coderifts 4.8.0 → 4.10.0

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## 4.10.0
+
+### Added
+- **`coderifts init --agents --strict`** writes the STRICT contract-gate
+  workflow: `require-verified-monitoring: 'true'` (plus attestation /
+  keyring inputs). The default template is unchanged (monitoring stays
+  commented / false).
+
+## 4.9.0
+
+### Fixed
+- **P0 / ID621 — `enforce --check` no longer reports `inescapable_deploy: true`
+  for an unenforced configuration.** External audit 2026-08-24 reproduced two
+  holes on the published CLI: (a) the required check matched by **name only**
+  (`required_status_checks.checks[]` with no `app_id`), so any repository
+  writer could satisfy it with a same-named success status; (b) the two local
+  workflow checks were **text searches**, so `# uses: coderifts/contract-gate@v0`
+  in a comment counted as VERIFIED. Both now fail closed.
+
+### Changed
+- **`--json` spec `provider-enforcement-evidence.v2`.** The meaning of
+  `VERIFIED` changed. A layer whose evidence cannot be bound to an issuer
+  (CodeRifts GitHub App id, public `GET /apps/coderifts`) or to an **active**
+  workflow job is `NOT_VERIFIED` or `UNVERIFIABLE` — never `VERIFIED`.
+  `inescapable_deploy` is true only when every layer is VERIFIED under these
+  rules.
+- **Issuer binding:** `required_check` is VERIFIED only when `checks[]`
+  carries our App's numeric `app_id`. Legacy `contexts: string[]` is
+  `legacy_contexts_no_issuer_binding`. Name-only `checks[]` is
+  `no_issuer_binding`. A different `app_id` is `issuer_app_id_mismatch`.
+- **YAML AST, not grep:** workflow files are parsed with `js-yaml` (already a
+  CLI dependency — no new package). VERIFIED requires a job that is not
+  `if: false` and a step whose `uses:` is `coderifts/contract-gate` at a
+  pinned major, or a `run:` that actually invokes `coderifts deploy-gate`.
+  Comments, string literals in other keys, and commented-out steps fail.
+- **Environment correlation:** `environment_protection` is VERIFIED only when
+  `--env` names a protected GitHub Environment **and** an active deploy-gate
+  job sets that same `environment:` key (`environment_mismatch` otherwise).
+
 ## 4.8.0
 
 ### Fixed

package/README.md

@@ -75,6 +75,7 @@ coderifts init --agents --hosts=cursor   # Cursor only
 coderifts init --agents --hosts=copilot  # GitHub Copilot / VS Code only
 coderifts init --agents --no-hook        # skip host hook install
 coderifts init --agents --no-workflow    # skip .github/workflows/coderifts.yml
+coderifts init --agents --strict         # STRICT: require-verified-monitoring: true
 coderifts init --agents --check          # which of the four pieces are present
 ```
 
@@ -83,7 +84,7 @@ coderifts init --agents --check          # which of the four pieces are present
 | **MCP config** | `.mcp.json` (Claude Code), `.cursor/mcp.json` (Cursor), `.vscode/mcp.json` (Copilot / VS Code) | Three shapes, never normalised into one: Claude `mcpServers` + `type: "http"` + `url`; Cursor `mcpServers` + `url` only (no `type`); Copilot **`servers`** (not `mcpServers`) + `type: "http"` + `url`. Never `httpUrl` (that is Gemini, extension-level — this command does not write it). |
 | **Agent rules** | generated host files via `agent-setup`'s writer | `AGENTS.md` is always written. Claude also gets `CLAUDE.md`; Cursor also gets `.cursor/rules/coderifts.mdc`; Copilot also gets `.github/copilot-instructions.md`. `--hosts=all` adds LangGraph and OpenAI instructions. (`coderifts init agent` is a different command — it writes a `.coderifts.yml` template.) |
 | **Host hook** | `.claude/settings.json`, `.cursor/hooks.json` | Reuses `hook install --claude` / `--cursor` (JSON-merge, backup, idempotent). Copilot shares Claude's `.claude/settings.json` — VS Code reads it by default. |
-| **CI workflow** | `.github/workflows/coderifts.yml` | `coderifts/contract-gate@v0`. `require-verified-monitoring` is commented (honest default: **false**) |
+| **CI workflow** | `.github/workflows/coderifts.yml` | `coderifts/contract-gate@v0`. Default: `require-verified-monitoring` commented (honest default: **false**). `--strict`: the same file with `require-verified-monitoring: 'true'` |
 
 **Next manual step:** add `CODERIFTS_API_KEY` to the repository secrets. The
 CLI never writes a key anywhere.
@@ -437,12 +438,14 @@ Provider-native pipeline-protection evidence. This is **not** a host claim:
 
 | Layer | VERIFIED when |
 |-------|----------------|
-| `required_check` | Default-branch protection requires `CodeRifts / contract-gate` |
+| `required_check` | Default-branch protection `required_status_checks.checks[]` lists `CodeRifts / contract-gate` **bound to the CodeRifts GitHub App `app_id`** (public metadata: `GET https://api.github.com/apps/coderifts`). Name-only `checks[]` (`app_id` null) is `no_issuer_binding`. The legacy `contexts` array has no issuer field → `legacy_contexts_no_issuer_binding`. Both are **NOT_VERIFIED** (ID621). |
 | `enforce_admins` | `enforce_admins.enabled` is **true** (admins cannot bypass). `false` = NOT_VERIFIED (admin bypass open) |
 | `strict_status_checks` | `required_status_checks.strict` is true |
-| `environment_protection` | `--env` names a GitHub Environment with protection rules or a deployment branch policy |
-| `workflow_contract_gate` | a local `.github/workflows` file references `coderifts/contract-gate@v0` |
-| `workflow_deploy_gate` | a local workflow runs `coderifts deploy-gate` |
+| `environment_protection` | `--env` names a GitHub Environment with protection rules **and** an active deploy-gate job sets that same `environment:` (mismatch → `environment_mismatch`) |
+| `workflow_contract_gate` | an **active** job (not `if: false`) has a step whose `uses:` is `coderifts/contract-gate` at a pinned major. Comments, string literals, and commented-out steps are **NOT_VERIFIED** |
+| `workflow_deploy_gate` | an **active** job step **invokes** `coderifts deploy-gate` (not `echo` of the string; not a comment) |
+
+**Invariant:** any layer whose evidence cannot be bound to an issuer (our GitHub App id) or to an active job is `NOT_VERIFIED` or `UNVERIFIABLE` — never `VERIFIED`. `inescapable_deploy` remains true only when every layer is `VERIFIED` under that rule.
 
 Statuses: `VERIFIED` / `NOT_VERIFIED` / `UNVERIFIABLE(reason)`. Auth:
 `GITHUB_TOKEN` (never printed). **No token** → API layers `UNVERIFIABLE` with
@@ -451,9 +454,11 @@ CodeRifts GitHub App **cannot** query branch protection (permissions are
 contents / pull requests / checks — not `administration:read`).
 
 `--json` is the quotable evidence document (`spec`:
-`provider-enforcement-evidence.v1`): each layer's status, the API endpoint
-consulted, `queried_at`. Exit **0** when a report was produced (evidence, not
-a gate). GitLab/Bitbucket: no adapter — `UNVERIFIABLE`, never stubbed.
+`provider-enforcement-evidence.v2` — VERIFIED now requires issuer binding and
+an active YAML-AST job; v1 treated name-only checks and text search as
+VERIFIED): each layer's status, `reason_code`, the API endpoint consulted,
+`queried_at`. Exit **0** when a report was produced (evidence, not a gate).
+GitLab/Bitbucket: no adapter — `UNVERIFIABLE`, never stubbed.
 
 ### Agent host files (`coderifts agent-setup`)
 

package/bin/coderifts.js

@@ -95,6 +95,7 @@ program
   .option('--hosts <list>', 'With --agents: claude, cursor, copilot, or all (default: all)', 'all')
   .option('--no-hook', 'With --agents: skip host hook install')
   .option('--no-workflow', 'With --agents: skip writing .github/workflows/coderifts.yml')
+  .option('--strict', 'With --agents: STRICT workflow (require-verified-monitoring: true)')
   .option('--dry-run', 'With --agents: print the plan without writing')
   .option('--check', 'With --agents: report which of the four pieces are present (no write)')
   .option('--out <dir>', 'With --agents: target directory (default: cwd)')
@@ -118,6 +119,7 @@ program
         dryRun: !!options.dryRun,
         check: !!options.check,
         out: options.out,
+        strict: !!options.strict,
       });
       if (result && typeof result.exitCode === 'number') {
         process.exitCode = result.exitCode;

package/dist/cli.js

@@ -3028,7 +3028,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "4.8.0",
+      version: "4.10.0",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -200889,9 +200889,20 @@ var require_decision_result_v1_producer = __commonJS({
             source: {
               type: "string",
               enum: [
-                "github_compare"
+                "github_compare",
+                "gitlab_compare",
+                "bitbucket_compare"
               ],
-              description: "How the server listed the change-set. github_compare = GitHub Compare API via the App installation."
+              description: "How the server listed the change-set. github_compare = GitHub Compare API via the App installation. gitlab_compare / bitbucket_compare = platform Compare via a caller-supplied short-lived SCM token (never stored)."
+            },
+            platform: {
+              type: "string",
+              enum: [
+                "github",
+                "gitlab",
+                "bitbucket"
+              ],
+              description: "Additive P1-6. SCM platform that produced this SERVER_DERIVED set. Taken from the proven binding / context.platform \u2014 never guessed from the repository string. Absent on envelopes minted before this field existed."
             },
             base_sha: {
               type: "string",
@@ -201799,6 +201810,9 @@ var require_change_set_completeness = __commonJS({
       if (v == null) return "";
       return typeof v === "string" ? v : JSON.stringify(v);
     }
+    function afterContentHash(content) {
+      return sha256hexLocal(specStr(content));
+    }
     function artifactPath(artifact) {
       if (!artifact || typeof artifact !== "object") return "";
       if (typeof artifact.path === "string" && artifact.path.trim()) return artifact.path.trim();
@@ -202097,7 +202111,8 @@ var require_change_set_completeness = __commonJS({
         contract_selector_hash,
         completeness_count: normalizedLeaves.length,
         submitted_set_digest,
-        expected_channel: "webhook_full_file_list"
+        expected_channel: "webhook_full_file_list",
+        leaves: normalizedLeaves
       };
     }
     function assertCompletenessRequirement(block, requireLevel) {
@@ -202181,9 +202196,45 @@ var require_change_set_completeness = __commonJS({
         contract_selector_hash: computeContractSelectorHash(DEFAULT_CONTRACT_SELECTOR),
         completeness_count: leaves.length,
         submitted_set_digest,
-        expected_channel: null
+        expected_channel: null,
+        leaves
       };
     }
+    function authorizedPathsFromArtifacts(artifacts) {
+      const list = Array.isArray(artifacts) ? artifacts : [];
+      const seen = /* @__PURE__ */ new Set();
+      const rows = [];
+      for (const a of list) {
+        const path = artifactPath(a);
+        if (!path || seen.has(path)) continue;
+        seen.add(path);
+        rows.push({
+          path,
+          after_hex: sha256hexLocal(specStr(a && a.after)),
+          change_type: deriveChangeType(a && a.before, a && a.after)
+        });
+      }
+      return rows;
+    }
+    function authorizedPathsForPersist(block, artifacts) {
+      const submitted = authorizedPathsFromArtifacts(artifacts);
+      const leaves = block && Array.isArray(block.leaves) ? block.leaves : null;
+      if (!leaves || leaves.length === 0) return submitted;
+      const byPath = /* @__PURE__ */ new Map();
+      for (const L of leaves) {
+        if (!L || typeof L !== "object") continue;
+        const path = String(L.path == null ? "" : L.path).trim();
+        if (!path) continue;
+        const after_hex = String(L.after_hex == null ? "" : L.after_hex).replace(/^sha256:/i, "").toLowerCase();
+        if (!/^[0-9a-f]{64}$/.test(after_hex)) continue;
+        byPath.set(path, {
+          path,
+          after_hex,
+          change_type: normalizeChangeType(L.change_type)
+        });
+      }
+      return submitted.map((row) => byPath.get(row.path) || row);
+    }
     function completenessToEnvelopeFields(block) {
       if (!block || block.completeness_mode === "UNBOUND") {
         return {
@@ -202230,7 +202281,10 @@ var require_change_set_completeness = __commonJS({
       assertNoBooleanCompleteness,
       completenessRequiredError,
       sha256hexLocal,
-      specStr
+      specStr,
+      afterContentHash,
+      authorizedPathsFromArtifacts,
+      authorizedPathsForPersist
     };
   }
 });
@@ -202795,7 +202849,8 @@ var require_change_set = __commonJS({
       assertCompletenessRequirement,
       completenessToEnvelopeFields,
       applyProvenRepoBinding,
-      assertNoBooleanCompleteness
+      assertNoBooleanCompleteness,
+      authorizedPathsForPersist
     } = require_change_set_completeness();
     var { authorFingerprintBindingEnvelopeFields } = require_fingerprint_binding_gate();
     var NUL = "";
@@ -203522,6 +203577,7 @@ var require_change_set = __commonJS({
         }
       }
       const completenessEnvelope = completenessToEnvelopeFields(completenessBlock);
+      const authorizedPaths = preflightMode === "authorize" ? authorizedPathsForPersist(completenessBlock, artifacts) : [];
       const fingerprintBindingEnvelope = authorFingerprintBindingEnvelopeFields({
         preflightMode
       });
@@ -203583,6 +203639,7 @@ var require_change_set = __commonJS({
         // body_hash stays byte-identical. Covered by body_hash when set; NOT in fingerprint.
         ...input && input.derivation_meta && typeof input.derivation_meta === "object" ? { derivation: {
           source: String(input.derivation_meta.source || "github_compare"),
+          platform: String(input.derivation_meta.platform || "github"),
           base_sha: String(input.derivation_meta.base_sha || ""),
           head_sha: String(input.derivation_meta.head_sha || "")
         } } : {},
@@ -203777,6 +203834,12 @@ var require_change_set = __commonJS({
         }
       } catch (_) {
       }
+      if (preflightMode === "authorize" && Array.isArray(authorizedPaths) && authorizedPaths.length > 0) {
+        Object.defineProperty(out, "_authorized_paths", {
+          value: Object.freeze(authorizedPaths.map((r) => Object.freeze({ ...r }))),
+          enumerable: false
+        });
+      }
       return out;
     }
     module2.exports = {
@@ -210159,6 +210222,46 @@ jobs:
           # monitoring-attestation: \${{ vars.CODERIFTS_MONITORING_ATTESTATION }}
           # monitoring-keyring: \${{ github.workspace }}/.coderifts/monitoring-keys.json
 `;
+    var STRICT_WORKFLOW_BODY = `# Written by \`coderifts init --agents --strict\`. Re-run is a no-op when this file already exists.
+#
+# STRICT template: require-verified-monitoring is ON.
+# This workflow POSTS the Check Run named exactly:
+#   CodeRifts / contract-gate
+# It does NOT enable branch protection and it does NOT make that check required.
+# Turn the check on in repo settings to enforce (${ENFORCEMENT_DOC}).
+#
+# Copied from the gate repo example (examples/contract-gate.yml) \u2014 action at @v0.
+name: CodeRifts Contract Gate
+
+# Run on EVERY pull request. Do NOT add paths: filters \u2014 a required check that
+# never runs leaves the PR mergeable (see ENFORCEMENT.md, "fail-closed on absence").
+on:
+  pull_request:
+
+permissions:
+  checks: write
+  contents: read
+
+jobs:
+  contract-gate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # REQUIRED: the gate derives the change set from git diff base...head.
+          fetch-depth: 0
+
+      - uses: ${GATE_ACTION}
+        with:
+          api-key: \${{ secrets.CODERIFTS_API_KEY }}
+          # api-url: https://app.coderifts.com   # override only for self-hosted
+          require-verified-monitoring: 'true'
+          monitoring-attestation: \${{ vars.CODERIFTS_MONITORING_ATTESTATION }}
+          monitoring-keyring: \${{ github.workspace }}/.coderifts/monitoring-keys.json
+`;
+    function workflowBody(strict) {
+      return strict ? STRICT_WORKFLOW_BODY : WORKFLOW_BODY;
+    }
     function writeContractGateWorkflow(opts = {}) {
       const outDir = opts.outDir;
       const dest = path.join(outDir, WORKFLOW_REL);
@@ -210169,6 +210272,7 @@ jobs:
         fs.writeFileSync(p, c, "utf8");
       });
       const dryRun = !!opts.dryRun;
+      const body = workflowBody(!!opts.strict);
       if (exists(dest)) {
         let onDisk = "";
         try {
@@ -210176,13 +210280,13 @@ jobs:
         } catch {
           onDisk = "";
         }
-        const reason = onDisk === WORKFLOW_BODY ? "already present, identical" : "exists; installer does not clobber workflows";
+        const reason = onDisk === body ? "already present, identical" : "exists; installer does not clobber workflows";
         return { action: "skip", relPath: WORKFLOW_REL, reason, exitCode: 0 };
       }
       if (dryRun) {
         return { action: "create", relPath: WORKFLOW_REL, reason: "created", exitCode: 0, dryRun: true };
       }
-      writeFile(dest, WORKFLOW_BODY);
+      writeFile(dest, body);
       return { action: "create", relPath: WORKFLOW_REL, reason: "created", exitCode: 0 };
     }
     function workflowPresent(outDir, deps = {}) {
@@ -210199,6 +210303,7 @@ jobs:
     module2.exports = {
       WORKFLOW_REL,
       WORKFLOW_BODY,
+      STRICT_WORKFLOW_BODY,
       GATE_ACTION,
       ENFORCEMENT_DOC,
       writeContractGateWorkflow,
@@ -210230,7 +210335,7 @@ var require_init_agents = __commonJS({
       workflowPresent
     } = require_contract_gate_workflow();
     if (process.env.NO_COLOR) chalk.level = 0;
-    var USAGE = `Usage: coderifts init --agents [--hosts=claude,cursor,copilot,all] [--no-hook] [--no-workflow] [--dry-run] [--check] [--out <dir>]
+    var USAGE = `Usage: coderifts init --agents [--hosts=claude,cursor,copilot,all] [--no-hook] [--no-workflow] [--strict] [--dry-run] [--check] [--out <dir>]
 
   Wire this repository for governed agent work in ONE command:
     1. repo-level MCP config (per host: .mcp.json / .cursor/mcp.json / .vscode/mcp.json)
@@ -210241,6 +210346,7 @@ var require_init_agents = __commonJS({
   --hosts <list>   claude, cursor, copilot, or all (default: all)
   --no-hook        Skip host hook install
   --no-workflow    Skip writing the CI workflow
+  --strict         STRICT workflow: require-verified-monitoring: true (default template stays false)
   --dry-run        Print the plan without writing
   --check          Report which of the four pieces are present (no write)
   --out <dir>      Target directory (default: cwd)
@@ -210300,9 +210406,9 @@ ${USAGE}`
       return { hosts, allRules: false };
     }
     function agentFlagsRequireAgents(options = {}) {
-      return !!(options.check || options.dryRun || options.out || options.hosts != null && String(options.hosts) !== "all" || options.hook === false || options.workflow === false || options.noHook === true || options.noWorkflow === true);
+      return !!(options.check || options.dryRun || options.out || options.hosts != null && String(options.hosts) !== "all" || options.hook === false || options.workflow === false || options.noHook === true || options.noWorkflow === true || options.strict === true);
     }
-    var AGENT_FLAGS_REQUIRE_AGENTS = "Error: --check/--dry-run/--out/--hosts/--no-hook/--no-workflow require --agents";
+    var AGENT_FLAGS_REQUIRE_AGENTS = "Error: --check/--dry-run/--out/--hosts/--no-hook/--no-workflow/--strict require --agents";
     var AGENTS_NO_TEMPLATE = "Error: init --agents does not take a template. Did you mean `coderifts init --agents` (not `coderifts init agent`)?";
     function rulePathsForHosts(hosts, allRules) {
       const out = [SHARED_RULE];
@@ -210565,12 +210671,12 @@ ${USAGE}`
       if (!wantWorkflow(options)) {
         items.push({ section: "workflow", action: "skip", relPath: WORKFLOW_REL, note: "--no-workflow" });
       } else {
-        const r = writeContractGateWorkflow({ outDir, dryRun, ...fsDeps });
+        const r = writeContractGateWorkflow({ outDir, dryRun, strict: !!options.strict, ...fsDeps });
         items.push({
           section: "workflow",
           action: r.action,
           relPath: r.relPath,
-          note: r.action === "create" ? `${GATE_ACTION}` : r.reason
+          note: r.action === "create" ? options.strict ? `${GATE_ACTION} (STRICT require-verified-monitoring)` : GATE_ACTION : r.reason
         });
       }
       const created = items.filter((i) => i.action === "create").length;
@@ -237167,6 +237273,162 @@ var require_status = __commonJS({
   }
 });
 
+// src/provider/workflow-scan.js
+var require_workflow_scan = __commonJS({
+  "src/provider/workflow-scan.js"(exports2, module2) {
+    "use strict";
+    var yaml = require_js_yaml();
+    var CONTRACT_GATE_ACTION = "coderifts/contract-gate";
+    var DEPLOY_GATE_INVOCATION = /^(?:npx(?:\s+--yes)?\s+|npm\s+exec\s+|pnpm\s+(?:dlx|exec)\s+|yarn(?:\s+(?:dlx|exec))?\s+)?coderifts\s+deploy-gate(?:\s|$)/;
+    var NON_SHELL = /* @__PURE__ */ new Set(["python", "python3", "node", "ruby", "perl", "php", "pwsh", "powershell"]);
+    function isPinnedMajor(ref) {
+      const r = String(ref || "");
+      if (/^v\d+(\.\d+){0,2}$/.test(r)) return true;
+      if (/^[0-9a-f]{40}$/i.test(r)) return true;
+      return false;
+    }
+    function parseActionUses(uses) {
+      const raw = String(uses || "").trim();
+      const at = raw.lastIndexOf("@");
+      if (at <= 0) return { name: raw, ref: "", pinnedMajor: false };
+      return {
+        name: raw.slice(0, at),
+        ref: raw.slice(at + 1),
+        pinnedMajor: isPinnedMajor(raw.slice(at + 1))
+      };
+    }
+    function isContractGateUses(uses) {
+      const parsed = parseActionUses(uses);
+      return parsed.name === CONTRACT_GATE_ACTION && parsed.pinnedMajor === true;
+    }
+    function isExplicitlyDisabled(node) {
+      if (!node || typeof node !== "object" || !Object.prototype.hasOwnProperty.call(node, "if")) {
+        return false;
+      }
+      const ifVal = node.if;
+      if (ifVal === false || ifVal === 0 || ifVal === null) return true;
+      if (typeof ifVal === "string") {
+        const s = ifVal.trim().toLowerCase();
+        if (s === "false" || s === "0" || s === "" || s === "null") return true;
+        if (/^\$\{\{\s*(?:false|0|null)\s*\}\}$/.test(s)) return true;
+      }
+      return false;
+    }
+    function jobEnvironmentName(job) {
+      if (!job || typeof job !== "object") return null;
+      const env = job.environment;
+      if (typeof env === "string") {
+        const name = env.trim();
+        return name || null;
+      }
+      if (env && typeof env === "object" && typeof env.name === "string") {
+        const name = env.name.trim();
+        return name || null;
+      }
+      return null;
+    }
+    function isNonPosixShell(shell) {
+      if (shell == null || shell === "") return false;
+      const first = String(shell).trim().split(/\s+/)[0].replace(/^.*\//, "").toLowerCase();
+      return NON_SHELL.has(first);
+    }
+    function isDeployGateInvocation(run, shell) {
+      if (isNonPosixShell(shell)) return false;
+      const text = String(run || "");
+      let heredoc = null;
+      let quote = null;
+      for (const rawLine of text.split("\n")) {
+        let line = String(rawLine || "");
+        if (heredoc) {
+          if (line.trim() === heredoc) heredoc = null;
+          continue;
+        }
+        const hd = /<<[-]?\s*['"]?(\w+)['"]?/.exec(line);
+        if (hd) heredoc = hd[1];
+        if (quote) {
+          for (let i = 0; i < line.length; i++) {
+            const ch = line[i];
+            if (ch === quote && line[i - 1] !== "\\") {
+              quote = null;
+              break;
+            }
+          }
+          if (quote) continue;
+        }
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#")) continue;
+        let cmd = trimmed.replace(/^(?:\w+=\S+\s+)+/, "");
+        if (/^(echo|printf|cat|false|true|:)\b/.test(cmd)) {
+          for (let i = 0; i < cmd.length; i++) {
+            const ch = cmd[i];
+            if ((ch === "'" || ch === '"') && cmd[i - 1] !== "\\") {
+              quote = quote ? quote === ch ? null : quote : ch;
+            }
+          }
+          continue;
+        }
+        if (DEPLOY_GATE_INVOCATION.test(cmd)) return true;
+      }
+      return false;
+    }
+    function stepsOf(job) {
+      if (!job || typeof job !== "object") return [];
+      return Array.isArray(job.steps) ? job.steps : [];
+    }
+    function inspectJob(job) {
+      const out = {
+        contractGate: false,
+        deployGate: false,
+        environment: jobEnvironmentName(job),
+        disabled: isExplicitlyDisabled(job)
+      };
+      if (out.disabled) return out;
+      for (const step of stepsOf(job)) {
+        if (!step || typeof step !== "object") continue;
+        if (isExplicitlyDisabled(step)) continue;
+        if (step.uses != null && isContractGateUses(step.uses)) out.contractGate = true;
+        if (step.run != null && isDeployGateInvocation(step.run, step.shell)) out.deployGate = true;
+      }
+      return out;
+    }
+    function inspectWorkflowYaml(body) {
+      const empty = { contractGate: false, deployGate: false, deployEnvironments: [] };
+      let doc;
+      try {
+        doc = yaml.load(String(body || ""));
+      } catch {
+        return empty;
+      }
+      if (!doc || typeof doc !== "object" || Array.isArray(doc)) return empty;
+      const jobs = doc.jobs && typeof doc.jobs === "object" && !Array.isArray(doc.jobs) ? doc.jobs : null;
+      if (!jobs) return empty;
+      let contractGate = false;
+      let deployGate = false;
+      const deployEnvironments = [];
+      for (const name of Object.keys(jobs)) {
+        const info = inspectJob(jobs[name]);
+        if (info.contractGate) contractGate = true;
+        if (info.deployGate) {
+          deployGate = true;
+          if (info.environment) deployEnvironments.push(info.environment);
+        }
+      }
+      return { contractGate, deployGate, deployEnvironments };
+    }
+    module2.exports = {
+      CONTRACT_GATE_ACTION,
+      isPinnedMajor,
+      parseActionUses,
+      isContractGateUses,
+      isExplicitlyDisabled,
+      jobEnvironmentName,
+      isDeployGateInvocation,
+      inspectJob,
+      inspectWorkflowYaml
+    };
+  }
+});
+
 // src/provider/github-enforcement.js
 var require_github_enforcement = __commonJS({
   "src/provider/github-enforcement.js"(exports2, module2) {
@@ -237178,7 +237440,107 @@ var require_github_enforcement = __commonJS({
       extractRequiredContexts
     } = require_setup_required_check();
     var { GATE_ACTION } = require_contract_gate_workflow();
-    var EVIDENCE_SPEC = "provider-enforcement-evidence.v1";
+    var { inspectWorkflowYaml } = require_workflow_scan();
+    var EVIDENCE_SPEC = "provider-enforcement-evidence.v2";
+    var CODERIFTS_GITHUB_APP_SLUG = "coderifts";
+    var CODERIFTS_GITHUB_APP_ID = 2860592;
+    var REASON = Object.freeze({
+      ISSUER_BOUND: "issuer_bound",
+      NO_ISSUER_BINDING: "no_issuer_binding",
+      LEGACY_CONTEXTS_NO_ISSUER_BINDING: "legacy_contexts_no_issuer_binding",
+      ISSUER_APP_ID_MISMATCH: "issuer_app_id_mismatch",
+      ISSUER_APP_ID_UNRESOLVABLE: "issuer_app_id_unresolvable",
+      REQUIRED_CHECK_ABSENT: "required_check_absent",
+      ACTIVE_JOB: "active_job",
+      NO_ACTIVE_JOB: "no_active_job",
+      ENVIRONMENT_CORRELATED: "environment_correlated",
+      ENVIRONMENT_MISMATCH: "environment_mismatch"
+    });
+    function verifiedRequiresBinding(layer2) {
+      if (!layer2 || layer2.status !== STATUS.VERIFIED) return true;
+      if (layer2.id === "required_check") return layer2.reason_code === REASON.ISSUER_BOUND;
+      if (layer2.id === "workflow_contract_gate" || layer2.id === "workflow_deploy_gate") {
+        return layer2.reason_code === REASON.ACTIVE_JOB;
+      }
+      if (layer2.id === "environment_protection") {
+        return layer2.reason_code === REASON.ENVIRONMENT_CORRELATED;
+      }
+      return true;
+    }
+    function expectedIssuerAppId() {
+      const id = Number(CODERIFTS_GITHUB_APP_ID);
+      return Number.isInteger(id) && id > 0 ? id : null;
+    }
+    function ourCheckEntries(rsc) {
+      if (!rsc || !Array.isArray(rsc.checks)) return [];
+      return rsc.checks.filter((c) => c && typeof c.context === "string" && c.context === CHECK_NAME);
+    }
+    function numericAppId(value) {
+      if (value == null || value === "") return null;
+      const n = Number(value);
+      return Number.isInteger(n) && n > 0 ? n : null;
+    }
+    function evaluateRequiredCheck(protection) {
+      const expected = expectedIssuerAppId();
+      const rsc = protection && protection.required_status_checks;
+      const contexts = extractRequiredContexts(protection);
+      if (expected == null) {
+        return {
+          status: STATUS.UNVERIFIABLE,
+          reason_code: REASON.ISSUER_APP_ID_UNRESOLVABLE,
+          reason: "CodeRifts GitHub App id could not be determined from public metadata; required_check is UNVERIFIABLE (never VERIFIED without an issuer id)",
+          required_contexts: contexts,
+          app_id: null
+        };
+      }
+      const ours = ourCheckEntries(rsc);
+      if (ours.length > 0) {
+        const bound = ours.find((c) => numericAppId(c.app_id) === expected);
+        if (bound) {
+          return {
+            status: STATUS.VERIFIED,
+            reason_code: REASON.ISSUER_BOUND,
+            reason: `required_status_checks.checks binds "${CHECK_NAME}" to GitHub App id ${expected} (slug ${CODERIFTS_GITHUB_APP_SLUG})`,
+            required_contexts: contexts,
+            app_id: expected
+          };
+        }
+        const other = ours.find((c) => numericAppId(c.app_id) != null);
+        if (other) {
+          return {
+            status: STATUS.NOT_VERIFIED,
+            reason_code: REASON.ISSUER_APP_ID_MISMATCH,
+            reason: `required_status_checks.checks binds "${CHECK_NAME}" to app_id ${numericAppId(other.app_id)}, not CodeRifts App id ${expected}`,
+            required_contexts: contexts,
+            app_id: numericAppId(other.app_id),
+            expected_app_id: expected
+          };
+        }
+        return {
+          status: STATUS.NOT_VERIFIED,
+          reason_code: REASON.NO_ISSUER_BINDING,
+          reason: `required_status_checks.checks lists "${CHECK_NAME}" with no app_id (name-only; any repository writer can post a success status with that context)`,
+          required_contexts: contexts,
+          app_id: null
+        };
+      }
+      if (contexts.includes(CHECK_NAME)) {
+        return {
+          status: STATUS.NOT_VERIFIED,
+          reason_code: REASON.LEGACY_CONTEXTS_NO_ISSUER_BINDING,
+          reason: `required_status_checks.contexts lists "${CHECK_NAME}" but the legacy contexts array has no app_id at all (legacy_contexts_no_issuer_binding)`,
+          required_contexts: contexts,
+          app_id: null
+        };
+      }
+      return {
+        status: STATUS.NOT_VERIFIED,
+        reason_code: REASON.REQUIRED_CHECK_ABSENT,
+        reason: `required_status_checks does not include "${CHECK_NAME}" (have: ${contexts.join(", ") || "none"})`,
+        required_contexts: contexts,
+        app_id: null
+      };
+    }
     var APP_INSTALLATION = Object.freeze({
       can_query_protection: false,
       permissions: Object.freeze([
@@ -237344,12 +237706,14 @@ var require_github_enforcement = __commonJS({
       } else {
         const protection = prot.body && typeof prot.body === "object" ? prot.body : {};
         const endpoint = prot.endpoint ? `GET ${prot.endpoint}` : null;
-        const contexts = extractRequiredContexts(protection);
-        const hasCheck = contexts.includes(CHECK_NAME);
-        layers.push(layer("required_check", hasCheck ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
-          reason: hasCheck ? `required_status_checks includes "${CHECK_NAME}"` : `required_status_checks does not include "${CHECK_NAME}" (have: ${contexts.join(", ") || "none"})`,
+        const required = evaluateRequiredCheck(protection);
+        layers.push(layer("required_check", required.status, {
+          reason: required.reason,
+          reason_code: required.reason_code,
           endpoint,
-          required_contexts: contexts
+          required_contexts: required.required_contexts,
+          app_id: required.app_id,
+          ...required.expected_app_id != null ? { expected_app_id: required.expected_app_id } : {}
         }));
         const admins = enforceAdminsEnabled(protection);
         layers.push(layer("enforce_admins", admins ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
@@ -237401,24 +237765,55 @@ var require_github_enforcement = __commonJS({
         }));
       } else {
         const ok = environmentProtected(environmentRead.body);
-        layers.push(layer("environment_protection", ok ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
-          reason: ok ? `GitHub Environment "${environmentName}" has protection rules or a deployment branch policy` : `GitHub Environment "${environmentName}" exists but has no protection_rules and no deployment_branch_policy`,
-          endpoint: environmentRead.endpoint ? `GET ${environmentRead.endpoint}` : null,
-          environment: environmentName
-        }));
+        const referenced = (localFiles.deployGateEnvironments || []).map(String);
+        const correlated = ok && environmentName && referenced.includes(environmentName);
+        if (correlated) {
+          layers.push(layer("environment_protection", STATUS.VERIFIED, {
+            reason: `GitHub Environment "${environmentName}" has protection rules and is referenced by an active deploy-gate job (environment:)`,
+            reason_code: REASON.ENVIRONMENT_CORRELATED,
+            endpoint: environmentRead.endpoint ? `GET ${environmentRead.endpoint}` : null,
+            environment: environmentName,
+            workflow_environments: referenced
+          }));
+        } else if (!ok) {
+          layers.push(layer("environment_protection", STATUS.NOT_VERIFIED, {
+            reason: `GitHub Environment "${environmentName}" exists but has no protection_rules and no deployment_branch_policy`,
+            reason_code: REASON.ENVIRONMENT_MISMATCH,
+            endpoint: environmentRead.endpoint ? `GET ${environmentRead.endpoint}` : null,
+            environment: environmentName,
+            workflow_environments: referenced
+          }));
+        } else {
+          layers.push(layer("environment_protection", STATUS.NOT_VERIFIED, {
+            reason: `GitHub Environment "${environmentName}" is protected but no active deploy-gate job sets environment: ${environmentName} (have: ${referenced.join(", ") || "none"})`,
+            reason_code: REASON.ENVIRONMENT_MISMATCH,
+            endpoint: environmentRead.endpoint ? `GET ${environmentRead.endpoint}` : null,
+            environment: environmentName,
+            workflow_environments: referenced
+          }));
+        }
       }
       const cg = localFiles.contractGateFiles || [];
       layers.push(layer("workflow_contract_gate", cg.length ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
-        reason: cg.length ? `workflow references ${GATE_ACTION} (${cg.join(", ")})` : `no .github/workflows file references ${GATE_ACTION}`,
+        reason: cg.length ? `active job step uses ${GATE_ACTION} (${cg.join(", ")})` : `no active .github/workflows job uses ${GATE_ACTION} (comments, disabled jobs, and string literals do not count)`,
+        reason_code: cg.length ? REASON.ACTIVE_JOB : REASON.NO_ACTIVE_JOB,
         endpoint: "local:.github/workflows",
         files: cg
       }));
       const dg = localFiles.deployGateFiles || [];
       layers.push(layer("workflow_deploy_gate", dg.length ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
-        reason: dg.length ? `workflow runs coderifts deploy-gate (${dg.join(", ")})` : "no .github/workflows file runs coderifts deploy-gate",
+        reason: dg.length ? `active job step invokes coderifts deploy-gate (${dg.join(", ")})` : "no active .github/workflows job invokes coderifts deploy-gate (comments, disabled jobs, and string literals do not count)",
+        reason_code: dg.length ? REASON.ACTIVE_JOB : REASON.NO_ACTIVE_JOB,
         endpoint: "local:.github/workflows",
         files: dg
       }));
+      for (const l of layers) {
+        if (l.status === STATUS.VERIFIED && !verifiedRequiresBinding(l)) {
+          l.status = STATUS.NOT_VERIFIED;
+          l.reason_code = l.reason_code || REASON.NO_ISSUER_BINDING;
+          l.reason = `${l.reason || l.id} \u2014 downgraded: VERIFIED requires issuer or active-job binding`;
+        }
+      }
       const byId = Object.fromEntries(layers.map((l) => [l.id, l]));
       const inescapable = LAYER_IDS.every((id) => byId[id] && byId[id].status === STATUS.VERIFIED);
       return {
@@ -237426,7 +237821,7 @@ var require_github_enforcement = __commonJS({
         inescapable_deploy: inescapable,
         claim: {
           inescapable_deploy: inescapable,
-          basis: inescapable ? "all six layers VERIFIED from queried provider evidence + local workflow files" : "inescapable_deploy stays false until every layer is VERIFIED"
+          basis: inescapable ? "all six layers VERIFIED (issuer-bound required check + active workflow jobs + correlated environment)" : "inescapable_deploy stays false until every layer is VERIFIED"
         }
       };
     }
@@ -237437,12 +237832,13 @@ var require_github_enforcement = __commonJS({
       const dir = path.join(cwd, ".github", "workflows");
       const contractGateFiles = [];
       const deployGateFiles = [];
-      if (!exists(dir)) return { contractGateFiles, deployGateFiles };
+      const deployGateEnvironments = [];
+      if (!exists(dir)) return { contractGateFiles, deployGateFiles, deployGateEnvironments };
       let names = [];
       try {
         names = readdir(dir);
       } catch {
-        return { contractGateFiles, deployGateFiles };
+        return { contractGateFiles, deployGateFiles, deployGateEnvironments };
       }
       for (const name of names) {
         if (!/\.ya?ml$/i.test(name)) continue;
@@ -237453,10 +237849,18 @@ var require_github_enforcement = __commonJS({
         } catch {
           continue;
         }
-        if (body.includes(GATE_ACTION)) contractGateFiles.push(rel);
-        if (/\bcoderifts\s+deploy-gate\b/.test(body)) deployGateFiles.push(rel);
+        const evidence = inspectWorkflowYaml(body);
+        if (evidence.contractGate) contractGateFiles.push(rel);
+        if (evidence.deployGate) {
+          deployGateFiles.push(rel);
+          for (const envName of evidence.deployEnvironments) {
+            if (envName && !deployGateEnvironments.includes(envName)) {
+              deployGateEnvironments.push(envName);
+            }
+          }
+        }
       }
-      return { contractGateFiles, deployGateFiles };
+      return { contractGateFiles, deployGateFiles, deployGateEnvironments };
     }
     async function queryGitHubEnforcement({
       owner,
@@ -237491,12 +237895,17 @@ var require_github_enforcement = __commonJS({
       NO_TOKEN_INSTRUCTION,
       LAYER_IDS,
       STATUS,
+      REASON,
       CHECK_NAME,
       GATE_ACTION,
+      CODERIFTS_GITHUB_APP_ID,
+      CODERIFTS_GITHUB_APP_SLUG,
       resolveGitHubAuth,
       redactSecrets,
       createGitHubHttpClient,
       evaluateLayers,
+      evaluateRequiredCheck,
+      verifiedRequiresBinding,
       scanLocalWorkflows,
       queryGitHubEnforcement,
       enforceAdminsEnabled,
@@ -237572,7 +237981,8 @@ var require_enforce_check = __commonJS({
         const missing = report.layers.filter((l) => l.status !== "VERIFIED");
         for (const l of missing) {
           if (l.id === "required_check") {
-            lines.push(chalk.dim('    require "CodeRifts / contract-gate" on default-branch protection'));
+            lines.push(chalk.dim('    require "CodeRifts / contract-gate" bound to the CodeRifts GitHub App (app_id)'));
+            lines.push(chalk.dim("    on default-branch protection \u2014 name-only and legacy contexts[] are NOT_VERIFIED"));
             lines.push(chalk.dim("    (coderifts setup-required-check --apply)"));
           } else if (l.id === "enforce_admins") {
             lines.push(chalk.dim("    set enforce_admins: true so administrators cannot bypass"));
@@ -237580,12 +237990,13 @@ var require_enforce_check = __commonJS({
           } else if (l.id === "strict_status_checks") {
             lines.push(chalk.dim("    set required_status_checks.strict: true"));
           } else if (l.id === "environment_protection") {
-            lines.push(chalk.dim("    add a GitHub Environment with protection rules, pass --env <name>"));
+            lines.push(chalk.dim("    add a GitHub Environment with protection rules, pass --env <name>,"));
+            lines.push(chalk.dim("    and set that same name on the deploy-gate job's environment: key"));
           } else if (l.id === "workflow_contract_gate") {
-            lines.push(chalk.dim("    add .github/workflows/coderifts.yml using coderifts/contract-gate@v0"));
-            lines.push(chalk.dim("    (coderifts init --agents)"));
+            lines.push(chalk.dim("    add an active job step: uses: coderifts/contract-gate@v0"));
+            lines.push(chalk.dim("    (comments / if: false / wrong org do not count; coderifts init --agents)"));
           } else if (l.id === "workflow_deploy_gate") {
-            lines.push(chalk.dim("    add a CD step: coderifts deploy-gate --env <env> --artifact <id> --receipt <file>"));
+            lines.push(chalk.dim("    add an active CD step that invokes: coderifts deploy-gate --env <env> --artifact <id> --receipt <file>"));
           }
         }
       }
@@ -240719,7 +241130,7 @@ program.command("registry-gate [dir]").description("Admit a directory of OpenAPI
   process.exitCode = code;
   process.exit(code);
 });
-program.command("init [template]").description("Generate a .coderifts.yml from a policy template, or wire governed agent work (--agents)").option("--agents", "Wire this repo for governed agent work (MCP config, rule files, host hook, CI gate)").option("--hosts <list>", "With --agents: claude, cursor, copilot, or all (default: all)", "all").option("--no-hook", "With --agents: skip host hook install").option("--no-workflow", "With --agents: skip writing .github/workflows/coderifts.yml").option("--dry-run", "With --agents: print the plan without writing").option("--check", "With --agents: report which of the four pieces are present (no write)").option("--out <dir>", "With --agents: target directory (default: cwd)").action(async (template, options) => {
+program.command("init [template]").description("Generate a .coderifts.yml from a policy template, or wire governed agent work (--agents)").option("--agents", "Wire this repo for governed agent work (MCP config, rule files, host hook, CI gate)").option("--hosts <list>", "With --agents: claude, cursor, copilot, or all (default: all)", "all").option("--no-hook", "With --agents: skip host hook install").option("--no-workflow", "With --agents: skip writing .github/workflows/coderifts.yml").option("--strict", "With --agents: STRICT workflow (require-verified-monitoring: true)").option("--dry-run", "With --agents: print the plan without writing").option("--check", "With --agents: report which of the four pieces are present (no write)").option("--out <dir>", "With --agents: target directory (default: cwd)").action(async (template, options) => {
   const {
     runInitAgents,
     agentFlagsRequireAgents,
@@ -240738,7 +241149,8 @@ program.command("init [template]").description("Generate a .coderifts.yml from a
       workflow: options.workflow,
       dryRun: !!options.dryRun,
       check: !!options.check,
-      out: options.out
+      out: options.out,
+      strict: !!options.strict
     });
     if (result && typeof result.exitCode === "number") {
       process.exitCode = result.exitCode;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coderifts",
-  "version": "4.8.0",
+  "version": "4.10.0",
   "description": "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
   "author": "CodeRifts <hello@coderifts.com>",
   "license": "MIT",