coderifts 4.7.0 → 4.9.0

package/dist/cli.js

@@ -3028,7 +3028,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "4.7.0",
+      version: "4.9.0",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -74363,7 +74363,7 @@ var require_claude_hook = __commonJS({
       "Parse-gap DEFAULT (exit 2): unparseable stdin / missing file_path \u2014 refusing (fail-closed);",
       "  set CODERIFTS_ADVISORY=1 to soften. JSONL hook_blocked cause stdin_unparseable|missing_file_path.",
       "",
-      "Still exit 0 (nothing to govern): non-spec path, identical content.",
+      "Still exit 0 (nothing to govern): non-spec path, identical content, non-governed tool.",
       "",
       "CONTINUE_WITH_MONITORING: allow only if the host asserts a sink",
       "  (CODERIFTS_MONITORING_SINK_WIRED=1|true or git config coderifts.monitoringSinkWired).",
@@ -74504,6 +74504,42 @@ var require_claude_hook = __commonJS({
       if (fromGit) return fromGit;
       return DEFAULT_SPEC_PATH;
     }
+    var GOVERNED_TOOLS = /* @__PURE__ */ new Set(["write", "edit", "multiedit", "multi_edit"]);
+    function isGovernedTool(name) {
+      return GOVERNED_TOOLS.has(String(name || "").toLowerCase());
+    }
+    function pickToolField(obj, ...keys) {
+      if (!obj || typeof obj !== "object" || Array.isArray(obj)) return void 0;
+      for (const k of keys) {
+        if (!Object.prototype.hasOwnProperty.call(obj, k)) continue;
+        const v = obj[k];
+        if (v === void 0 || v === null) continue;
+        return v;
+      }
+      return void 0;
+    }
+    function filePathFromInput(toolInput) {
+      const v = pickToolField(toolInput, "file_path", "filePath", "path", "target_file", "targetFile");
+      return typeof v === "string" && v !== "" ? v : void 0;
+    }
+    function contentFromInput(toolInput) {
+      const v = pickToolField(toolInput, "content", "contents");
+      return typeof v === "string" ? v : void 0;
+    }
+    function coerceToolInput(value) {
+      if (value && typeof value === "object" && !Array.isArray(value)) return value;
+      if (typeof value === "string") {
+        const t = value.trim();
+        if (!t) return null;
+        try {
+          const parsed = JSON.parse(t);
+          if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
+        } catch {
+          return null;
+        }
+      }
+      return null;
+    }
     function parseStdinJson(raw) {
       if (raw == null || String(raw).trim() === "") {
         return { ok: false, reason: "empty stdin" };
@@ -74517,9 +74553,9 @@ var require_claude_hook = __commonJS({
       if (!obj || typeof obj !== "object" || Array.isArray(obj)) {
         return { ok: false, reason: "stdin JSON is not an object" };
       }
-      const toolName = obj.tool_name || obj.toolName || obj.name || null;
-      let toolInput = obj.tool_input || obj.toolInput || obj.input || null;
-      if (toolInput == null && obj.file_path) toolInput = obj;
+      const toolName = pickToolField(obj, "tool_name", "toolName", "name");
+      let toolInput = coerceToolInput(pickToolField(obj, "tool_input", "toolInput", "input"));
+      if (toolInput == null && filePathFromInput(obj)) toolInput = obj;
       if (!toolName || typeof toolName !== "string") {
         return { ok: false, reason: "missing tool_name" };
       }
@@ -74543,16 +74579,17 @@ var require_claude_hook = __commonJS({
       return false;
     }
     function deriveAfterContent(toolName, toolInput, diskBefore) {
-      const name = String(toolName || "");
-      if (name === "Write" || name === "write") {
-        if (typeof toolInput.content !== "string") {
+      const name = String(toolName || "").toLowerCase();
+      if (name === "write") {
+        const content = contentFromInput(toolInput);
+        if (typeof content !== "string") {
           return { ok: false, reason: "Write tool_input.content missing or not a string" };
         }
-        return { ok: true, after: toolInput.content };
+        return { ok: true, after: content };
       }
-      if (name === "Edit" || name === "edit") {
-        const oldS = toolInput.old_string != null ? toolInput.old_string : toolInput.oldString;
-        const newS = toolInput.new_string != null ? toolInput.new_string : toolInput.newString;
+      if (name === "edit") {
+        const oldS = pickToolField(toolInput, "old_string", "oldString");
+        const newS = pickToolField(toolInput, "new_string", "newString");
         if (typeof oldS !== "string" || typeof newS !== "string") {
           return { ok: false, reason: "Edit tool_input.old_string/new_string missing" };
         }
@@ -74561,16 +74598,16 @@ var require_claude_hook = __commonJS({
         }
         return { ok: true, after: diskBefore.replace(oldS, newS) };
       }
-      if (name === "MultiEdit" || name === "multi_edit" || name === "multiEdit") {
-        const edits = toolInput.edits || toolInput.Edits;
+      if (name === "multiedit" || name === "multi_edit") {
+        const edits = pickToolField(toolInput, "edits", "Edits");
         if (!Array.isArray(edits) || edits.length === 0) {
           return { ok: false, reason: "MultiEdit tool_input.edits missing or empty" };
         }
         let cur = diskBefore;
         for (let i = 0; i < edits.length; i++) {
           const e = edits[i] || {};
-          const oldS = e.old_string != null ? e.old_string : e.oldString;
-          const newS = e.new_string != null ? e.new_string : e.newString;
+          const oldS = pickToolField(e, "old_string", "oldString");
+          const newS = pickToolField(e, "new_string", "newString");
           if (typeof oldS !== "string" || typeof newS !== "string") {
             return { ok: false, reason: `MultiEdit edits[${i}] missing old_string/new_string` };
           }
@@ -74581,7 +74618,7 @@ var require_claude_hook = __commonJS({
         }
         return { ok: true, after: cur };
       }
-      return { ok: false, reason: `unsupported tool_name for content derive: ${name}` };
+      return { ok: false, reason: `unsupported tool_name for content derive: ${toolName}` };
     }
     function isV2DecisionBody(d, dr) {
       if (dr && typeof dr === "object") return true;
@@ -74742,18 +74779,6 @@ var require_claude_hook = __commonJS({
         }
         return r;
       };
-      const apiKey = resolveApiKey({ ...deps, cwd, env });
-      if (!apiKey) {
-        logEv({ type: "preflight_unavailable", cause: "missing_api_key" });
-        return emitTerminal(failClosedOrAdvisory({
-          advisory,
-          strict,
-          site: "missing_api_key",
-          why: "no API key",
-          softMsg: "CodeRifts claude-hook: no API key (coderifts login / CODERIFTS_API_KEY / git config coderifts.apiKey) \u2014 allowing",
-          errLog
-        }));
-      }
       const PARSE_GAP_STDERR = "unparseable input \u2014 refusing (fail-closed); set CODERIFTS_ADVISORY=1 to soften";
       const raw = typeof options.stdin === "string" ? options.stdin : readStdin();
       const parsed = parseStdinJson(raw);
@@ -74767,7 +74792,11 @@ var require_claude_hook = __commonJS({
       }
       const { toolName, toolInput } = parsed;
       tool = toolName;
-      const filePath = toolInput.file_path || toolInput.filePath || toolInput.path;
+      if (!isGovernedTool(toolName)) {
+        logEv({ type: "detection_skip", signals: ["not_governed_tool"], tool });
+        return emitTerminal({ exitCode: 0, reason: "not_governed_tool" });
+      }
+      const filePath = filePathFromInput(toolInput);
       if (!filePath || typeof filePath !== "string") {
         if (advisory && !strict) {
           errLog("CodeRifts claude-hook: tool_input.file_path missing \u2014 allowing (CODERIFTS_ADVISORY)");
@@ -74782,6 +74811,18 @@ var require_claude_hook = __commonJS({
         logEv({ type: "detection_skip", signals: ["not_spec_path"], tool, path: filePath });
         return emitTerminal({ exitCode: 0, reason: "not_spec_path" });
       }
+      const apiKey = resolveApiKey({ ...deps, cwd, env });
+      if (!apiKey) {
+        logEv({ type: "preflight_unavailable", cause: "missing_api_key" });
+        return emitTerminal(failClosedOrAdvisory({
+          advisory,
+          strict,
+          site: "missing_api_key",
+          why: "no API key",
+          softMsg: "CodeRifts claude-hook: no API key (coderifts login / CODERIFTS_API_KEY / git config coderifts.apiKey) \u2014 allowing",
+          errLog
+        }));
+      }
       const absPath = path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
       let diskBefore = "";
       if (exists(absPath)) {
@@ -74941,6 +74982,11 @@ var require_claude_hook = __commonJS({
     module2.exports = {
       runClaudeHook,
       parseStdinJson,
+      pickToolField,
+      filePathFromInput,
+      contentFromInput,
+      isGovernedTool,
+      coerceToolInput,
       isSpecPath,
       deriveAfterContent,
       mapDecisionSeverity,
@@ -142589,6 +142635,13 @@ var require_key_store = __commonJS({
     function findByPrefix(prefix) {
       return keyRecords.find((r) => r.keyPrefix === prefix) || null;
     }
+    function findAllByPrefix(prefix) {
+      if (!prefix || typeof prefix !== "string") return [];
+      return keyRecords.filter((r) => r.keyPrefix === prefix);
+    }
+    function isFullKeyToken(token) {
+      return typeof token === "string" && token.length > 12;
+    }
     function findRecordByKey(key) {
       if (!key || typeof key !== "string") return null;
       const prefix = getKeyPrefix(key);
@@ -142672,14 +142725,38 @@ var require_key_store = __commonJS({
     function _setGenerateKeyStringForTest(fn) {
       _generateKeyStringForTest = typeof fn === "function" ? fn : null;
     }
-    function deleteByPrefix(prefix, ownerEmail) {
-      const idx = keyRecords.findIndex((r) => r.keyPrefix === prefix);
+    function deleteRecord(record, ownerEmail) {
+      const idx = keyRecords.indexOf(record);
       if (idx === -1) return false;
       if (ownerEmail && keyRecords[idx].owner !== ownerEmail) return false;
       keyRecords.splice(idx, 1);
       saveKeys();
       return true;
     }
+    function revokeKey({ token, ownerEmail } = {}) {
+      const raw = typeof token === "string" ? token : "";
+      if (!raw) return { ok: false, code: "not_found", count: 0 };
+      if (isFullKeyToken(raw)) {
+        const rec = findRecordByKey(raw);
+        if (!rec) return { ok: false, code: "not_found", count: 0 };
+        if (!deleteRecord(rec, ownerEmail || null)) {
+          return { ok: false, code: "unauthorized", count: 1, prefix: rec.keyPrefix };
+        }
+        return { ok: true, code: "deleted", count: 1, prefix: rec.keyPrefix };
+      }
+      const matches = findAllByPrefix(raw);
+      if (matches.length === 0) return { ok: false, code: "not_found", count: 0 };
+      if (matches.length > 1) {
+        return { ok: false, code: "ambiguous", count: matches.length, prefix: raw };
+      }
+      if (!deleteRecord(matches[0], ownerEmail || null)) {
+        return { ok: false, code: "unauthorized", count: 1, prefix: raw };
+      }
+      return { ok: true, code: "deleted", count: 1, prefix: raw };
+    }
+    function deleteByPrefix(prefix, ownerEmail) {
+      return revokeKey({ token: prefix, ownerEmail }).ok === true;
+    }
     module2.exports = {
       createKey,
       hasKey,
@@ -142689,7 +142766,9 @@ var require_key_store = __commonJS({
       listKeysByOwner,
       deleteByPrefix,
       findByPrefix,
+      findAllByPrefix,
       findRecordByKey,
+      revokeKey,
       FREE_TIER_REQUESTS_PER_MONTH,
       FREE_TIER_REQUESTS_PER_MINUTE,
       PREFIX_REGENERATE_ATTEMPTS,
@@ -198815,9 +198894,10 @@ var require_remediation_taxonomy = __commonJS({
           break;
         }
         case "COVERAGE_GAP": {
-          target = "analysis";
+          const detail = str(pattern && pattern.description) || str(pattern && pattern.error);
+          target = str(pattern && pattern.affected_path) || "analysis";
           target_ref = {};
-          instruction = "Do not treat this as a schema edit: restore analyzable artifacts / wait for coverage; re-preflight when analysis is complete.";
+          instruction = detail ? `fix the spec: ${detail}` : "Do not treat this as a schema edit: restore analyzable artifacts / wait for coverage; re-preflight when analysis is complete.";
           break;
         }
         default: {
@@ -198872,6 +198952,21 @@ var require_remediation_taxonomy = __commonJS({
       if (patterns.length > 0) {
         return patterns.map((pattern) => remediationFromDetection({ pattern, ir: null }));
       }
+      const degradedReasons = Array.isArray(verdict.degraded_reasons) ? verdict.degraded_reasons : [];
+      if (degradedReasons.length > 0) {
+        return degradedReasons.map((r) => {
+          const msg = r && (r.message || r.code) ? String(r.message || r.code) : "analysis incomplete";
+          return remediationFromDetection({
+            pattern: {
+              name: "COVERAGE_GAP",
+              degraded: true,
+              description: msg,
+              affected_path: r && r.code || "analysis"
+            },
+            ir: null
+          });
+        });
+      }
       if (verdict.coverage_gap === true || verdict.degraded === true) {
         return [remediationFromDetection({ pattern: { name: "COVERAGE_GAP", degraded: true }, ir: null })];
       }
@@ -200794,9 +200889,20 @@ var require_decision_result_v1_producer = __commonJS({
             source: {
               type: "string",
               enum: [
-                "github_compare"
+                "github_compare",
+                "gitlab_compare",
+                "bitbucket_compare"
               ],
-              description: "How the server listed the change-set. github_compare = GitHub Compare API via the App installation."
+              description: "How the server listed the change-set. github_compare = GitHub Compare API via the App installation. gitlab_compare / bitbucket_compare = platform Compare via a caller-supplied short-lived SCM token (never stored)."
+            },
+            platform: {
+              type: "string",
+              enum: [
+                "github",
+                "gitlab",
+                "bitbucket"
+              ],
+              description: "Additive P1-6. SCM platform that produced this SERVER_DERIVED set. Taken from the proven binding / context.platform \u2014 never guessed from the repository string. Absent on envelopes minted before this field existed."
             },
             base_sha: {
               type: "string",
@@ -201704,6 +201810,9 @@ var require_change_set_completeness = __commonJS({
       if (v == null) return "";
       return typeof v === "string" ? v : JSON.stringify(v);
     }
+    function afterContentHash(content) {
+      return sha256hexLocal(specStr(content));
+    }
     function artifactPath(artifact) {
       if (!artifact || typeof artifact !== "object") return "";
       if (typeof artifact.path === "string" && artifact.path.trim()) return artifact.path.trim();
@@ -202002,7 +202111,8 @@ var require_change_set_completeness = __commonJS({
         contract_selector_hash,
         completeness_count: normalizedLeaves.length,
         submitted_set_digest,
-        expected_channel: "webhook_full_file_list"
+        expected_channel: "webhook_full_file_list",
+        leaves: normalizedLeaves
       };
     }
     function assertCompletenessRequirement(block, requireLevel) {
@@ -202086,9 +202196,45 @@ var require_change_set_completeness = __commonJS({
         contract_selector_hash: computeContractSelectorHash(DEFAULT_CONTRACT_SELECTOR),
         completeness_count: leaves.length,
         submitted_set_digest,
-        expected_channel: null
+        expected_channel: null,
+        leaves
       };
     }
+    function authorizedPathsFromArtifacts(artifacts) {
+      const list = Array.isArray(artifacts) ? artifacts : [];
+      const seen = /* @__PURE__ */ new Set();
+      const rows = [];
+      for (const a of list) {
+        const path = artifactPath(a);
+        if (!path || seen.has(path)) continue;
+        seen.add(path);
+        rows.push({
+          path,
+          after_hex: sha256hexLocal(specStr(a && a.after)),
+          change_type: deriveChangeType(a && a.before, a && a.after)
+        });
+      }
+      return rows;
+    }
+    function authorizedPathsForPersist(block, artifacts) {
+      const submitted = authorizedPathsFromArtifacts(artifacts);
+      const leaves = block && Array.isArray(block.leaves) ? block.leaves : null;
+      if (!leaves || leaves.length === 0) return submitted;
+      const byPath = /* @__PURE__ */ new Map();
+      for (const L of leaves) {
+        if (!L || typeof L !== "object") continue;
+        const path = String(L.path == null ? "" : L.path).trim();
+        if (!path) continue;
+        const after_hex = String(L.after_hex == null ? "" : L.after_hex).replace(/^sha256:/i, "").toLowerCase();
+        if (!/^[0-9a-f]{64}$/.test(after_hex)) continue;
+        byPath.set(path, {
+          path,
+          after_hex,
+          change_type: normalizeChangeType(L.change_type)
+        });
+      }
+      return submitted.map((row) => byPath.get(row.path) || row);
+    }
     function completenessToEnvelopeFields(block) {
       if (!block || block.completeness_mode === "UNBOUND") {
         return {
@@ -202135,7 +202281,10 @@ var require_change_set_completeness = __commonJS({
       assertNoBooleanCompleteness,
       completenessRequiredError,
       sha256hexLocal,
-      specStr
+      specStr,
+      afterContentHash,
+      authorizedPathsFromArtifacts,
+      authorizedPathsForPersist
     };
   }
 });
@@ -202700,7 +202849,8 @@ var require_change_set = __commonJS({
       assertCompletenessRequirement,
       completenessToEnvelopeFields,
       applyProvenRepoBinding,
-      assertNoBooleanCompleteness
+      assertNoBooleanCompleteness,
+      authorizedPathsForPersist
     } = require_change_set_completeness();
     var { authorFingerprintBindingEnvelopeFields } = require_fingerprint_binding_gate();
     var NUL = "";
@@ -203427,6 +203577,7 @@ var require_change_set = __commonJS({
         }
       }
       const completenessEnvelope = completenessToEnvelopeFields(completenessBlock);
+      const authorizedPaths = preflightMode === "authorize" ? authorizedPathsForPersist(completenessBlock, artifacts) : [];
       const fingerprintBindingEnvelope = authorFingerprintBindingEnvelopeFields({
         preflightMode
       });
@@ -203488,6 +203639,7 @@ var require_change_set = __commonJS({
         // body_hash stays byte-identical. Covered by body_hash when set; NOT in fingerprint.
         ...input && input.derivation_meta && typeof input.derivation_meta === "object" ? { derivation: {
           source: String(input.derivation_meta.source || "github_compare"),
+          platform: String(input.derivation_meta.platform || "github"),
           base_sha: String(input.derivation_meta.base_sha || ""),
           head_sha: String(input.derivation_meta.head_sha || "")
         } } : {},
@@ -203682,6 +203834,12 @@ var require_change_set = __commonJS({
         }
       } catch (_) {
       }
+      if (preflightMode === "authorize" && Array.isArray(authorizedPaths) && authorizedPaths.length > 0) {
+        Object.defineProperty(out, "_authorized_paths", {
+          value: Object.freeze(authorizedPaths.map((r) => Object.freeze({ ...r }))),
+          enumerable: false
+        });
+      }
       return out;
     }
     module2.exports = {
@@ -206628,8 +206786,19 @@ var require_remediation_transaction = __commonJS({
       if (artifactIds.length > 0) scope.artifact_ids = artifactIds;
       return scope;
     }
+    function isDegradedContext(coreVerdict, context = {}) {
+      if (context.analysis_complete === false) return true;
+      if (Array.isArray(context.degraded_reasons) && context.degraded_reasons.length > 0) return true;
+      if (coreVerdict && coreVerdict.degraded === true) return true;
+      if (Array.isArray(coreVerdict && coreVerdict.degraded_reasons) && coreVerdict.degraded_reasons.length > 0) {
+        return true;
+      }
+      return false;
+    }
     function buildRemediationTransaction({ decision, fingerprint, coreVerdict, context = {} }) {
-      if (decision !== "BLOCK") return null;
+      const degraded = isDegradedContext(coreVerdict, context);
+      const emit = decision === "BLOCK" || decision === "REQUIRE_APPROVAL" || degraded;
+      if (!emit) return null;
       if (typeof fingerprint !== "string" || !fingerprint) return null;
       const verdictForTaxonomy = {
         ...coreVerdict && typeof coreVerdict === "object" ? coreVerdict : {}
@@ -206639,6 +206808,13 @@ var require_remediation_transaction = __commonJS({
           verdictForTaxonomy.detected_patterns = context.detectedPatterns;
         }
       }
+      if (degraded) {
+        verdictForTaxonomy.degraded = true;
+        const reasons = Array.isArray(context.degraded_reasons) && context.degraded_reasons.length ? context.degraded_reasons : verdictForTaxonomy.degraded_reasons;
+        if (Array.isArray(reasons) && reasons.length) {
+          verdictForTaxonomy.degraded_reasons = reasons;
+        }
+      }
       const required_changes = buildRemediations(verdictForTaxonomy);
       const profile = resolveFingerprintProfile(context);
       return {
@@ -206673,6 +206849,7 @@ var require_remediation_transaction = __commonJS({
       resolveFingerprintProfile,
       deriveRecheckScope,
       blockRequiredActionCore,
+      isDegradedContext,
       PROFILE_CRBUNDLE_V1,
       PROFILE_VERDICT_FP_V1,
       RESUBMISSION_UNCHANGED,
@@ -206848,7 +207025,7 @@ var require_decision_result = __commonJS({
       pattern_sources: null,
       // Control core for retrieval; null = not supplied (must never render as type none for BLOCK)
       required_action_core: null,
-      // ID850 v1 — BLOCK-only remediation transaction (null / omit on non-BLOCK)
+      // ID850 v1 — remediation transaction (null / omit on ALLOW/WARN with complete analysis)
       remediation_transaction: null,
       // ID637 v5 slice 4 — change-set completeness commitment (honest; not a proof on generic path).
       // SERVER-authored mode; body_hash covered. Never boolean completeness:true.
@@ -209804,6 +209981,7 @@ var require_mcp_repo_config = __commonJS({
         id: "claude",
         relPath: ".mcp.json",
         label: "Claude Code",
+        rootKey: "mcpServers",
         // Measured: type+url required. url-without-type is a config error.
         entry: Object.freeze({
           type: "http",
@@ -209818,6 +209996,7 @@ var require_mcp_repo_config = __commonJS({
         id: "cursor",
         relPath: ".cursor/mcp.json",
         label: "Cursor",
+        rootKey: "mcpServers",
         // Measured: url only — Cursor docs do not use type for remote HTTP.
         entry: Object.freeze({
           url: MCP_URL,
@@ -209826,8 +210005,24 @@ var require_mcp_repo_config = __commonJS({
           })
         }),
         shapeNote: "mcpServers.coderifts url (no type \u2014 Cursor remote form)"
+      }),
+      copilot: Object.freeze({
+        id: "copilot",
+        relPath: ".vscode/mcp.json",
+        label: "GitHub Copilot / VS Code",
+        // Measured: THIRD variant — root key is `servers`, not mcpServers.
+        rootKey: "servers",
+        entry: Object.freeze({
+          type: "http",
+          url: MCP_URL,
+          headers: Object.freeze({
+            Authorization: "Bearer ${env:CODERIFTS_API_KEY}"
+          })
+        }),
+        shapeNote: "servers.coderifts type=http url (root key servers, not mcpServers)"
       })
     });
+    var MCP_HOST_IDS = Object.freeze(Object.keys(MCP_HOSTS));
     function deepEqual(a, b) {
       if (a === b) return true;
       try {
@@ -209836,25 +210031,26 @@ var require_mcp_repo_config = __commonJS({
         return false;
       }
     }
-    function planMcpMerge(existing, entry) {
+    function planMcpMerge(existing, entry, rootKey = "mcpServers") {
+      const key = rootKey || "mcpServers";
       const hadFile = existing != null;
       const base = existing && typeof existing === "object" && !Array.isArray(existing) ? existing : {};
-      const servers = base.mcpServers && typeof base.mcpServers === "object" && !Array.isArray(base.mcpServers) ? base.mcpServers : {};
-      const current = Object.prototype.hasOwnProperty.call(servers, SERVER_NAME) ? servers[SERVER_NAME] : void 0;
+      const group = base[key] && typeof base[key] === "object" && !Array.isArray(base[key]) ? base[key] : {};
+      const current = Object.prototype.hasOwnProperty.call(group, SERVER_NAME) ? group[SERVER_NAME] : void 0;
       if (deepEqual(current, entry)) {
         return { action: "skip", next: null, reason: "already present, identical" };
       }
       const next = {
         ...base,
-        mcpServers: {
-          ...servers,
+        [key]: {
+          ...group,
           [SERVER_NAME]: entry
         }
       };
       if (!hadFile) {
         return { action: "create", next, reason: "created" };
       }
-      const reason = current === void 0 ? "added mcpServers.coderifts; preserved other servers" : "updated mcpServers.coderifts; preserved other servers";
+      const reason = current === void 0 ? `added ${key}.coderifts; preserved other servers` : `updated ${key}.coderifts; preserved other servers`;
       return { action: "merge", next, reason };
     }
     function serializeMcp(doc) {
@@ -209923,7 +210119,7 @@ var require_mcp_repo_config = __commonJS({
           existing = {};
         }
       }
-      const plan = planMcpMerge(existing, host.entry);
+      const plan = planMcpMerge(existing, host.entry, host.rootKey);
       if (plan.action === "skip") {
         return { action: "skip", relPath: host.relPath, reason: plan.reason, exitCode: 0 };
       }
@@ -209960,7 +210156,7 @@ var require_mcp_repo_config = __commonJS({
       if (!exists(fp)) return false;
       try {
         const doc = JSON.parse(readFile(fp));
-        return planMcpMerge(doc, host.entry).action === "skip";
+        return planMcpMerge(doc, host.entry, host.rootKey).action === "skip";
       } catch {
         return false;
       }
@@ -209969,6 +210165,7 @@ var require_mcp_repo_config = __commonJS({
       MCP_URL,
       SERVER_NAME,
       MCP_HOSTS,
+      MCP_HOST_IDS,
       planMcpMerge,
       serializeMcp,
       writeHostMcpConfig,
@@ -210084,6 +210281,7 @@ var require_init_agents = __commonJS({
     var { installClaudeHook, installCursorHook } = require_hook();
     var {
       MCP_HOSTS,
+      MCP_HOST_IDS,
       writeHostMcpConfig,
       mcpConfigPresent
     } = require_mcp_repo_config();
@@ -210095,15 +210293,15 @@ var require_init_agents = __commonJS({
       workflowPresent
     } = require_contract_gate_workflow();
     if (process.env.NO_COLOR) chalk.level = 0;
-    var USAGE = `Usage: coderifts init --agents [--hosts=claude,cursor,all] [--no-hook] [--no-workflow] [--dry-run] [--check] [--out <dir>]
+    var USAGE = `Usage: coderifts init --agents [--hosts=claude,cursor,copilot,all] [--no-hook] [--no-workflow] [--dry-run] [--check] [--out <dir>]
 
   Wire this repository for governed agent work in ONE command:
-    1. repo-level MCP config (per host: .mcp.json / .cursor/mcp.json)
+    1. repo-level MCP config (per host: .mcp.json / .cursor/mcp.json / .vscode/mcp.json)
     2. generated agent rule files (reuses agent-setup)
-    3. host hook (Claude Code today; Cursor when hook install --cursor is present)
+    3. host hook (Claude Code / VS Code Copilot via .claude/settings.json; Cursor via .cursor/hooks.json)
     4. .github/workflows/coderifts.yml (coderifts/contract-gate@v0)
 
-  --hosts <list>   claude, cursor, or all (default: all)
+  --hosts <list>   claude, cursor, copilot, or all (default: all)
   --no-hook        Skip host hook install
   --no-workflow    Skip writing the CI workflow
   --dry-run        Print the plan without writing
@@ -210114,7 +210312,8 @@ var require_init_agents = __commonJS({
     var SHARED_RULE = "AGENTS.md";
     var HOST_RULES = Object.freeze({
       claude: Object.freeze(["CLAUDE.md"]),
-      cursor: Object.freeze([".cursor/rules/coderifts.mdc"])
+      cursor: Object.freeze([".cursor/rules/coderifts.mdc"]),
+      copilot: Object.freeze([".github/copilot-instructions.md"])
     });
     var EXTRA_RULES_ON_ALL = Object.freeze([
       ".github/copilot-instructions.md",
@@ -210134,27 +210333,28 @@ var require_init_agents = __commonJS({
       "    \xB7 write Gemini MCP config (Gemini uses httpUrl at extension level, not a repo file)"
     ]);
     function parseHosts(raw) {
+      const allHosts = [...MCP_HOST_IDS];
       if (raw == null || raw === true || String(raw).trim() === "") {
-        return { hosts: ["claude", "cursor"], allRules: true };
+        return { hosts: allHosts, allRules: true };
       }
       const parts = String(raw).split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
       if (parts.length === 0) {
-        return { hosts: ["claude", "cursor"], allRules: true, error: `init --agents: --hosts requires a value
+        return { hosts: allHosts, allRules: true, error: `init --agents: --hosts requires a value
 ${USAGE}` };
       }
-      const allowed = /* @__PURE__ */ new Set(["claude", "cursor", "all"]);
+      const allowed = /* @__PURE__ */ new Set([...MCP_HOST_IDS, "all"]);
       for (const p of parts) {
         if (!allowed.has(p)) {
           return {
             hosts: [],
             allRules: false,
-            error: `init --agents: unknown host "${p}" (use claude, cursor, all)
+            error: `init --agents: unknown host "${p}" (use claude, cursor, copilot, all)
 ${USAGE}`
           };
         }
       }
       if (parts.includes("all")) {
-        return { hosts: ["claude", "cursor"], allRules: true };
+        return { hosts: allHosts, allRules: true };
       }
       const hosts = [];
       for (const p of parts) {
@@ -210186,7 +210386,25 @@ ${USAGE}`
       return hostId === "cursor" ? ".cursor/hooks.json" : ".claude/settings.json";
     }
     function hookNoteForHost(hostId) {
-      return hostId === "cursor" ? "preToolUse \u2192 coderifts cursor-hook" : "PreToolUse \u2192 coderifts claude-hook";
+      if (hostId === "cursor") return "preToolUse \u2192 coderifts cursor-hook";
+      if (hostId === "copilot") {
+        return "PreToolUse \u2192 coderifts claude-hook (VS Code reads .claude/settings.json by default)";
+      }
+      return "PreToolUse \u2192 coderifts claude-hook";
+    }
+    function hookInstallerForHost(hostId) {
+      return hostId === "cursor" ? installCursorHook : installClaudeHook;
+    }
+    function uniqueHookHosts(hosts) {
+      const seen = /* @__PURE__ */ new Set();
+      const out = [];
+      for (const h of hosts) {
+        const rel = hookRelForHost(h);
+        if (seen.has(rel)) continue;
+        seen.add(rel);
+        out.push(h);
+      }
+      return out;
     }
     function wantHook(options) {
       if (options.noHook === true) return false;
@@ -210233,9 +210451,9 @@ ${USAGE}`
       const hooksMissing = [];
       const hooksWanted = wantHook(options);
       if (hooksWanted) {
-        for (const h of hosts) {
+        for (const h of uniqueHookHosts(hosts)) {
           const rel = hookRelForHost(h);
-          const installer = h === "cursor" ? installCursorHook : installClaudeHook;
+          const installer = hookInstallerForHost(h);
           const r = installer({ cwd: outDir, silent: true, dryRun: true });
           if (r && r.code === "NOOP") hooksPresent.push(rel);
           else hooksMissing.push(rel);
@@ -210366,7 +210584,7 @@ ${USAGE}`
         items.push({ section: "rules", action: "skip", relPath: rel, note: "exists; installer does not overwrite" });
       }
       if (!wantHook(options)) {
-        for (const h of hosts) {
+        for (const h of uniqueHookHosts(hosts)) {
           items.push({
             section: "hooks",
             action: "skip",
@@ -210375,8 +210593,8 @@ ${USAGE}`
           });
         }
       } else {
-        for (const h of hosts) {
-          const installer = h === "cursor" ? installCursorHook : installClaudeHook;
+        for (const h of uniqueHookHosts(hosts)) {
+          const installer = hookInstallerForHost(h);
           const r = installer({
             cwd: outDir,
             silent: true,
@@ -237012,6 +237230,162 @@ var require_status = __commonJS({
   }
 });
 
+// src/provider/workflow-scan.js
+var require_workflow_scan = __commonJS({
+  "src/provider/workflow-scan.js"(exports2, module2) {
+    "use strict";
+    var yaml = require_js_yaml();
+    var CONTRACT_GATE_ACTION = "coderifts/contract-gate";
+    var DEPLOY_GATE_INVOCATION = /^(?:npx(?:\s+--yes)?\s+|npm\s+exec\s+|pnpm\s+(?:dlx|exec)\s+|yarn(?:\s+(?:dlx|exec))?\s+)?coderifts\s+deploy-gate(?:\s|$)/;
+    var NON_SHELL = /* @__PURE__ */ new Set(["python", "python3", "node", "ruby", "perl", "php", "pwsh", "powershell"]);
+    function isPinnedMajor(ref) {
+      const r = String(ref || "");
+      if (/^v\d+(\.\d+){0,2}$/.test(r)) return true;
+      if (/^[0-9a-f]{40}$/i.test(r)) return true;
+      return false;
+    }
+    function parseActionUses(uses) {
+      const raw = String(uses || "").trim();
+      const at = raw.lastIndexOf("@");
+      if (at <= 0) return { name: raw, ref: "", pinnedMajor: false };
+      return {
+        name: raw.slice(0, at),
+        ref: raw.slice(at + 1),
+        pinnedMajor: isPinnedMajor(raw.slice(at + 1))
+      };
+    }
+    function isContractGateUses(uses) {
+      const parsed = parseActionUses(uses);
+      return parsed.name === CONTRACT_GATE_ACTION && parsed.pinnedMajor === true;
+    }
+    function isExplicitlyDisabled(node) {
+      if (!node || typeof node !== "object" || !Object.prototype.hasOwnProperty.call(node, "if")) {
+        return false;
+      }
+      const ifVal = node.if;
+      if (ifVal === false || ifVal === 0 || ifVal === null) return true;
+      if (typeof ifVal === "string") {
+        const s = ifVal.trim().toLowerCase();
+        if (s === "false" || s === "0" || s === "" || s === "null") return true;
+        if (/^\$\{\{\s*(?:false|0|null)\s*\}\}$/.test(s)) return true;
+      }
+      return false;
+    }
+    function jobEnvironmentName(job) {
+      if (!job || typeof job !== "object") return null;
+      const env = job.environment;
+      if (typeof env === "string") {
+        const name = env.trim();
+        return name || null;
+      }
+      if (env && typeof env === "object" && typeof env.name === "string") {
+        const name = env.name.trim();
+        return name || null;
+      }
+      return null;
+    }
+    function isNonPosixShell(shell) {
+      if (shell == null || shell === "") return false;
+      const first = String(shell).trim().split(/\s+/)[0].replace(/^.*\//, "").toLowerCase();
+      return NON_SHELL.has(first);
+    }
+    function isDeployGateInvocation(run, shell) {
+      if (isNonPosixShell(shell)) return false;
+      const text = String(run || "");
+      let heredoc = null;
+      let quote = null;
+      for (const rawLine of text.split("\n")) {
+        let line = String(rawLine || "");
+        if (heredoc) {
+          if (line.trim() === heredoc) heredoc = null;
+          continue;
+        }
+        const hd = /<<[-]?\s*['"]?(\w+)['"]?/.exec(line);
+        if (hd) heredoc = hd[1];
+        if (quote) {
+          for (let i = 0; i < line.length; i++) {
+            const ch = line[i];
+            if (ch === quote && line[i - 1] !== "\\") {
+              quote = null;
+              break;
+            }
+          }
+          if (quote) continue;
+        }
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#")) continue;
+        let cmd = trimmed.replace(/^(?:\w+=\S+\s+)+/, "");
+        if (/^(echo|printf|cat|false|true|:)\b/.test(cmd)) {
+          for (let i = 0; i < cmd.length; i++) {
+            const ch = cmd[i];
+            if ((ch === "'" || ch === '"') && cmd[i - 1] !== "\\") {
+              quote = quote ? quote === ch ? null : quote : ch;
+            }
+          }
+          continue;
+        }
+        if (DEPLOY_GATE_INVOCATION.test(cmd)) return true;
+      }
+      return false;
+    }
+    function stepsOf(job) {
+      if (!job || typeof job !== "object") return [];
+      return Array.isArray(job.steps) ? job.steps : [];
+    }
+    function inspectJob(job) {
+      const out = {
+        contractGate: false,
+        deployGate: false,
+        environment: jobEnvironmentName(job),
+        disabled: isExplicitlyDisabled(job)
+      };
+      if (out.disabled) return out;
+      for (const step of stepsOf(job)) {
+        if (!step || typeof step !== "object") continue;
+        if (isExplicitlyDisabled(step)) continue;
+        if (step.uses != null && isContractGateUses(step.uses)) out.contractGate = true;
+        if (step.run != null && isDeployGateInvocation(step.run, step.shell)) out.deployGate = true;
+      }
+      return out;
+    }
+    function inspectWorkflowYaml(body) {
+      const empty = { contractGate: false, deployGate: false, deployEnvironments: [] };
+      let doc;
+      try {
+        doc = yaml.load(String(body || ""));
+      } catch {
+        return empty;
+      }
+      if (!doc || typeof doc !== "object" || Array.isArray(doc)) return empty;
+      const jobs = doc.jobs && typeof doc.jobs === "object" && !Array.isArray(doc.jobs) ? doc.jobs : null;
+      if (!jobs) return empty;
+      let contractGate = false;
+      let deployGate = false;
+      const deployEnvironments = [];
+      for (const name of Object.keys(jobs)) {
+        const info = inspectJob(jobs[name]);
+        if (info.contractGate) contractGate = true;
+        if (info.deployGate) {
+          deployGate = true;
+          if (info.environment) deployEnvironments.push(info.environment);
+        }
+      }
+      return { contractGate, deployGate, deployEnvironments };
+    }
+    module2.exports = {
+      CONTRACT_GATE_ACTION,
+      isPinnedMajor,
+      parseActionUses,
+      isContractGateUses,
+      isExplicitlyDisabled,
+      jobEnvironmentName,
+      isDeployGateInvocation,
+      inspectJob,
+      inspectWorkflowYaml
+    };
+  }
+});
+
 // src/provider/github-enforcement.js
 var require_github_enforcement = __commonJS({
   "src/provider/github-enforcement.js"(exports2, module2) {
@@ -237023,7 +237397,107 @@ var require_github_enforcement = __commonJS({
       extractRequiredContexts
     } = require_setup_required_check();
     var { GATE_ACTION } = require_contract_gate_workflow();
-    var EVIDENCE_SPEC = "provider-enforcement-evidence.v1";
+    var { inspectWorkflowYaml } = require_workflow_scan();
+    var EVIDENCE_SPEC = "provider-enforcement-evidence.v2";
+    var CODERIFTS_GITHUB_APP_SLUG = "coderifts";
+    var CODERIFTS_GITHUB_APP_ID = 2860592;
+    var REASON = Object.freeze({
+      ISSUER_BOUND: "issuer_bound",
+      NO_ISSUER_BINDING: "no_issuer_binding",
+      LEGACY_CONTEXTS_NO_ISSUER_BINDING: "legacy_contexts_no_issuer_binding",
+      ISSUER_APP_ID_MISMATCH: "issuer_app_id_mismatch",
+      ISSUER_APP_ID_UNRESOLVABLE: "issuer_app_id_unresolvable",
+      REQUIRED_CHECK_ABSENT: "required_check_absent",
+      ACTIVE_JOB: "active_job",
+      NO_ACTIVE_JOB: "no_active_job",
+      ENVIRONMENT_CORRELATED: "environment_correlated",
+      ENVIRONMENT_MISMATCH: "environment_mismatch"
+    });
+    function verifiedRequiresBinding(layer2) {
+      if (!layer2 || layer2.status !== STATUS.VERIFIED) return true;
+      if (layer2.id === "required_check") return layer2.reason_code === REASON.ISSUER_BOUND;
+      if (layer2.id === "workflow_contract_gate" || layer2.id === "workflow_deploy_gate") {
+        return layer2.reason_code === REASON.ACTIVE_JOB;
+      }
+      if (layer2.id === "environment_protection") {
+        return layer2.reason_code === REASON.ENVIRONMENT_CORRELATED;
+      }
+      return true;
+    }
+    function expectedIssuerAppId() {
+      const id = Number(CODERIFTS_GITHUB_APP_ID);
+      return Number.isInteger(id) && id > 0 ? id : null;
+    }
+    function ourCheckEntries(rsc) {
+      if (!rsc || !Array.isArray(rsc.checks)) return [];
+      return rsc.checks.filter((c) => c && typeof c.context === "string" && c.context === CHECK_NAME);
+    }
+    function numericAppId(value) {
+      if (value == null || value === "") return null;
+      const n = Number(value);
+      return Number.isInteger(n) && n > 0 ? n : null;
+    }
+    function evaluateRequiredCheck(protection) {
+      const expected = expectedIssuerAppId();
+      const rsc = protection && protection.required_status_checks;
+      const contexts = extractRequiredContexts(protection);
+      if (expected == null) {
+        return {
+          status: STATUS.UNVERIFIABLE,
+          reason_code: REASON.ISSUER_APP_ID_UNRESOLVABLE,
+          reason: "CodeRifts GitHub App id could not be determined from public metadata; required_check is UNVERIFIABLE (never VERIFIED without an issuer id)",
+          required_contexts: contexts,
+          app_id: null
+        };
+      }
+      const ours = ourCheckEntries(rsc);
+      if (ours.length > 0) {
+        const bound = ours.find((c) => numericAppId(c.app_id) === expected);
+        if (bound) {
+          return {
+            status: STATUS.VERIFIED,
+            reason_code: REASON.ISSUER_BOUND,
+            reason: `required_status_checks.checks binds "${CHECK_NAME}" to GitHub App id ${expected} (slug ${CODERIFTS_GITHUB_APP_SLUG})`,
+            required_contexts: contexts,
+            app_id: expected
+          };
+        }
+        const other = ours.find((c) => numericAppId(c.app_id) != null);
+        if (other) {
+          return {
+            status: STATUS.NOT_VERIFIED,
+            reason_code: REASON.ISSUER_APP_ID_MISMATCH,
+            reason: `required_status_checks.checks binds "${CHECK_NAME}" to app_id ${numericAppId(other.app_id)}, not CodeRifts App id ${expected}`,
+            required_contexts: contexts,
+            app_id: numericAppId(other.app_id),
+            expected_app_id: expected
+          };
+        }
+        return {
+          status: STATUS.NOT_VERIFIED,
+          reason_code: REASON.NO_ISSUER_BINDING,
+          reason: `required_status_checks.checks lists "${CHECK_NAME}" with no app_id (name-only; any repository writer can post a success status with that context)`,
+          required_contexts: contexts,
+          app_id: null
+        };
+      }
+      if (contexts.includes(CHECK_NAME)) {
+        return {
+          status: STATUS.NOT_VERIFIED,
+          reason_code: REASON.LEGACY_CONTEXTS_NO_ISSUER_BINDING,
+          reason: `required_status_checks.contexts lists "${CHECK_NAME}" but the legacy contexts array has no app_id at all (legacy_contexts_no_issuer_binding)`,
+          required_contexts: contexts,
+          app_id: null
+        };
+      }
+      return {
+        status: STATUS.NOT_VERIFIED,
+        reason_code: REASON.REQUIRED_CHECK_ABSENT,
+        reason: `required_status_checks does not include "${CHECK_NAME}" (have: ${contexts.join(", ") || "none"})`,
+        required_contexts: contexts,
+        app_id: null
+      };
+    }
     var APP_INSTALLATION = Object.freeze({
       can_query_protection: false,
       permissions: Object.freeze([
@@ -237189,12 +237663,14 @@ var require_github_enforcement = __commonJS({
       } else {
         const protection = prot.body && typeof prot.body === "object" ? prot.body : {};
         const endpoint = prot.endpoint ? `GET ${prot.endpoint}` : null;
-        const contexts = extractRequiredContexts(protection);
-        const hasCheck = contexts.includes(CHECK_NAME);
-        layers.push(layer("required_check", hasCheck ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
-          reason: hasCheck ? `required_status_checks includes "${CHECK_NAME}"` : `required_status_checks does not include "${CHECK_NAME}" (have: ${contexts.join(", ") || "none"})`,
+        const required = evaluateRequiredCheck(protection);
+        layers.push(layer("required_check", required.status, {
+          reason: required.reason,
+          reason_code: required.reason_code,
           endpoint,
-          required_contexts: contexts
+          required_contexts: required.required_contexts,
+          app_id: required.app_id,
+          ...required.expected_app_id != null ? { expected_app_id: required.expected_app_id } : {}
         }));
         const admins = enforceAdminsEnabled(protection);
         layers.push(layer("enforce_admins", admins ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
@@ -237246,24 +237722,55 @@ var require_github_enforcement = __commonJS({
         }));
       } else {
         const ok = environmentProtected(environmentRead.body);
-        layers.push(layer("environment_protection", ok ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
-          reason: ok ? `GitHub Environment "${environmentName}" has protection rules or a deployment branch policy` : `GitHub Environment "${environmentName}" exists but has no protection_rules and no deployment_branch_policy`,
-          endpoint: environmentRead.endpoint ? `GET ${environmentRead.endpoint}` : null,
-          environment: environmentName
-        }));
+        const referenced = (localFiles.deployGateEnvironments || []).map(String);
+        const correlated = ok && environmentName && referenced.includes(environmentName);
+        if (correlated) {
+          layers.push(layer("environment_protection", STATUS.VERIFIED, {
+            reason: `GitHub Environment "${environmentName}" has protection rules and is referenced by an active deploy-gate job (environment:)`,
+            reason_code: REASON.ENVIRONMENT_CORRELATED,
+            endpoint: environmentRead.endpoint ? `GET ${environmentRead.endpoint}` : null,
+            environment: environmentName,
+            workflow_environments: referenced
+          }));
+        } else if (!ok) {
+          layers.push(layer("environment_protection", STATUS.NOT_VERIFIED, {
+            reason: `GitHub Environment "${environmentName}" exists but has no protection_rules and no deployment_branch_policy`,
+            reason_code: REASON.ENVIRONMENT_MISMATCH,
+            endpoint: environmentRead.endpoint ? `GET ${environmentRead.endpoint}` : null,
+            environment: environmentName,
+            workflow_environments: referenced
+          }));
+        } else {
+          layers.push(layer("environment_protection", STATUS.NOT_VERIFIED, {
+            reason: `GitHub Environment "${environmentName}" is protected but no active deploy-gate job sets environment: ${environmentName} (have: ${referenced.join(", ") || "none"})`,
+            reason_code: REASON.ENVIRONMENT_MISMATCH,
+            endpoint: environmentRead.endpoint ? `GET ${environmentRead.endpoint}` : null,
+            environment: environmentName,
+            workflow_environments: referenced
+          }));
+        }
       }
       const cg = localFiles.contractGateFiles || [];
       layers.push(layer("workflow_contract_gate", cg.length ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
-        reason: cg.length ? `workflow references ${GATE_ACTION} (${cg.join(", ")})` : `no .github/workflows file references ${GATE_ACTION}`,
+        reason: cg.length ? `active job step uses ${GATE_ACTION} (${cg.join(", ")})` : `no active .github/workflows job uses ${GATE_ACTION} (comments, disabled jobs, and string literals do not count)`,
+        reason_code: cg.length ? REASON.ACTIVE_JOB : REASON.NO_ACTIVE_JOB,
         endpoint: "local:.github/workflows",
         files: cg
       }));
       const dg = localFiles.deployGateFiles || [];
       layers.push(layer("workflow_deploy_gate", dg.length ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
-        reason: dg.length ? `workflow runs coderifts deploy-gate (${dg.join(", ")})` : "no .github/workflows file runs coderifts deploy-gate",
+        reason: dg.length ? `active job step invokes coderifts deploy-gate (${dg.join(", ")})` : "no active .github/workflows job invokes coderifts deploy-gate (comments, disabled jobs, and string literals do not count)",
+        reason_code: dg.length ? REASON.ACTIVE_JOB : REASON.NO_ACTIVE_JOB,
         endpoint: "local:.github/workflows",
         files: dg
       }));
+      for (const l of layers) {
+        if (l.status === STATUS.VERIFIED && !verifiedRequiresBinding(l)) {
+          l.status = STATUS.NOT_VERIFIED;
+          l.reason_code = l.reason_code || REASON.NO_ISSUER_BINDING;
+          l.reason = `${l.reason || l.id} \u2014 downgraded: VERIFIED requires issuer or active-job binding`;
+        }
+      }
       const byId = Object.fromEntries(layers.map((l) => [l.id, l]));
       const inescapable = LAYER_IDS.every((id) => byId[id] && byId[id].status === STATUS.VERIFIED);
       return {
@@ -237271,7 +237778,7 @@ var require_github_enforcement = __commonJS({
         inescapable_deploy: inescapable,
         claim: {
           inescapable_deploy: inescapable,
-          basis: inescapable ? "all six layers VERIFIED from queried provider evidence + local workflow files" : "inescapable_deploy stays false until every layer is VERIFIED"
+          basis: inescapable ? "all six layers VERIFIED (issuer-bound required check + active workflow jobs + correlated environment)" : "inescapable_deploy stays false until every layer is VERIFIED"
         }
       };
     }
@@ -237282,12 +237789,13 @@ var require_github_enforcement = __commonJS({
       const dir = path.join(cwd, ".github", "workflows");
       const contractGateFiles = [];
       const deployGateFiles = [];
-      if (!exists(dir)) return { contractGateFiles, deployGateFiles };
+      const deployGateEnvironments = [];
+      if (!exists(dir)) return { contractGateFiles, deployGateFiles, deployGateEnvironments };
       let names = [];
       try {
         names = readdir(dir);
       } catch {
-        return { contractGateFiles, deployGateFiles };
+        return { contractGateFiles, deployGateFiles, deployGateEnvironments };
       }
       for (const name of names) {
         if (!/\.ya?ml$/i.test(name)) continue;
@@ -237298,10 +237806,18 @@ var require_github_enforcement = __commonJS({
         } catch {
           continue;
         }
-        if (body.includes(GATE_ACTION)) contractGateFiles.push(rel);
-        if (/\bcoderifts\s+deploy-gate\b/.test(body)) deployGateFiles.push(rel);
+        const evidence = inspectWorkflowYaml(body);
+        if (evidence.contractGate) contractGateFiles.push(rel);
+        if (evidence.deployGate) {
+          deployGateFiles.push(rel);
+          for (const envName of evidence.deployEnvironments) {
+            if (envName && !deployGateEnvironments.includes(envName)) {
+              deployGateEnvironments.push(envName);
+            }
+          }
+        }
       }
-      return { contractGateFiles, deployGateFiles };
+      return { contractGateFiles, deployGateFiles, deployGateEnvironments };
     }
     async function queryGitHubEnforcement({
       owner,
@@ -237336,12 +237852,17 @@ var require_github_enforcement = __commonJS({
       NO_TOKEN_INSTRUCTION,
       LAYER_IDS,
       STATUS,
+      REASON,
       CHECK_NAME,
       GATE_ACTION,
+      CODERIFTS_GITHUB_APP_ID,
+      CODERIFTS_GITHUB_APP_SLUG,
       resolveGitHubAuth,
       redactSecrets,
       createGitHubHttpClient,
       evaluateLayers,
+      evaluateRequiredCheck,
+      verifiedRequiresBinding,
       scanLocalWorkflows,
       queryGitHubEnforcement,
       enforceAdminsEnabled,
@@ -237417,7 +237938,8 @@ var require_enforce_check = __commonJS({
         const missing = report.layers.filter((l) => l.status !== "VERIFIED");
         for (const l of missing) {
           if (l.id === "required_check") {
-            lines.push(chalk.dim('    require "CodeRifts / contract-gate" on default-branch protection'));
+            lines.push(chalk.dim('    require "CodeRifts / contract-gate" bound to the CodeRifts GitHub App (app_id)'));
+            lines.push(chalk.dim("    on default-branch protection \u2014 name-only and legacy contexts[] are NOT_VERIFIED"));
             lines.push(chalk.dim("    (coderifts setup-required-check --apply)"));
           } else if (l.id === "enforce_admins") {
             lines.push(chalk.dim("    set enforce_admins: true so administrators cannot bypass"));
@@ -237425,12 +237947,13 @@ var require_enforce_check = __commonJS({
           } else if (l.id === "strict_status_checks") {
             lines.push(chalk.dim("    set required_status_checks.strict: true"));
           } else if (l.id === "environment_protection") {
-            lines.push(chalk.dim("    add a GitHub Environment with protection rules, pass --env <name>"));
+            lines.push(chalk.dim("    add a GitHub Environment with protection rules, pass --env <name>,"));
+            lines.push(chalk.dim("    and set that same name on the deploy-gate job's environment: key"));
           } else if (l.id === "workflow_contract_gate") {
-            lines.push(chalk.dim("    add .github/workflows/coderifts.yml using coderifts/contract-gate@v0"));
-            lines.push(chalk.dim("    (coderifts init --agents)"));
+            lines.push(chalk.dim("    add an active job step: uses: coderifts/contract-gate@v0"));
+            lines.push(chalk.dim("    (comments / if: false / wrong org do not count; coderifts init --agents)"));
           } else if (l.id === "workflow_deploy_gate") {
-            lines.push(chalk.dim("    add a CD step: coderifts deploy-gate --env <env> --artifact <id> --receipt <file>"));
+            lines.push(chalk.dim("    add an active CD step that invokes: coderifts deploy-gate --env <env> --artifact <id> --receipt <file>"));
           }
         }
       }
@@ -238767,7 +239290,7 @@ var require_outcome = __commonJS({
 var require_cursor_hook = __commonJS({
   "src/commands/cursor-hook.js"(exports2, module2) {
     "use strict";
-    var { runClaudeHook } = require_claude_hook();
+    var { runClaudeHook, pickToolField, filePathFromInput, contentFromInput, coerceToolInput } = require_claude_hook();
     var USAGE = `Usage: coderifts cursor-hook
 
 Cursor preToolUse adapter. Reads Cursor's hook JSON on stdin, emits
@@ -238794,15 +239317,15 @@ Unparseable stdin denies (fail-closed).
       if (!obj || typeof obj !== "object" || Array.isArray(obj)) {
         return { ok: false, reason: "stdin JSON is not an object" };
       }
-      const toolName = typeof obj.tool_name === "string" ? obj.tool_name : null;
-      if (!toolName) return { ok: false, reason: "missing tool_name" };
-      const toolInput = obj.tool_input && typeof obj.tool_input === "object" && !Array.isArray(obj.tool_input) ? obj.tool_input : null;
+      const toolName = pickToolField(obj, "tool_name", "toolName", "name");
+      if (typeof toolName !== "string" || !toolName) return { ok: false, reason: "missing tool_name" };
+      const toolInput = coerceToolInput(pickToolField(obj, "tool_input", "toolInput", "input")) || (filePathFromInput(obj) ? obj : null);
       if (!toolInput) return { ok: false, reason: "missing tool_input" };
       return { ok: true, payload: obj, toolName, toolInput };
     }
     function toClaudeShape(toolName, toolInput) {
-      const filePath = toolInput.file_path || toolInput.path || toolInput.target_file || null;
-      const content = toolInput.content !== void 0 ? toolInput.content : toolInput.contents !== void 0 ? toolInput.contents : void 0;
+      const filePath = filePathFromInput(toolInput) || null;
+      const content = contentFromInput(toolInput);
       const out = { ...toolInput };
       if (filePath) out.file_path = filePath;
       if (content !== void 0) out.content = content;
@@ -240564,7 +241087,7 @@ program.command("registry-gate [dir]").description("Admit a directory of OpenAPI
   process.exitCode = code;
   process.exit(code);
 });
-program.command("init [template]").description("Generate a .coderifts.yml from a policy template, or wire governed agent work (--agents)").option("--agents", "Wire this repo for governed agent work (MCP config, rule files, host hook, CI gate)").option("--hosts <list>", "With --agents: claude, cursor, or all (default: all)", "all").option("--no-hook", "With --agents: skip host hook install").option("--no-workflow", "With --agents: skip writing .github/workflows/coderifts.yml").option("--dry-run", "With --agents: print the plan without writing").option("--check", "With --agents: report which of the four pieces are present (no write)").option("--out <dir>", "With --agents: target directory (default: cwd)").action(async (template, options) => {
+program.command("init [template]").description("Generate a .coderifts.yml from a policy template, or wire governed agent work (--agents)").option("--agents", "Wire this repo for governed agent work (MCP config, rule files, host hook, CI gate)").option("--hosts <list>", "With --agents: claude, cursor, copilot, or all (default: all)", "all").option("--no-hook", "With --agents: skip host hook install").option("--no-workflow", "With --agents: skip writing .github/workflows/coderifts.yml").option("--dry-run", "With --agents: print the plan without writing").option("--check", "With --agents: report which of the four pieces are present (no write)").option("--out <dir>", "With --agents: target directory (default: cwd)").action(async (template, options) => {
   const {
     runInitAgents,
     agentFlagsRequireAgents,