedUp)) {
+        lines.push(chalk.dim("  Do not commit *.bak (may contain prior contents, including secrets)."));
+      }
+      lines.push("");
+      for (const line of NEXT_MANUAL_STEP_LINES) lines.push(chalk.dim(line));
+      lines.push("");
+      for (const line of HONESTY_LINES) {
+        lines.push(line === HONESTY_LINES[0] ? chalk.bold(line) : chalk.dim(line));
+      }
+      return lines;
+    }
+    function printPartialAndError(items, fatal, { outDir, hosts, dryRun, log, logErr }) {
+      if (items.length > 0) {
+        const created = items.filter((i) => i.action === "create").length;
+        const merged = items.filter((i) => i.action === "merge").length;
+        const skipped = items.filter((i) => i.action === "skip").length;
+        log(chalk.yellow("  Partial write (stopped on error) \u2014 already-written pieces:"));
+        for (const line of buildSummaryLines({
+          outDir,
+          hosts,
+          dryRun,
+          items,
+          created,
+          merged,
+          skipped,
+          unchanged: false
+        })) {
+          log(line);
+        }
+      }
+      logErr(fatal.message || fatal.reason || "init --agents failed");
+    }
+    module2.exports = {
+      runInitAgents,
+      parseHosts,
+      checkInitAgents,
+      rulePathsForHosts,
+      wantHook,
+      wantWorkflow,
+      agentFlagsRequireAgents,
+      AGENT_FLAGS_REQUIRE_AGENTS,
+      AGENTS_NO_TEMPLATE,
+      USAGE,
+      NEXT_MANUAL_STEP_LINES,
+      HONESTY_LINES,
+      HOST_RULES,
+      EXTRA_RULES_ON_ALL,
+      SHARED_RULE,
+      buildSummaryLines
+    };
+  }
+});
+
 // src/commands/init.js
 var require_init2 = __commonJS({
   "src/commands/init.js"(exports2, module2) {
@@ -235450,468 +237012,534 @@ var require_status = __commonJS({
   }
 });
 
-// src/commands/hook.js
-var require_hook = __commonJS({
-  "src/commands/hook.js"(exports2, module2) {
+// src/provider/github-enforcement.js
+var require_github_enforcement = __commonJS({
+  "src/provider/github-enforcement.js"(exports2, module2) {
     "use strict";
     var fs = require("fs");
     var path = require("path");
-    var os = require("os");
-    var { execSync } = require("child_process");
-    var HOOK_MARKER = "# CodeRifts pre-push hook";
-    var PRE_PUSH_SCRIPT = `#!/bin/sh
-${HOOK_MARKER}
-# Checks API spec changes before pushing.
-# The pre-push hook receives lines on stdin:
-#   <local ref> <local sha> <remote ref> <remote sha>
-#
-# Re-install after CLI upgrades: coderifts hook install
-#
-# Exit map (fail-closed when configured):
-#   CODERIFTS_SKIP=1          \u2192 exit 0 (explicit loud override)
-#   no apiKey                 \u2192 exit 0 soft (not configured)
-#   BLOCK / STOP / UNKNOWN    \u2192 exit 1
-#   INDETERMINATE (no decision obtainable) \u2192 exit 1
-#   ALLOW / analysis clean    \u2192 exit 0
-#   REQUIRE_APPROVAL / WARN   \u2192 warn, exit 0
-
-# Explicit escape hatch \u2014 never the default on error; human must set this.
-if [ "\${CODERIFTS_SKIP:-}" = "1" ]; then
-  echo "CodeRifts: CODERIFTS_SKIP=1 set \u2014 push allowed (explicit override)." >&2
-  exit 0
-fi
-
-CODERIFTS_API_KEY=$(git config coderifts.apiKey)
-SPEC_PATH=$(git config coderifts.specPath || echo "api/openapi.yaml")
-ZERO="0000000000000000000000000000000000000000"
-
-if [ -z "$CODERIFTS_API_KEY" ]; then
-  echo "CodeRifts: No API key configured. Run: git config coderifts.apiKey <your-key>"
-  exit 0  # Don't block if not configured
-fi
-
-# --- helpers: three-state git blob read (present | absent | error) ---
-# Sets: BLOB_KIND, BLOB_CONTENT, BLOB_ERR. Never maps unreadable \u2192 empty string.
-git_blob_at() {
-  _ref="$1"
-  _path="$2"
-  BLOB_CONTENT=""
-  BLOB_ERR=""
-  BLOB_KIND=""
-  if ! git rev-parse --verify "$_ref^{commit}" >/dev/null 2>&1; then
-    BLOB_KIND=error
-    BLOB_ERR="GIT_ERROR: cannot resolve ref $_ref"
-    return 1
-  fi
-  _errf=$(mktemp 2>/dev/null || echo "/tmp/coderifts-hook-err.$$")
-  if BLOB_CONTENT=$(git show "$_ref:$_path" 2>"$_errf"); then
-    BLOB_KIND=present
-    rm -f "$_errf"
-    return 0
-  fi
-  _err=$(cat "$_errf" 2>/dev/null)
-  rm -f "$_errf"
-  case "$_err" in
-    *"does not exist in"*|*"exists on disk, but not in"*)
-      BLOB_KIND=absent
-      BLOB_CONTENT=""
-      return 0
-      ;;
-  esac
-  BLOB_KIND=error
-  BLOB_ERR="GIT_ERROR: git show $_ref:$_path failed"
-  return 1
-}
-
-# New-branch baseline: merge-base with default branch (not empty before).
-# Prints merge-base SHA on success; nonzero if none can be resolved.
-resolve_new_branch_base_ref() {
-  _local="$1"
-  for _cand in origin/HEAD origin/main origin/master main master; do
-    _mb=$(git merge-base "$_local" "$_cand" 2>/dev/null) || continue
-    if [ -n "$_mb" ] && [ "$_mb" != "$ZERO" ]; then
-      echo "$_mb"
-      return 0
-    fi
-  done
-  return 1
-}
-
-# Read stdin lines provided by git pre-push
-while read LOCAL_REF LOCAL_SHA REMOTE_REF REMOTE_SHA; do
-  # Skip delete pushes
-  if [ "$LOCAL_SHA" = "$ZERO" ]; then
-    continue
-  fi
-
-  # after = local (about-to-be-pushed) commit \u2014 three-state
-  if ! git_blob_at "$LOCAL_SHA" "$SPEC_PATH"; then
-    echo "CodeRifts: $BLOB_ERR (after=$SPEC_PATH at $LOCAL_SHA). Fail-closed."
-    exit 1
-  fi
-  if [ "$BLOB_KIND" = "absent" ]; then
-    continue  # Spec doesn't exist in local commit, skip
-  fi
-  HEAD_SPEC=$BLOB_CONTENT
-
-  # before = remote tip, or for new branch (zero remote SHA) a merge-base baseline
-  if [ "$REMOTE_SHA" = "$ZERO" ]; then
-    BASE_REF=$(resolve_new_branch_base_ref "$LOCAL_SHA") || {
-      echo "CodeRifts: GIT_ERROR \u2014 cannot resolve merge-base baseline for new branch (tried origin/HEAD, origin/main, origin/master, main, master). Fail-closed."
-      exit 1
-    }
-  else
-    BASE_REF=$REMOTE_SHA
-  fi
-
-  if ! git_blob_at "$BASE_REF" "$SPEC_PATH"; then
-    echo "CodeRifts: $BLOB_ERR (before=$SPEC_PATH at $BASE_REF). Fail-closed \u2014 not treating as new spec."
-    exit 1
-  fi
-  if [ "$BLOB_KIND" = "absent" ]; then
-    # Honest NEW_ARTIFACT: path genuinely not at baseline
-    echo "CodeRifts: New artifact (spec absent at baseline $BASE_REF:$SPEC_PATH); allowing push."
-    continue
-  fi
-  BASE_SPEC=$BLOB_CONTENT
-
-  # If specs are identical, nothing to check
-  if [ "$BASE_SPEC" = "$HEAD_SPEC" ]; then
-    continue
-  fi
-
-  echo "CodeRifts: Checking API spec changes (baseline $BASE_REF)..."
-
-  # Capture body + HTTP status separately (fail-closed on non-2xx when configured).
-  _CR_BODY=$(mktemp 2>/dev/null || echo "/tmp/coderifts-hook-body.$$")
-  _CR_HTTP=$(curl -sS -o "$_CR_BODY" -w "%{http_code}" -X POST https://app.coderifts.com/api/v1/diff \\
-    -H "Authorization: Bearer $CODERIFTS_API_KEY" \\
-    -H "Content-Type: application/json" \\
-    -d "{\\"before\\": $(echo "$BASE_SPEC" | python3 -c 'import sys,json; print(json.dumps(sys.stdin.read()))'), \\"after\\": $(echo "$HEAD_SPEC" | python3 -c 'import sys,json; print(json.dumps(sys.stdin.read()))')}" 2>/dev/null) || _CR_HTTP="000"
-  RESULT=$(cat "$_CR_BODY" 2>/dev/null)
-  rm -f "$_CR_BODY"
-
-  # (a) HTTP non-2xx (incl. transport fail \u2192 000) \u2192 configured-but-indeterminate
-  case "$_CR_HTTP" in
-    2??) ;;
-    *)
-      echo "CodeRifts could not obtain a decision (HTTP \${_CR_HTTP:-000}); push blocked \u2014 set CODERIFTS_SKIP=1 to override intentionally" >&2
-      exit 1
-      ;;
-  esac
-
-  # Prefer closed-set execution_action; omega_decision only when action is absent.
-  # Indeterminate classes \u2192 INDETERMINATE (fail closed), never default ALLOW.
-  # Severity: BLOCK/STOP \u2192 exit 1; REQUIRE_APPROVAL/WARN \u2192 warn; unknown action \u2192 halt;
-  #           INDETERMINATE / empty \u2192 exit 1 (configured-but-indeterminate).
-  DECISION=$(echo "$RESULT" | python3 -c '
-import sys, json
-raw = sys.stdin.read()
-if raw is None or not str(raw).strip():
-    print("INDETERMINATE")
-    raise SystemExit(0)
-try:
-    d = json.loads(raw)
-except Exception:
-    # (b) 2xx but unparseable JSON
-    print("INDETERMINATE")
-    raise SystemExit(0)
-if not isinstance(d, dict):
-    print("INDETERMINATE")
-    raise SystemExit(0)
-# API error body without a decision (e.g. {"error":"internal_error"} / server_error)
-if d.get("error") and not (
-    d.get("omega_decision") or d.get("decision")
-    or d.get("execution_action")
-    or (isinstance(d.get("decision_result"), dict) and d["decision_result"].get("execution_action"))
-):
-    print("INDETERMINATE")
-    raise SystemExit(0)
-ea = None
-dr = d.get("decision_result")
-if isinstance(dr, dict) and isinstance(dr.get("execution_action"), str):
-    ea = dr["execution_action"]
-elif isinstance(d.get("execution_action"), str):
-    ea = d["execution_action"]
-closed = {"CONTINUE", "CONTINUE_WITH_MONITORING", "REQUEST_APPROVAL", "STOP"}
-if ea is not None and ea != "":
-    if ea not in closed:
-        print("UNKNOWN")
-        raise SystemExit(0)
-    if ea in ("CONTINUE", "CONTINUE_WITH_MONITORING"):
-        print("ALLOW")
-    elif ea == "STOP":
-        print("BLOCK")
-    else:
-        print("REQUIRE_APPROVAL")
-    raise SystemExit(0)
-# (c) parsed but no execution_action AND no decision \u2014 do NOT default ALLOW
-od = d.get("omega_decision") or d.get("decision")
-if od is None or od == "":
-    print("INDETERMINATE")
-    raise SystemExit(0)
-print(od)
-' 2>/dev/null)
-  # (d) empty DECISION (python missing / crash with empty stdout) \u2192 fail closed
-  if [ -z "$DECISION" ]; then
-    DECISION="INDETERMINATE"
-  fi
-  OMEGA=$(echo "$RESULT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('omega_api',0))" 2>/dev/null)
-  BREAKING=$(echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(len(d.get('breaking_changes',[])))" 2>/dev/null)
-
-  if [ "$DECISION" = "INDETERMINATE" ]; then
-    echo "CodeRifts could not obtain a decision (indeterminate response); push blocked \u2014 set CODERIFTS_SKIP=1 to override intentionally" >&2
-    exit 1
-  fi
-
-  if [ "$DECISION" = "UNKNOWN" ]; then
-    echo ""
-    echo "========================================"
-    echo "  CodeRifts: PUSH BLOCKED"
-    echo "========================================"
-    echo "  Reason: unrecognised execution_action is not permission"
-    echo "  Fail-closed (unknown present action)."
-    echo "========================================"
-    echo ""
-    echo "Set CODERIFTS_SKIP=1 to override intentionally (or git push --no-verify)."
-    exit 1
-  fi
-
-  if [ "$DECISION" = "BLOCK" ]; then
-    echo ""
-    echo "========================================"
-    echo "  CodeRifts: PUSH BLOCKED"
-    echo "========================================"
-    echo "  Risk score:       $OMEGA/100"
-    echo "  Breaking changes: $BREAKING"
-    echo "  Decision:         BLOCK"
-    echo "========================================"
-    echo ""
-    echo "Fix breaking changes, set CODERIFTS_SKIP=1 to override intentionally, or use --no-verify."
-    exit 1
-  fi
-
-  if [ "$DECISION" = "REQUIRE_APPROVAL" ] || [ "$DECISION" = "WARN" ]; then
-    echo "CodeRifts: WARNING \u2014 $DECISION \u2014 Risk: $OMEGA/100, Breaking: $BREAKING"
-  fi
-done
-
-exit 0
-`;
-    function findGitDir(startDir) {
-      let dir = startDir || process.cwd();
-      while (dir !== path.dirname(dir)) {
-        const gitDir = path.join(dir, ".git");
-        if (fs.existsSync(gitDir) && fs.statSync(gitDir).isDirectory()) {
-          return gitDir;
-        }
-        dir = path.dirname(dir);
+    var {
+      CHECK_NAME,
+      extractRequiredContexts
+    } = require_setup_required_check();
+    var { GATE_ACTION } = require_contract_gate_workflow();
+    var EVIDENCE_SPEC = "provider-enforcement-evidence.v1";
+    var APP_INSTALLATION = Object.freeze({
+      can_query_protection: false,
+      permissions: Object.freeze([
+        "contents:read",
+        "pull_requests:read+write",
+        "checks:read+write"
+      ]),
+      missing_scope: "administration:read",
+      reason: "GET /repos/{owner}/{repo}/branches/{branch}/protection requires administration:read (or repo admin). The CodeRifts GitHub App permission set is contents:read, pull_requests:read+write, checks:read+write \u2014 administration:read is not granted."
+    });
+    var NO_TOKEN_INSTRUCTION = "NO token \u2014 set GITHUB_TOKEN (repo + administration:read; Environments: Read if querying --env). The CodeRifts GitHub App installation cannot query branch protection (permissions: contents:read, pull_requests:read+write, checks:read+write \u2014 missing administration:read).";
+    var LAYER_IDS = Object.freeze([
+      "required_check",
+      "enforce_admins",
+      "strict_status_checks",
+      "environment_protection",
+      "workflow_contract_gate",
+      "workflow_deploy_gate"
+    ]);
+    var STATUS = Object.freeze({
+      VERIFIED: "VERIFIED",
+      NOT_VERIFIED: "NOT_VERIFIED",
+      UNVERIFIABLE: "UNVERIFIABLE"
+    });
+    function resolveGitHubAuth(env = process.env) {
+      const user = String(env && (env.GITHUB_TOKEN || env.GH_TOKEN) || "").trim();
+      if (user) {
+        return { ok: true, source: "github_token", token: user };
       }
-      return null;
+      const app = String(env && (env.GITHUB_APP_TOKEN || env.CODERIFTS_GITHUB_APP_TOKEN) || "").trim();
+      if (app) {
+        return { ok: true, source: "github_app_installation", token: app };
+      }
+      return { ok: false, source: "none", token: null, reason: NO_TOKEN_INSTRUCTION };
     }
-    function getHookPath(gitDir) {
-      return path.join(gitDir, "hooks", "pre-push");
+    function redactSecrets(text) {
+      return String(text || "").replace(/Bearer\s+\S+/gi, "Bearer [redacted]").replace(/ghp_[A-Za-z0-9_]+/g, "ghp_[redacted]").replace(/github_pat_[A-Za-z0-9_]+/g, "github_pat_[redacted]");
     }
-    function isCodeRiftsHook(hookPath) {
-      if (!fs.existsSync(hookPath)) return false;
-      const content = fs.readFileSync(hookPath, "utf-8");
-      return content.includes(HOOK_MARKER);
+    function createGitHubHttpClient(opts = {}) {
+      const token = opts.token;
+      const fetchFn = opts.fetchImpl || (typeof fetch === "function" ? fetch.bind(globalThis) : null);
+      const apiBase = (opts.apiBase || "https://api.github.com").replace(/\/$/, "");
+      return {
+        name: "github",
+        async get(apiPath) {
+          const endpoint = `${apiBase}/${String(apiPath).replace(/^\//, "")}`;
+          if (!fetchFn) {
+            return {
+              status: 0,
+              body: null,
+              endpoint,
+              error: "fetch is not available in this runtime"
+            };
+          }
+          const res = await fetchFn(endpoint, {
+            method: "GET",
+            headers: {
+              Authorization: `Bearer ${token}`,
+              Accept: "application/vnd.github+json",
+              "X-GitHub-Api-Version": "2022-11-28",
+              "User-Agent": "coderifts-cli"
+            }
+          });
+          const text = await res.text();
+          let body = null;
+          try {
+            body = text ? JSON.parse(text) : null;
+          } catch {
+            body = null;
+          }
+          return { status: res.status, body, endpoint };
+        }
+      };
     }
-    var CLAUDE_MATCHER = "Write|Edit|MultiEdit";
-    var CLAUDE_HOOK_BIN = "coderifts claude-hook";
-    function claudeSettingsPath({ global: isGlobal, cwd } = {}) {
-      if (isGlobal) return path.join(os.homedir(), ".claude", "settings.json");
-      return path.join(cwd || process.cwd(), ".claude", "settings.json");
+    function enforceAdminsEnabled(protection) {
+      if (!protection || typeof protection !== "object") return false;
+      const ea = protection.enforce_admins;
+      if (ea === true) return true;
+      if (ea && typeof ea === "object" && ea.enabled === true) return true;
+      return false;
     }
-    function claudeHookCommand(logPath) {
-      if (!logPath) return CLAUDE_HOOK_BIN;
-      const abs = path.resolve(String(logPath));
-      return `CODERIFTS_GUARD_EVENT_LOG=${abs} CODERIFTS_SESSION_ID=coderifts-claude-hook ${CLAUDE_HOOK_BIN}`;
+    function strictEnabled(protection) {
+      if (!protection || typeof protection !== "object") return false;
+      const rsc = protection.required_status_checks;
+      return !!(rsc && typeof rsc === "object" && rsc.strict === true);
     }
-    function isOurPreToolUseEntry(entry, command) {
-      if (!entry || typeof entry !== "object") return false;
-      if (entry.matcher !== CLAUDE_MATCHER) return false;
-      const hooks = Array.isArray(entry.hooks) ? entry.hooks : [];
-      return hooks.some((h) => h && h.type === "command" && String(h.command || "") === command);
+    function environmentProtected(body) {
+      if (!body || typeof body !== "object") return false;
+      const rules = Array.isArray(body.protection_rules) ? body.protection_rules : [];
+      if (rules.length > 0) return true;
+      const policy = body.deployment_branch_policy;
+      if (policy && typeof policy === "object") {
+        return policy.protected_branches === true || policy.custom_branch_policies === true;
+      }
+      return false;
     }
-    function installClaudeHook(opts = {}) {
-      const cwd = opts.cwd || process.cwd();
-      const home = opts.homeDir || os.homedir();
-      const dest = opts.global ? path.join(home, ".claude", "settings.json") : path.join(cwd, ".claude", "settings.json");
-      const command = claudeHookCommand(opts.logPath);
-      const block = {
-        matcher: CLAUDE_MATCHER,
-        hooks: [{ type: "command", command, timeout: 60 }]
-      };
-      let existing = {};
-      let hadFile = false;
-      if (fs.existsSync(dest)) {
-        hadFile = true;
-        let raw;
-        try {
-          raw = fs.readFileSync(dest, "utf8");
-        } catch (err) {
-          const message = `Error: cannot read ${dest} (${err && err.message}) \u2014 refusing to write.`;
-          console.error(message);
-          process.exitCode = 1;
-          return { exitCode: 1, code: "READ_FAILED", path: dest, message };
+    function layer(id, status, extra = {}) {
+      return { id, status, ...extra };
+    }
+    function evaluateLayers({
+      protectionRead,
+      environmentRead,
+      environmentName,
+      local,
+      auth
+    } = {}) {
+      const layers = [];
+      const localFiles = local || { contractGateFiles: [], deployGateFiles: [] };
+      const noAuth = !auth || auth.source === "none" || !auth.ok;
+      const prot = protectionRead || null;
+      if (noAuth && !prot) {
+        const why = auth && auth.reason || NO_TOKEN_INSTRUCTION;
+        for (const id of ["required_check", "enforce_admins", "strict_status_checks"]) {
+          layers.push(layer(id, STATUS.UNVERIFIABLE, {
+            reason: why,
+            endpoint: null,
+            missing_scope: APP_INSTALLATION.missing_scope
+          }));
         }
-        if (String(raw).trim() !== "") {
-          try {
-            existing = JSON.parse(raw);
-          } catch (err) {
-            const message = `Error: ${dest} is not valid JSON \u2014 refusing (no write). Fix or remove the file, then re-run.`;
-            console.error(message);
-            process.exitCode = 1;
-            return { exitCode: 1, code: "PARSE_FAILED", path: dest, message };
-          }
-          if (!existing || typeof existing !== "object" || Array.isArray(existing)) {
-            const message = `Error: ${dest} JSON root is not an object \u2014 refusing (no write).`;
-            console.error(message);
-            process.exitCode = 1;
-            return { exitCode: 1, code: "PARSE_FAILED", path: dest, message };
-          }
+      } else if (!prot) {
+        const why = "branch protection was not queried";
+        for (const id of ["required_check", "enforce_admins", "strict_status_checks"]) {
+          layers.push(layer(id, STATUS.UNVERIFIABLE, { reason: why, endpoint: null }));
+        }
+      } else if (prot.status === 403) {
+        const why = "GitHub HTTP 403 \u2014 missing scope administration:read (branch protection). Grant Administration: Read on the token, or use a repo-admin token.";
+        const endpoint = prot.endpoint ? `GET ${prot.endpoint}` : null;
+        for (const id of ["required_check", "enforce_admins", "strict_status_checks"]) {
+          layers.push(layer(id, STATUS.UNVERIFIABLE, {
+            reason: why,
+            endpoint,
+            missing_scope: "administration:read",
+            http_status: 403
+          }));
+        }
+      } else if (prot.status === 404) {
+        const endpoint = prot.endpoint ? `GET ${prot.endpoint}` : null;
+        layers.push(layer("required_check", STATUS.NOT_VERIFIED, {
+          reason: `classic branch protection is absent \u2014 required check "${CHECK_NAME}" is not required`,
+          endpoint,
+          http_status: 404
+        }));
+        layers.push(layer("enforce_admins", STATUS.NOT_VERIFIED, {
+          reason: "classic branch protection is absent \u2014 administrators are unrestricted",
+          endpoint,
+          http_status: 404
+        }));
+        layers.push(layer("strict_status_checks", STATUS.NOT_VERIFIED, {
+          reason: "classic branch protection is absent \u2014 required_status_checks.strict is not set",
+          endpoint,
+          http_status: 404
+        }));
+      } else if (prot.status >= 400 || prot.status === 0) {
+        const endpoint = prot.endpoint ? `GET ${prot.endpoint}` : null;
+        const why = `GitHub HTTP ${prot.status || 0} reading branch protection \u2014 cannot verify`;
+        for (const id of ["required_check", "enforce_admins", "strict_status_checks"]) {
+          layers.push(layer(id, STATUS.UNVERIFIABLE, {
+            reason: redactSecrets(why),
+            endpoint,
+            http_status: prot.status
+          }));
         }
+      } else {
+        const protection = prot.body && typeof prot.body === "object" ? prot.body : {};
+        const endpoint = prot.endpoint ? `GET ${prot.endpoint}` : null;
+        const contexts = extractRequiredContexts(protection);
+        const hasCheck = contexts.includes(CHECK_NAME);
+        layers.push(layer("required_check", hasCheck ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
+          reason: hasCheck ? `required_status_checks includes "${CHECK_NAME}"` : `required_status_checks does not include "${CHECK_NAME}" (have: ${contexts.join(", ") || "none"})`,
+          endpoint,
+          required_contexts: contexts
+        }));
+        const admins = enforceAdminsEnabled(protection);
+        layers.push(layer("enforce_admins", admins ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
+          reason: admins ? "enforce_admins.enabled is true \u2014 administrators cannot bypass required checks" : "enforce_admins.enabled is false \u2014 repository administrators can bypass required checks",
+          endpoint,
+          enforce_admins: admins
+        }));
+        const strict = strictEnabled(protection);
+        layers.push(layer("strict_status_checks", strict ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
+          reason: strict ? "required_status_checks.strict is true" : "required_status_checks.strict is not true \u2014 a branch need not be up to date before merge",
+          endpoint,
+          strict
+        }));
       }
-      const hooksRoot = existing.hooks && typeof existing.hooks === "object" && !Array.isArray(existing.hooks) ? { ...existing.hooks } : {};
-      const pre = Array.isArray(hooksRoot.PreToolUse) ? hooksRoot.PreToolUse.slice() : [];
-      if (pre.some((e) => isOurPreToolUseEntry(e, command))) {
-        console.log(`Claude Code hook already installed at ${dest} (no-op).`);
-        return { exitCode: 0, code: "NOOP", path: dest, wrote: false };
+      if (!environmentName) {
+        layers.push(layer("environment_protection", STATUS.UNVERIFIABLE, {
+          reason: "no --env supplied; pass --env <GitHub Environment name> to query environment protection rules",
+          endpoint: null
+        }));
+      } else if (noAuth && !environmentRead) {
+        layers.push(layer("environment_protection", STATUS.UNVERIFIABLE, {
+          reason: auth && auth.reason || NO_TOKEN_INSTRUCTION,
+          endpoint: null,
+          missing_scope: "actions:read / Environments: Read"
+        }));
+      } else if (!environmentRead) {
+        layers.push(layer("environment_protection", STATUS.UNVERIFIABLE, {
+          reason: "environment was not queried",
+          endpoint: null
+        }));
+      } else if (environmentRead.status === 403) {
+        layers.push(layer("environment_protection", STATUS.UNVERIFIABLE, {
+          reason: "GitHub HTTP 403 \u2014 missing scope to read environments (Actions/Environments: Read, or repo admin).",
+          endpoint: environmentRead.endpoint ? `GET ${environmentRead.endpoint}` : null,
+          missing_scope: "environments:read",
+          http_status: 403
+        }));
+      } else if (environmentRead.status === 404) {
+        layers.push(layer("environment_protection", STATUS.NOT_VERIFIED, {
+          reason: `GitHub Environment "${environmentName}" does not exist (or has no protection)`,
+          endpoint: environmentRead.endpoint ? `GET ${environmentRead.endpoint}` : null,
+          http_status: 404
+        }));
+      } else if (environmentRead.status >= 400 || environmentRead.status === 0) {
+        layers.push(layer("environment_protection", STATUS.UNVERIFIABLE, {
+          reason: `GitHub HTTP ${environmentRead.status || 0} reading environment "${environmentName}"`,
+          endpoint: environmentRead.endpoint ? `GET ${environmentRead.endpoint}` : null,
+          http_status: environmentRead.status
+        }));
+      } else {
+        const ok = environmentProtected(environmentRead.body);
+        layers.push(layer("environment_protection", ok ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
+          reason: ok ? `GitHub Environment "${environmentName}" has protection rules or a deployment branch policy` : `GitHub Environment "${environmentName}" exists but has no protection_rules and no deployment_branch_policy`,
+          endpoint: environmentRead.endpoint ? `GET ${environmentRead.endpoint}` : null,
+          environment: environmentName
+        }));
       }
-      const nextPre = pre.concat([block]);
-      const next = {
-        ...existing,
-        hooks: { ...hooksRoot, PreToolUse: nextPre }
+      const cg = localFiles.contractGateFiles || [];
+      layers.push(layer("workflow_contract_gate", cg.length ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
+        reason: cg.length ? `workflow references ${GATE_ACTION} (${cg.join(", ")})` : `no .github/workflows file references ${GATE_ACTION}`,
+        endpoint: "local:.github/workflows",
+        files: cg
+      }));
+      const dg = localFiles.deployGateFiles || [];
+      layers.push(layer("workflow_deploy_gate", dg.length ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
+        reason: dg.length ? `workflow runs coderifts deploy-gate (${dg.join(", ")})` : "no .github/workflows file runs coderifts deploy-gate",
+        endpoint: "local:.github/workflows",
+        files: dg
+      }));
+      const byId = Object.fromEntries(layers.map((l) => [l.id, l]));
+      const inescapable = LAYER_IDS.every((id) => byId[id] && byId[id].status === STATUS.VERIFIED);
+      return {
+        layers,
+        inescapable_deploy: inescapable,
+        claim: {
+          inescapable_deploy: inescapable,
+          basis: inescapable ? "all six layers VERIFIED from queried provider evidence + local workflow files" : "inescapable_deploy stays false until every layer is VERIFIED"
+        }
       };
-      const serialized = `${JSON.stringify(next, null, 2)}
-`;
-      let backedUp;
-      if (hadFile) {
-        backedUp = `${dest}.bak`;
-        fs.copyFileSync(dest, backedUp);
-      }
-      fs.mkdirSync(path.dirname(dest), { recursive: true });
-      fs.writeFileSync(dest, serialized, "utf8");
-      console.log(`Claude Code PreToolUse hook written to ${dest}`);
-      if (backedUp) console.log(`Backup: ${backedUp}`);
-      console.log("matcher Write|Edit|MultiEdit \u2192 coderifts claude-hook (exit 2 = BLOCK).");
-      return { exitCode: 0, code: "OK", path: dest, backedUp, wrote: true };
     }
-    function install(options = {}) {
-      if (options.global && !options.claude) {
-        console.error("Error: --global requires --claude (writes ~/.claude/settings.json).");
-        process.exitCode = 1;
-        return { exitCode: 1, code: "USAGE" };
-      }
-      if (options.claude) {
-        const r = installClaudeHook({
-          global: !!options.global,
-          logPath: options.log,
-          cwd: options.cwd,
-          homeDir: options.homeDir
-        });
-        if (r.exitCode !== 0) return r;
+    function scanLocalWorkflows(cwd, deps = {}) {
+      const exists = deps.exists || fs.existsSync.bind(fs);
+      const readdir = deps.readdir || ((p) => fs.readdirSync(p));
+      const readFile = deps.readFile || ((p) => fs.readFileSync(p, "utf8"));
+      const dir = path.join(cwd, ".github", "workflows");
+      const contractGateFiles = [];
+      const deployGateFiles = [];
+      if (!exists(dir)) return { contractGateFiles, deployGateFiles };
+      let names = [];
+      try {
+        names = readdir(dir);
+      } catch {
+        return { contractGateFiles, deployGateFiles };
       }
-      const gitDir = findGitDir(options.cwd);
-      if (!gitDir) {
-        if (options.claude) {
-          console.log("Not inside a Git repository \u2014 skipped pre-push hook.");
-          return { exitCode: 0, code: "OK" };
+      for (const name of names) {
+        if (!/\.ya?ml$/i.test(name)) continue;
+        const rel = `.github/workflows/${name}`;
+        let body = "";
+        try {
+          body = String(readFile(path.join(dir, name)));
+        } catch {
+          continue;
         }
-        console.error("Error: Not inside a Git repository.");
-        process.exitCode = 1;
-        return { exitCode: 1, code: "NO_GIT" };
-      }
-      const hooksDir = path.join(gitDir, "hooks");
-      if (!fs.existsSync(hooksDir)) {
-        fs.mkdirSync(hooksDir, { recursive: true });
-      }
-      const hookPath = getHookPath(gitDir);
-      if (fs.existsSync(hookPath) && !isCodeRiftsHook(hookPath)) {
-        console.error("Error: A pre-push hook already exists and was not created by CodeRifts.");
-        console.error("Remove it manually or back it up before installing.");
-        process.exitCode = 1;
-        return;
+        if (body.includes(GATE_ACTION)) contractGateFiles.push(rel);
+        if (/\bcoderifts\s+deploy-gate\b/.test(body)) deployGateFiles.push(rel);
       }
-      fs.writeFileSync(hookPath, PRE_PUSH_SCRIPT, { mode: 493 });
-      console.log("CodeRifts pre-push hook installed.");
-      console.log("");
-      console.log("Configure your API key:");
-      console.log("  git config coderifts.apiKey <your-key>");
-      console.log("");
-      console.log("Optionally set spec path (default: api/openapi.yaml):");
-      console.log("  git config coderifts.specPath path/to/openapi.yaml");
-      console.log("");
-      console.log("After upgrading the coderifts CLI, re-run this command so the installed");
-      console.log("hook matches the package (already-installed hooks are not auto-updated):");
-      console.log("  coderifts hook install");
-      console.log("");
-      console.log("Agent-using repo? Run: coderifts agent-setup");
+      return { contractGateFiles, deployGateFiles };
     }
-    function uninstall() {
-      const gitDir = findGitDir();
-      if (!gitDir) {
-        console.error("Error: Not inside a Git repository.");
-        process.exitCode = 1;
-        return;
-      }
-      const hookPath = getHookPath(gitDir);
-      if (!fs.existsSync(hookPath)) {
-        console.log("No pre-push hook found. Nothing to uninstall.");
-        return;
-      }
-      if (!isCodeRiftsHook(hookPath)) {
-        console.error("Error: The existing pre-push hook was not created by CodeRifts. Skipping.");
-        process.exitCode = 1;
-        return;
-      }
-      fs.unlinkSync(hookPath);
-      console.log("CodeRifts pre-push hook removed.");
+    async function queryGitHubEnforcement({
+      owner,
+      repo,
+      branch,
+      environmentName,
+      client
+    } = {}) {
+      const protectionPath = branch ? `repos/${owner}/${repo}/branches/${encodeURIComponent(branch)}/protection` : null;
+      const envPath = environmentName ? `repos/${owner}/${repo}/environments/${encodeURIComponent(environmentName)}` : null;
+      let resolvedBranch = branch || null;
+      let repoRead = null;
+      if (!resolvedBranch && client) {
+        repoRead = await client.get(`repos/${owner}/${repo}`);
+        if (repoRead && repoRead.status === 200 && repoRead.body && repoRead.body.default_branch) {
+          resolvedBranch = String(repoRead.body.default_branch);
+        }
+      }
+      const protPath = resolvedBranch ? `repos/${owner}/${repo}/branches/${encodeURIComponent(resolvedBranch)}/protection` : protectionPath;
+      const protectionRead = client && protPath ? await client.get(protPath) : null;
+      const environmentRead = client && envPath ? await client.get(envPath) : null;
+      return {
+        branch: resolvedBranch,
+        repoRead,
+        protectionRead,
+        environmentRead
+      };
     }
-    function status() {
-      const gitDir = findGitDir();
-      if (!gitDir) {
-        console.error("Error: Not inside a Git repository.");
-        process.exitCode = 1;
-        return;
-      }
-      const hookPath = getHookPath(gitDir);
-      const installed = isCodeRiftsHook(hookPath);
-      console.log(`Hook: ${installed ? "installed" : "not installed"}`);
-      if (installed) {
-        try {
-          const apiKey = execSync("git config coderifts.apiKey", { encoding: "utf-8", cwd: path.dirname(gitDir) }).trim();
-          console.log(`API key: ${apiKey ? "configured" : "not configured"}`);
-        } catch {
-          console.log("API key: not configured");
+    module2.exports = {
+      EVIDENCE_SPEC,
+      APP_INSTALLATION,
+      NO_TOKEN_INSTRUCTION,
+      LAYER_IDS,
+      STATUS,
+      CHECK_NAME,
+      GATE_ACTION,
+      resolveGitHubAuth,
+      redactSecrets,
+      createGitHubHttpClient,
+      evaluateLayers,
+      scanLocalWorkflows,
+      queryGitHubEnforcement,
+      enforceAdminsEnabled,
+      strictEnabled,
+      environmentProtected
+    };
+  }
+});
+
+// src/commands/enforce-check.js
+var require_enforce_check = __commonJS({
+  "src/commands/enforce-check.js"(exports2, module2) {
+    "use strict";
+    var chalk = require_source();
+    var {
+      EVIDENCE_SPEC,
+      APP_INSTALLATION,
+      NO_TOKEN_INSTRUCTION,
+      resolveGitHubAuth,
+      createGitHubHttpClient,
+      evaluateLayers,
+      scanLocalWorkflows,
+      queryGitHubEnforcement
+    } = require_github_enforcement();
+    var { isValidRepo } = require_status();
+    var { resolveOwnerRepo } = require_setup_required_check();
+    if (process.env.NO_COLOR) chalk.level = 0;
+    var USAGE = [
+      "Usage: coderifts enforce --check --repo owner/repo [--env <github-environment>] [--branch <name>] [--json]",
+      "",
+      "Query the provider (GitHub) and local workflow files. Report, per layer:",
+      "  VERIFIED / NOT_VERIFIED / UNVERIFIABLE(reason).",
+      "inescapable_deploy is true only when every layer is VERIFIED.",
+      "",
+      "Auth: GITHUB_TOKEN (or GH_TOKEN). Never prints token values.",
+      "The CodeRifts GitHub App installation cannot query branch protection",
+      "(missing administration:read)."
+    ].join("\n");
+    function statusColor(status) {
+      if (status === "VERIFIED") return chalk.green(status);
+      if (status === "NOT_VERIFIED") return chalk.yellow(status);
+      return chalk.red(status);
+    }
+    function renderHuman(report) {
+      const lines = [];
+      lines.push(chalk.bold("CodeRifts enforce --check"));
+      lines.push(`  repo:    ${report.repo}`);
+      lines.push(`  branch:  ${report.branch || "(unknown)"}`);
+      if (report.environment) lines.push(`  env:     ${report.environment}`);
+      lines.push(`  queried: ${report.queried_at}`);
+      lines.push(`  auth:    ${report.auth.source} (value not printed)`);
+      lines.push(chalk.dim(`  App installation: cannot query protection (${report.auth.app_installation.missing_scope})`));
+      lines.push("");
+      lines.push(chalk.bold("  Layer                              Status"));
+      for (const l of report.layers) {
+        const id = String(l.id).padEnd(34, " ");
+        lines.push(`  ${id}${statusColor(l.status)}`);
+        if (l.status !== "VERIFIED" && l.reason) {
+          lines.push(chalk.dim(`    WHY    ${l.reason}`));
         }
-        try {
-          const specPath = execSync("git config coderifts.specPath", { encoding: "utf-8", cwd: path.dirname(gitDir) }).trim();
-          console.log(`Spec path: ${specPath || "api/openapi.yaml (default)"}`);
-        } catch {
-          console.log("Spec path: api/openapi.yaml (default)");
+        if (l.endpoint) lines.push(chalk.dim(`    via    ${l.endpoint}`));
+      }
+      lines.push("");
+      const claim = report.claim && report.claim.inescapable_deploy === true;
+      lines.push(`  inescapable_deploy: ${claim ? chalk.green("true") : chalk.yellow("false")}`);
+      lines.push(chalk.dim(`  ${report.claim.basis}`));
+      lines.push("");
+      lines.push(chalk.dim("  This is queried evidence, not a host claim."));
+      lines.push(chalk.dim("  --enforce / CODERIFTS_DEPLOY_NO_BYPASS are host claims and do not set this field."));
+      if (!claim) {
+        lines.push("");
+        lines.push(chalk.bold("  ACTION"));
+        const missing = report.layers.filter((l) => l.status !== "VERIFIED");
+        for (const l of missing) {
+          if (l.id === "required_check") {
+            lines.push(chalk.dim('    require "CodeRifts / contract-gate" on default-branch protection'));
+            lines.push(chalk.dim("    (coderifts setup-required-check --apply)"));
+          } else if (l.id === "enforce_admins") {
+            lines.push(chalk.dim("    set enforce_admins: true so administrators cannot bypass"));
+            lines.push(chalk.dim("    (coderifts setup-required-check --enforce-admins --apply)"));
+          } else if (l.id === "strict_status_checks") {
+            lines.push(chalk.dim("    set required_status_checks.strict: true"));
+          } else if (l.id === "environment_protection") {
+            lines.push(chalk.dim("    add a GitHub Environment with protection rules, pass --env <name>"));
+          } else if (l.id === "workflow_contract_gate") {
+            lines.push(chalk.dim("    add .github/workflows/coderifts.yml using coderifts/contract-gate@v0"));
+            lines.push(chalk.dim("    (coderifts init --agents)"));
+          } else if (l.id === "workflow_deploy_gate") {
+            lines.push(chalk.dim("    add a CD step: coderifts deploy-gate --env <env> --artifact <id> --receipt <file>"));
+          }
         }
+      }
+      return lines.join("\n");
+    }
+    async function runEnforceCheck(options = {}, deps = {}) {
+      const log = deps.log || console.log.bind(console);
+      const errLog = deps.errLog || console.error.bind(console);
+      const cwd = deps.cwd || options.cwd || process.cwd();
+      const now = deps.now || (() => (/* @__PURE__ */ new Date()).toISOString());
+      const env = deps.env || process.env;
+      const repoArg = options.repo;
+      let ownerRepo = null;
+      if (repoArg && isValidRepo(String(repoArg).trim())) {
+        const [owner, repo] = String(repoArg).trim().split("/");
+        ownerRepo = { owner, repo };
+      } else if (!repoArg) {
         try {
-          fs.accessSync(hookPath, fs.constants.X_OK);
-          console.log("Executable: yes");
+          ownerRepo = resolveOwnerRepo(cwd, deps.gitImpl);
         } catch {
-          console.log("Executable: no (run: chmod +x " + hookPath + ")");
+          ownerRepo = null;
         }
       }
+      if (!ownerRepo) {
+        errLog(chalk.red("Error: missing repo (pass --repo owner/repo)"));
+        errLog(USAGE);
+        return { exitCode: 1, error: "missing_repo" };
+      }
+      const providerName = String(options.provider || "github").toLowerCase();
+      const queriedAt = now();
+      const environmentName = options.env ? String(options.env).trim() : null;
+      const local = (deps.scanLocalWorkflows || scanLocalWorkflows)(cwd, deps.fs || {});
+      const authPublic = {
+        source: "none",
+        app_installation: { ...APP_INSTALLATION }
+      };
+      if (providerName !== "github") {
+        const reason = `no ${providerName} adapter \u2014 GitHub is the only implemented provider; refusing to stub results`;
+        const evaluated2 = evaluateLayers({
+          protectionRead: null,
+          environmentRead: null,
+          environmentName,
+          local,
+          auth: { ok: false, source: "none", reason }
+        });
+        const report2 = {
+          command: "enforce --check",
+          spec: EVIDENCE_SPEC,
+          queried_at: queriedAt,
+          repo: `${ownerRepo.owner}/${ownerRepo.repo}`,
+          branch: options.branch || null,
+          environment: environmentName,
+          provider: providerName,
+          auth: { ...authPublic, reason },
+          ...evaluated2
+        };
+        if (options.json) log(JSON.stringify(report2, null, 2));
+        else log(renderHuman(report2));
+        return { exitCode: 0, report: report2 };
+      }
+      const auth = (deps.resolveAuth || resolveGitHubAuth)(env);
+      authPublic.source = auth.source;
+      if (auth.reason) authPublic.reason = auth.reason;
+      let branch = options.branch ? String(options.branch).trim() : null;
+      let protectionRead = null;
+      let environmentRead = null;
+      if (auth.ok) {
+        const client = deps.githubClient || createGitHubHttpClient({
+          token: auth.token,
+          fetchImpl: deps.fetchImpl
+        });
+        const queried = await queryGitHubEnforcement({
+          owner: ownerRepo.owner,
+          repo: ownerRepo.repo,
+          branch,
+          environmentName,
+          client
+        });
+        branch = queried.branch || branch;
+        protectionRead = queried.protectionRead;
+        environmentRead = queried.environmentRead;
+      }
+      const evaluated = evaluateLayers({
+        protectionRead,
+        environmentRead,
+        environmentName,
+        local,
+        auth
+      });
+      const report = {
+        command: "enforce --check",
+        spec: EVIDENCE_SPEC,
+        queried_at: queriedAt,
+        repo: `${ownerRepo.owner}/${ownerRepo.repo}`,
+        branch,
+        environment: environmentName,
+        provider: "github",
+        auth: authPublic,
+        ...evaluated
+      };
+      if (options.json) log(JSON.stringify(report, null, 2));
+      else log(renderHuman(report));
+      return { exitCode: 0, report };
     }
     module2.exports = {
-      install,
-      uninstall,
-      status,
-      PRE_PUSH_SCRIPT,
-      HOOK_MARKER,
-      findGitDir,
-      isCodeRiftsHook,
-      installClaudeHook,
-      claudeSettingsPath,
-      claudeHookCommand,
-      CLAUDE_MATCHER
+      runEnforceCheck,
+      renderHuman,
+      USAGE,
+      NO_TOKEN_INSTRUCTION
     };
   }
 });
@@ -235938,14 +237566,19 @@ var require_enforce = __commonJS({
     var USAGE = [
       "Usage: coderifts enforce --repo owner/repo [--apply]",
       "   or: coderifts enforce owner/repo [--apply]",
+      "   or: coderifts enforce --check --repo owner/repo [--env <name>] [--json]",
       "",
       "Cross-layer orchestrator: reads enforcement-status, then closes gaps by calling existing",
       "setup commands (setup-required-check, hook install, deploy-gate guidance).",
       "",
+      "--check: query GitHub + local workflows and report VERIFIED / NOT_VERIFIED /",
+      "UNVERIFIABLE per layer. inescapable_deploy is true only when every layer is VERIFIED.",
+      "Does not use the CodeRifts API key. Auth: GITHUB_TOKEN. Read-only.",
+      "",
       "DRY-RUN BY DEFAULT \u2014 without --apply, prints what WOULD run and mutates NOTHING.",
       "With --apply, threads apply into each underlying command (their own safety still applies).",
       "",
-      "Requires a cloud API key for the status read (coderifts login / CODERIFTS_API_KEY).",
+      "Requires a cloud API key for the (non --check) status read (coderifts login / CODERIFTS_API_KEY).",
       "Merge apply uses your local `gh` credentials, not the CodeRifts API key."
     ].join("\n");
     var AGENT_GUARD_GUIDANCE = [
@@ -235956,8 +237589,10 @@ var require_enforce = __commonJS({
     ].join("\n");
     var DEPLOY_GUIDANCE = [
       "Deploy is declared-only on the server (never server-observed ENFORCING).",
-      "Add a CD step that runs: coderifts deploy-gate --env <env> --artifact <id> --receipt <file> --enforce",
-      "  (fail-closed by default; --enforce attests ENFORCING for inescapable_deploy. CODERIFTS_DEPLOY_ADVISORY=1 to soften.)",
+      "Add a CD step that runs: coderifts deploy-gate --env <env> --artifact <id> --receipt <file>",
+      "  (fail-closed by default. --enforce is a host claim, not inescapable_deploy.",
+      "   Prove pipeline protection with: coderifts enforce --check --repo owner/repo --env <env>.",
+      "   CODERIFTS_DEPLOY_ADVISORY=1 to soften the exit.)",
       "Also set policy.require_source_binding: true in .coderifts.yml for the deploy declaration leg."
     ].join("\n");
     var CONTENT_GUIDANCE = [
@@ -235984,6 +237619,15 @@ var require_enforce = __commonJS({
       }
     }
     async function runEnforce(options = {}, deps = {}) {
+      if (options.check === true) {
+        if (options.apply === true) {
+          const errLog2 = deps.errLog || console.error.bind(console);
+          errLog2(chalk.red("Error: --check is read-only evidence and cannot be combined with --apply"));
+          return { exitCode: 1, error: "check_apply_conflict", outcomes: [] };
+        }
+        const { runEnforceCheck } = require_enforce_check();
+        return runEnforceCheck(options, deps);
+      }
       const apply = options.apply === true;
       const getKey = deps.getApiKey || getApiKey;
       const fetchStatus = deps.cloudGetEnforcementStatus || cloudGetEnforcementStatus;
@@ -236179,216 +237823,6 @@ var require_enforce = __commonJS({
   }
 });
 
-// src/agent-host-files.embedded.js
-var require_agent_host_files_embedded = __commonJS({
-  "src/agent-host-files.embedded.js"(exports2, module2) {
-    "use strict";
-    var AGENT_HOST_PATHS = Object.freeze([
-      "AGENTS.md",
-      "CLAUDE.md",
-      ".cursor/rules/coderifts.mdc",
-      ".github/copilot-instructions.md",
-      "coderifts-langgraph-policy.js",
-      "openai-agent-instructions.md",
-      ".claude/settings.json"
-    ]);
-    var AGENT_HOST_FILES = Object.freeze({
-      "AGENTS.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent rules\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nA receipt is operation-scoped: a merge receipt never authorizes a deploy or publish. When the operation changes, you MUST call `preflight_change_set` again with the new `context.operation` \u2014 do not decline, re-preflight.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n',
-      "CLAUDE.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nA receipt is operation-scoped: a merge receipt never authorizes a deploy or publish. When the operation changes, you MUST call `preflight_change_set` again with the new `context.operation` \u2014 do not decline, re-preflight.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n',
-      ".cursor/rules/coderifts.mdc": '---\ndescription: CodeRifts API governance \u2014 when to preflight and how to branch\nglobs:\nalwaysApply: true\n---\n\n<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nA receipt is operation-scoped: a merge receipt never authorizes a deploy or publish. When the operation changes, you MUST call `preflight_change_set` again with the new `context.operation` \u2014 do not decline, re-preflight.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n',
-      ".github/copilot-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts instructions for GitHub Copilot\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nA receipt is operation-scoped: a merge receipt never authorizes a deploy or publish. When the operation changes, you MUST call `preflight_change_set` again with the new `context.operation` \u2014 do not decline, re-preflight.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n',
-      "coderifts-langgraph-policy.js": '// GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js\n// System policy string for a LangGraph (or similar) agent. Content is generated;\n// identical rule sentences to AGENTS.md / other formats.\n\'use strict\';\n\nmodule.exports = "Call `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\\n\\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\\n\\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\\n\\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\\n\\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not \\"proceed with caution\\" without monitoring.\\n\\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\\n\\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\\n\\nA receipt is operation-scoped: a merge receipt never authorizes a deploy or publish. When the operation changes, you MUST call `preflight_change_set` again with the new `context.operation` \u2014 do not decline, re-preflight.\\n\\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\\n\\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\\n\\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\\n\\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\\n\\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\\n\\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\\n\\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.";\n',
-      "openai-agent-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent instructions\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nA receipt is operation-scoped: a merge receipt never authorizes a deploy or publish. When the operation changes, you MUST call `preflight_change_set` again with the new `context.operation` \u2014 do not decline, re-preflight.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n',
-      ".claude/settings.json": '{\n  "hooks": {\n    "PreToolUse": [\n      {\n        "matcher": "Write|Edit|MultiEdit",\n        "hooks": [\n          {\n            "type": "command",\n            "command": "coderifts claude-hook",\n            "timeout": 60\n          }\n        ]\n      }\n    ]\n  }\n}\n'
-    });
-    module2.exports = { AGENT_HOST_FILES, AGENT_HOST_PATHS };
-  }
-});
-
-// src/commands/agent-setup.js
-var require_agent_setup = __commonJS({
-  "src/commands/agent-setup.js"(exports2, module2) {
-    "use strict";
-    var fs = require("fs");
-    var path = require("path");
-    var chalk = require_source();
-    var { AGENT_HOST_FILES, AGENT_HOST_PATHS } = require_agent_host_files_embedded();
-    if (process.env.NO_COLOR) chalk.level = 0;
-    var USAGE = `Usage: coderifts agent-setup [--out <dir>] [--check] [--force]
-
-  --out <dir>   Target directory (default: current working directory)
-  --check       Exit 0 if on-disk files match embedded content; exit 1 on drift
-  --force       Overwrite existing files (default: skip collisions)
-  Unknown flags exit 1 (never silently ignored).
-`;
-    function parseAgentSetupArgs(argv) {
-      const args = argv.slice(2);
-      let out = null;
-      let check = false;
-      let force = false;
-      let i = 0;
-      while (i < args.length && !String(args[i]).startsWith("-")) i += 1;
-      while (i < args.length) {
-        const a = args[i];
-        if (a === "--out") {
-          const v = args[i + 1];
-          if (v == null || v.startsWith("-")) {
-            return { out, check, force, error: `agent-setup: --out requires a path
-${USAGE}` };
-          }
-          out = path.resolve(v);
-          i += 2;
-          continue;
-        }
-        if (a === "--check") {
-          check = true;
-          i += 1;
-          continue;
-        }
-        if (a === "--force") {
-          force = true;
-          i += 1;
-          continue;
-        }
-        if (a.startsWith("-")) {
-          return { out, check, force, error: `agent-setup: unrecognized argument: ${a}
-${USAGE}` };
-        }
-        return { out, check, force, error: `agent-setup: unrecognized argument: ${a}
-${USAGE}` };
-      }
-      return { out, check, force };
-    }
-    function runAgentSetup(options = {}, deps = {}) {
-      const log = deps.log || console.log.bind(console);
-      const logErr = deps.logErr || console.error.bind(console);
-      const doExit = deps.exit !== false;
-      const cwd = deps.cwd || process.cwd();
-      const exists = deps.exists || fs.existsSync.bind(fs);
-      const readFile = deps.readFile || ((p) => fs.readFileSync(p, "utf8"));
-      const writeFile = deps.writeFile || ((p, c) => {
-        fs.mkdirSync(path.dirname(p), { recursive: true });
-        fs.writeFileSync(p, c, "utf8");
-      });
-      let outDir = options.out ? path.resolve(String(options.out)) : cwd;
-      let check = !!options.check;
-      let force = !!options.force;
-      if (deps.argv) {
-        const parsed = parseAgentSetupArgs(deps.argv);
-        if (parsed.error) {
-          logErr(parsed.error.trimEnd());
-          if (doExit) process.exit(1);
-          return { exitCode: 1, code: "USAGE", message: parsed.error };
-        }
-        if (parsed.out) outDir = parsed.out;
-        check = parsed.check;
-        force = parsed.force;
-      }
-      const files = deps.files || AGENT_HOST_FILES;
-      const relPaths = deps.paths || AGENT_HOST_PATHS;
-      if (check) {
-        let stale = false;
-        for (const rel of relPaths) {
-          const fp = path.join(outDir, rel);
-          const expected = files[rel];
-          if (!exists(fp)) {
-            logErr(chalk.red(`agent-setup --check: missing ${rel}`));
-            stale = true;
-            continue;
-          }
-          const onDisk = readFile(fp);
-          if (onDisk !== expected) {
-            logErr(chalk.red(`agent-setup --check: drift ${rel}`));
-            stale = true;
-          }
-        }
-        if (stale) {
-          logErr("Run: coderifts agent-setup --out " + outDir + " --force");
-          if (doExit) process.exit(1);
-          return { exitCode: 1, code: "DRIFT", outDir };
-        }
-        log(chalk.green(`agent-setup: up to date (${outDir}, ${relPaths.length} files)`));
-        if (doExit) process.exit(0);
-        return { exitCode: 0, code: "UP_TO_DATE", outDir };
-      }
-      const summary = { written: [], skipped: [], forced: [] };
-      for (const rel of relPaths) {
-        const fp = path.join(outDir, rel);
-        const content = files[rel];
-        if (exists(fp) && !force) {
-          summary.skipped.push(rel);
-          continue;
-        }
-        if (exists(fp) && force) summary.forced.push(rel);
-        writeFile(fp, content);
-        summary.written.push(rel);
-      }
-      if (!options.json) {
-        log(chalk.bold("CodeRifts agent-setup"));
-        log(`  target: ${outDir}`);
-        for (const rel of summary.written) {
-          const tag = summary.forced.includes(rel) ? "overwrote" : "wrote";
-          log(chalk.green(`  ${tag}:   ${rel}`));
-        }
-        for (const rel of summary.skipped) {
-          log(chalk.yellow(`  skipped: ${rel} (exists; use --force to overwrite)`));
-        }
-        log("");
-        log(chalk.dim(`  ${summary.written.length} written, ${summary.skipped.length} skipped`));
-        log("");
-        for (const line of AGENT_SETUP_WARN_TELEMETRY_LINES) {
-          log(line);
-        }
-        if (summary.skipped.includes(".claude/settings.json")) {
-          for (const line of AGENT_SETUP_HOOK_SKIP_LINES) {
-            log(line);
-          }
-        } else if (summary.written.includes(".claude/settings.json")) {
-          for (const line of AGENT_SETUP_HOOK_WIRE_LINES) {
-            log(line);
-          }
-        }
-      }
-      if (doExit) process.exit(0);
-      return { exitCode: 0, code: "OK", outDir, ...summary };
-    }
-    var AGENT_SETUP_WARN_TELEMETRY_LINES = Object.freeze([
-      chalk.bold("  Execution-state recheck (guard@8): DEFAULT ON"),
-      chalk.dim("  requireExecutionStateMatch absent/true \u2192 enforce: mismatch \u2192 EXECUTION_STATE_DRIFT"),
-      chalk.dim("  (factory does not run); missing fingerprint/artifacts \u2192 EXECUTION_STATE_UNMEASURABLE (STOP)."),
-      chalk.dim("  Opt-down: requireExecutionStateMatch: 'warn' (emit, then run unenforced on mismatch)"),
-      chalk.dim("  or false (no recheck \u2014 v7 proceed-on-drift). Must be set explicitly."),
-      chalk.dim("  Warn emits (then PROCEEDS \u2014 never blocks in warn mode):"),
-      chalk.dim("    \xB7 real drift \u2192 execution_state_drift_observed (loud)"),
-      chalk.dim("    \xB7 missing artifacts/fingerprint \u2192 execution_state_unmeasurable (quiet)"),
-      chalk.dim("  Merge gate block is separate: coderifts setup-required-check --apply")
-    ]);
-    var AGENT_SETUP_HOOK_WIRE_LINES = Object.freeze([
-      chalk.bold("  Claude Code hook (.claude/settings.json): fail-closed PreToolUse"),
-      chalk.dim("  matcher Write|Edit|MultiEdit \u2192 coderifts claude-hook (exit 2 = BLOCK)."),
-      chalk.dim("  Missing key / API down / unreadable spec \u2192 exit 2 (enforce_indeterminate), not ALLOW."),
-      chalk.dim("  Opt-out: CODERIFTS_ADVISORY=1|true restores soft-allow when governance could not run."),
-      chalk.dim("  CODERIFTS_STRICT=1 cannot be weakened by ADVISORY.")
-    ]);
-    var AGENT_SETUP_HOOK_SKIP_LINES = Object.freeze([
-      chalk.yellow("  .claude/settings.json exists \u2014 left unchanged (installer does not merge)."),
-      chalk.dim("  --force replaces the ENTIRE file (not just the PreToolUse hook)."),
-      chalk.dim("  To wire fail-closed: add PreToolUse \u2192 coderifts claude-hook by hand, or --force."),
-      chalk.dim("  Opt-out if wired: CODERIFTS_ADVISORY=1|true. CODERIFTS_STRICT cannot weaken.")
-    ]);
-    module2.exports = {
-      runAgentSetup,
-      parseAgentSetupArgs,
-      AGENT_HOST_FILES,
-      AGENT_HOST_PATHS,
-      USAGE,
-      AGENT_SETUP_WARN_TELEMETRY_LINES,
-      AGENT_SETUP_HOOK_WIRE_LINES,
-      AGENT_SETUP_HOOK_SKIP_LINES
-    };
-  }
-});
-
 // src/copilot-mcp.embedded.js
 var require_copilot_mcp_embedded = __commonJS({
   "src/copilot-mcp.embedded.js"(exports2, module2) {
@@ -237329,6 +238763,130 @@ var require_outcome = __commonJS({
   }
 });
 
+// src/commands/cursor-hook.js
+var require_cursor_hook = __commonJS({
+  "src/commands/cursor-hook.js"(exports2, module2) {
+    "use strict";
+    var { runClaudeHook } = require_claude_hook();
+    var USAGE = `Usage: coderifts cursor-hook
+
+Cursor preToolUse adapter. Reads Cursor's hook JSON on stdin, emits
+{ permission, user_message, agent_message } on stdout.
+
+  allow  -> the mutation proceeds (non-governed paths are silent)
+  deny   -> the mutation is blocked; user_message carries the WHY,
+            agent_message carries the remediation
+
+REQUIRE_APPROVAL maps to deny: Cursor does not enforce "ask" for preToolUse,
+so surfacing it as ask would let a human-approval decision through.
+Unparseable stdin denies (fail-closed).
+`;
+    var CURSOR_WRITE_TOOLS = Object.freeze(["Write", "Delete"]);
+    var CURSOR_MATCHER = CURSOR_WRITE_TOOLS.join("|");
+    function parseCursorStdin(raw) {
+      if (raw == null || String(raw).trim() === "") return { ok: false, reason: "empty stdin" };
+      let obj;
+      try {
+        obj = JSON.parse(String(raw));
+      } catch (_) {
+        return { ok: false, reason: "stdin is not JSON" };
+      }
+      if (!obj || typeof obj !== "object" || Array.isArray(obj)) {
+        return { ok: false, reason: "stdin JSON is not an object" };
+      }
+      const toolName = typeof obj.tool_name === "string" ? obj.tool_name : null;
+      if (!toolName) return { ok: false, reason: "missing tool_name" };
+      const toolInput = obj.tool_input && typeof obj.tool_input === "object" && !Array.isArray(obj.tool_input) ? obj.tool_input : null;
+      if (!toolInput) return { ok: false, reason: "missing tool_input" };
+      return { ok: true, payload: obj, toolName, toolInput };
+    }
+    function toClaudeShape(toolName, toolInput) {
+      const filePath = toolInput.file_path || toolInput.path || toolInput.target_file || null;
+      const content = toolInput.content !== void 0 ? toolInput.content : toolInput.contents !== void 0 ? toolInput.contents : void 0;
+      const out = { ...toolInput };
+      if (filePath) out.file_path = filePath;
+      if (content !== void 0) out.content = content;
+      if (toolName === "Delete" && out.content === void 0) out.content = "";
+      return { tool_name: toolName === "Delete" ? "Write" : "Write", tool_input: out };
+    }
+    function emit(permission, { userMessage, agentMessage } = {}, deps = {}) {
+      const write = deps.stdout || ((s) => process.stdout.write(s));
+      const body = { permission };
+      if (permission === "deny") {
+        body.user_message = userMessage || "CodeRifts blocked this change.";
+        body.agent_message = agentMessage || "Blocked by CodeRifts. Do not retry the same change.";
+      }
+      write(`${JSON.stringify(body)}
+`);
+      return permission === "deny" ? 2 : 0;
+    }
+    function denyMessages(whyText, detail = {}) {
+      const decision = detail.decision || null;
+      const severity = detail.severity || null;
+      const head = decision ? `CodeRifts ${decision}: this change is not authorized.` : "CodeRifts blocked this change.";
+      const body = String(whyText || "").trim();
+      const userMessage = body || `${head}${detail.reason ? ` (${detail.reason})` : ""}`;
+      const agentMessage = severity === "REQUIRE_APPROVAL" ? `${head} A human must approve this change. Do not retry the same edit and do not claim approval yourself.` : `${head} Do not retry the same edit. Address the reasons in the block above, then re-run preflight.`;
+      return { userMessage, agentMessage };
+    }
+    async function runCursorHook(o = {}) {
+      const argv = Array.isArray(o.argv) ? o.argv : [];
+      const deps = o.deps || {};
+      if (argv.includes("--help") || argv.includes("-h")) {
+        (deps.stdout || ((s) => process.stdout.write(s)))(USAGE);
+        return 0;
+      }
+      const parsed = parseCursorStdin(o.stdin);
+      if (!parsed.ok) {
+        return emit("deny", {
+          userMessage: `CodeRifts could not read the Cursor hook payload (${parsed.reason}) \u2014 refusing (fail-closed).`,
+          agentMessage: "CodeRifts could not evaluate this action and refused it. Do not retry blindly; check the hook installation."
+        }, deps);
+      }
+      if (!CURSOR_WRITE_TOOLS.includes(parsed.toolName)) {
+        return emit("allow", {}, deps);
+      }
+      const claudeStdin = JSON.stringify(toClaudeShape(parsed.toolName, parsed.toolInput));
+      const whyLines = [];
+      let detail;
+      try {
+        detail = await runClaudeHook(
+          { argv: [], env: o.env || process.env },
+          {
+            ...deps.inner || {},
+            readStdin: () => claudeStdin,
+            errLog: (m) => {
+              whyLines.push(String(m));
+            },
+            env: o.env || process.env
+          }
+        );
+      } catch (err) {
+        return emit("deny", {
+          userMessage: `CodeRifts hook error: ${err && err.message} \u2014 refusing (fail-closed).`,
+          agentMessage: "The CodeRifts hook failed to evaluate this action. It was refused rather than allowed."
+        }, deps);
+      }
+      const d = detail && typeof detail === "object" ? detail : {};
+      const exitCode = Number.isFinite(d.exitCode) ? d.exitCode : 0;
+      if (exitCode === 2) {
+        return emit("deny", denyMessages(whyLines.join("\n"), d), deps);
+      }
+      return emit("allow", {}, deps);
+    }
+    module2.exports = {
+      runCursorHook,
+      parseCursorStdin,
+      toClaudeShape,
+      denyMessages,
+      emit,
+      CURSOR_WRITE_TOOLS,
+      CURSOR_MATCHER,
+      USAGE
+    };
+  }
+});
+
 // corpus/vectors-mcp-fpfn.json
 var require_vectors_mcp_fpfn = __commonJS({
   "corpus/vectors-mcp-fpfn.json"(exports2, module2) {
@@ -239006,7 +240564,37 @@ program.command("registry-gate [dir]").description("Admit a directory of OpenAPI
   process.exitCode = code;
   process.exit(code);
 });
-program.command("init [template]").description("Generate a .coderifts.yml from a policy template (startup, growth, fintech, public-api, microservices)").action(async (template) => {
+program.command("init [template]").description("Generate a .coderifts.yml from a policy template, or wire governed agent work (--agents)").option("--agents", "Wire this repo for governed agent work (MCP config, rule files, host hook, CI gate)").option("--hosts <list>", "With --agents: claude, cursor, or all (default: all)", "all").option("--no-hook", "With --agents: skip host hook install").option("--no-workflow", "With --agents: skip writing .github/workflows/coderifts.yml").option("--dry-run", "With --agents: print the plan without writing").option("--check", "With --agents: report which of the four pieces are present (no write)").option("--out <dir>", "With --agents: target directory (default: cwd)").action(async (template, options) => {
+  const {
+    runInitAgents,
+    agentFlagsRequireAgents,
+    AGENT_FLAGS_REQUIRE_AGENTS,
+    AGENTS_NO_TEMPLATE
+  } = require_init_agents();
+  if (options.agents) {
+    if (template) {
+      console.error(AGENTS_NO_TEMPLATE);
+      process.exitCode = 1;
+      return;
+    }
+    const result = runInitAgents({
+      hosts: options.hosts,
+      hook: options.hook,
+      workflow: options.workflow,
+      dryRun: !!options.dryRun,
+      check: !!options.check,
+      out: options.out
+    });
+    if (result && typeof result.exitCode === "number") {
+      process.exitCode = result.exitCode;
+    }
+    return;
+  }
+  if (agentFlagsRequireAgents(options)) {
+    console.error(AGENT_FLAGS_REQUIRE_AGENTS);
+    process.exitCode = 1;
+    return;
+  }
   const { init } = require_init2();
   await init(template);
 });
@@ -239031,12 +240619,13 @@ program.command("status [repo]").description("Show cross-layer enforcement statu
     process.exitCode = result.exitCode;
   }
 });
-program.command("enforce [repo]").description("Close enforcement gaps by chaining setup-required-check / hook / deploy guidance (dry-run default; use --apply to mutate)").option("--repo <owner/repo>", "Repository (owner/repo); also accepted as a positional argument").option("--apply", "Actually run underlying setup commands (default: dry-run only)").option("--json", "Machine-readable JSON result").action(async (repoPositional, options) => {
+program.command("enforce [repo]").description("Close enforcement gaps (dry-run default), or --check to query provider-native pipeline protection evidence").option("--repo <owner/repo>", "Repository (owner/repo); also accepted as a positional argument").option("--apply", "Actually run underlying setup commands (default: dry-run only)").option("--check", "Query GitHub + local workflows; report VERIFIED / NOT_VERIFIED / UNVERIFIABLE (read-only)").option("--env <name>", "With --check: GitHub Environment name to query for protection rules").option("--branch <name>", "With --check: branch to query (default: repository default branch)").option("--provider <name>", "With --check: provider adapter (github only; others UNVERIFIABLE, never stubbed)", "github").option("--json", "Machine-readable JSON result").action(async (repoPositional, options) => {
   const { runEnforce } = require_enforce();
   const result = await runEnforce({
     ...options,
     repo: options.repo || repoPositional || null,
-    apply: !!options.apply
+    apply: !!options.apply,
+    check: !!options.check
   });
   if (result && typeof result.exitCode === "number") {
     process.exitCode = result.exitCode;
@@ -239103,11 +240692,31 @@ ${USAGE}
     process.exitCode = result.exitCode;
   }
 });
+program.command("cursor-hook").description(
+  'Cursor preToolUse gate: deny contract-touching Write|Delete on BLOCK/STOP/REQUEST_APPROVAL. Emits {permission,user_message,agent_message} on stdout. Cursor does not enforce "ask" for preToolUse, so REQUEST_APPROVAL maps to deny. Fail-closed on unparseable stdin.'
+).addHelpText("after", () => {
+  const { USAGE } = require_cursor_hook();
+  return `
+${USAGE}
+`;
+}).action(async () => {
+  const { runCursorHook } = require_cursor_hook();
+  const fsMod = require("fs");
+  let stdin = "";
+  try {
+    stdin = fsMod.readFileSync(0, "utf8");
+  } catch {
+    stdin = "";
+  }
+  const code = await runCursorHook({ argv: process.argv.slice(3), stdin });
+  if (typeof code === "number") process.exitCode = code;
+});
 var hookCmd = program.command("hook").description("Manage the CodeRifts pre-push Git hook");
-hookCmd.command("install").description("Install the CodeRifts pre-push hook in the current Git repo").option("--claude", "Write Claude Code PreToolUse hook to .claude/settings.json (JSON-merge)").option("--global", "With --claude: write ~/.claude/settings.json instead of the project file").option("--log <path>", "With --claude: embed CODERIFTS_GUARD_EVENT_LOG and CODERIFTS_SESSION_ID in the command").action((options) => {
+hookCmd.command("install").description("Install the CodeRifts pre-push hook in the current Git repo").option("--claude", "Write Claude Code PreToolUse hook to .claude/settings.json (JSON-merge)").option("--cursor", "Write Cursor preToolUse hook to .cursor/hooks.json (JSON-merge, failClosed:true)").option("--global", "With --claude/--cursor: write the ~/ config instead of the project file").option("--log <path>", "With --claude/--cursor: embed CODERIFTS_GUARD_EVENT_LOG and CODERIFTS_SESSION_ID in the command").action((options) => {
   const { install } = require_hook();
   install({
     claude: !!options.claude,
+    cursor: !!options.cursor,
     global: !!options.global,
     log: options.log
   });