coderifts 5.0.0 → 6.0.0

package/CHANGELOG.md

@@ -1,6 +1,34 @@
 # Changelog
 
-## Unreleased
+## 6.0.0
+
+_Nothing yet._
+
+## 5.0.1
+
+### Fixed
+- **A fresh install shipped the guard with the conditional-write hole.**
+  `coderifts@5.0.0` declared `@coderifts/agent-guard: ^11.0.0`, which resolved to
+  11.0.1 — precisely the tarball the guard's own 12.0.0 round reproduced the
+  defect against, where `requireConditionalWrite` did not fire on an ordinary
+  mutation and the side effect **ran** with `enforced: true`. The guard is a
+  **direct** dependency with no `peerDependencies` and no bundled copy, so this
+  range *is* the adopter's resolution, not advice. Now `^12.0.0`, with
+  `MIN_GUARD_MAJOR` raised to 12. Cost measured as zero: the CLI imports only
+  `deployGate`, `asVerifiedDeployReceiptView`, `DEPLOY_RECEIPT_VIEW_SPEC` and
+  `matchGlob`, whose modules are byte-identical 11.0.1 → 12.0.0.
+- **Two defects in the publish gate itself**, both proven by replaying the real
+  script. The resolved check only ever compared *downward* — `resolved >= floor`,
+  never whether the resolved version sits **inside** the declared range — so
+  declaring `^11.0.0` with 12.0.0 staged for a cost measurement printed OK and
+  exited 0, which is exactly the shape that makes "we measured 12 and shipped
+  ^11" indistinguishable from a correct release. And an unresolvable install was
+  a **pass**. Three failure modes added (resolved below the declared range at
+  full precision, resolved above it, and not resolvable at all), with no
+  opt-out — an `allowUnresolved` flag was written and deliberately removed, and
+  a test asserts it stays absent.
+
+## 5.0.0
 
 ### Fixed
 - **P0 — `setup-required-check --apply` no longer reports `APPLIED` over a
@@ -59,6 +87,63 @@
   template is unchanged and stays non-blocking; it carries the same three lines
   commented, with a note saying why the two differ.
 
+## 4.13.0 — never published (folded into 5.0.0)
+
+Bumped in-repo (`917611d`) but never tagged or released to npm; 5.0.0 superseded
+it, so adopters received this content **as part of 5.0.0**. Recorded separately
+because the version number appears in the source history and in
+`assert-guard-major.js`'s floor-raise log.
+
+### Changed
+- **Guard floor raised to 11.** Cost measured as zero the way the 10-raise was —
+  the CLI imports only `deployGate`, `asVerifiedDeployReceiptView`,
+  `DEPLOY_RECEIPT_VIEW_SPEC` and `matchGlob`, none of which 11.0.0 touched, and
+  the suite staged against 11 returned an identical 532/530/2 with a
+  byte-identical failure set. It rises anyway, because a semantics floor is about
+  what the CLI may **run** against, not what it happens to import today: 10.x's
+  `computeBundleFingerprint` disagreed with the server, which is exactly the
+  class this gate exists to refuse.
+- The two tests pinning the old floor were updated, and the invariant made
+  explicit: **the floor only ever rises**.
+
+### Added
+- `/api/v1/agent/preflight` returns `scorer_version` — the one field that makes
+  the single-spec fingerprint reproducible by a consumer holding their own
+  before/after/policy. Purely additive; no surface moves and `tools_sha256` is
+  unchanged.
+
+## 4.12.0
+
+### Changed
+- **Guard floor raised to 10.** Cost measured as zero: the CLI imports only
+  `deployGate`, `asVerifiedDeployReceiptView`, `DEPLOY_RECEIPT_VIEW_SPEC` and
+  `matchGlob` — never `withCodeRifts` — so 10.0.0's strict-composition break
+  cannot reach it. Verified by staging guard 10 into the install and running the
+  suite (guard-conformance 6/6, the same two pre-existing failures as the guard-9
+  baseline). The gate was satisfied, not weakened: before the install it
+  correctly reported FAIL on the stale resolve.
+
+## 4.11.0
+
+### Fixed
+- **P0 — the issuer binding pointed at a check that cannot block.** GitHub passes
+  a required status check on `success`, `skipped` **or `neutral`**, so our App's
+  advisory check genuinely cannot block; a false comment in
+  `webhook-integration.js` claiming otherwise is what produced the regression.
+  The enforcing issuer is `app_id 15368` (github-actions), which the contract-gate
+  Action posts under, so that binding is now VERIFIED — with the shared-identity
+  residual **named** rather than implied: anyone who can edit
+  `.github/workflows` can post under it. A binding to our own App id grades
+  UNVERIFIABLE rather than NOT_VERIFIED, because `MERGEGATE_ENFORCE` is
+  server-side and invisible from here.
+- **P0 — the installer wrote what our own verifier rejects.** It now writes
+  `checks[]` with an explicit `app_id`, because an omitted `app_id` silently
+  resolves to whoever posted last, which is unauditable. It never re-binds
+  another team's existing check, and the success path prints what it does **not**
+  achieve. A coupling test asserts the installer's and the verifier's issuer
+  constants are equal. The verifier was not weakened — the name-only and
+  legacy-contexts paths are byte-identical, asserted by two unchanged tests.
+
 ## 4.10.0
 
 ### Added

package/dist/cli.js

@@ -3028,7 +3028,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "5.0.0",
+      version: "6.0.0",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -3067,13 +3067,13 @@ var require_package = __commonJS({
       },
       scripts: {
         build: "node scripts/copy-corpus.js && node scripts/build.js",
-        prepublishOnly: "node scripts/assert-guard-major.js && bash ../../scripts/freeze-gate.sh && npm run build",
+        prepublishOnly: "node scripts/assert-guard-major.js && node scripts/assert-changelog-version.js && bash ../../scripts/freeze-gate.sh && npm run build",
         "assert-guard-major": "node scripts/assert-guard-major.js",
         postinstall: "node scripts/postinstall.js",
         test: "node --test test/*.test.js"
       },
       dependencies: {
-        "@coderifts/agent-guard": "^11.0.0",
+        "@coderifts/agent-guard": "^12.0.0",
         chalk: "^4.1.2",
         "cli-table3": "^0.6.4",
         commander: "^12.0.0",
@@ -66357,7 +66357,7 @@ var require_execution_time_fingerprint = __commonJS({
     exports2.authorizedFingerprintFromEnvelope = authorizedFingerprintFromEnvelope;
     exports2.checkExecutionTimeFingerprint = checkExecutionTimeFingerprint;
     var node_crypto_1 = require("node:crypto");
-    var NUL = "";
+    var US = "";
     var BUNDLE_FP_DOMAIN = "crbundle.v1";
     function sha256hex(s) {
       return (0, node_crypto_1.createHash)("sha256").update(s, "utf8").digest("hex");
@@ -66372,13 +66372,13 @@ var require_execution_time_fingerprint = __commonJS({
     }
     function computeCanonicalBundleFingerprint(artifacts, context) {
       const sorted = artifacts.slice().sort((x, y) => {
-        const kx = `${x.type}${NUL}${x.id}`;
-        const ky = `${y.type}${NUL}${y.id}`;
+        const kx = `${x.type}${US}${x.id}`;
+        const ky = `${y.type}${US}${y.id}`;
         return kx < ky ? -1 : kx > ky ? 1 : 0;
       });
       const parts = [BUNDLE_FP_DOMAIN, String(artifacts.length)];
       for (const a of sorted) {
-        parts.push([a.type, a.id, sha256hex(specStr(a.before)), sha256hex(specStr(a.after))].join(NUL));
+        parts.push([a.type, a.id, sha256hex(specStr(a.before)), sha256hex(specStr(a.after))].join(US));
       }
       const ctx = context || {};
       parts.push([
@@ -66388,8 +66388,8 @@ var require_execution_time_fingerprint = __commonJS({
         scalar(ctx.branch),
         scalar(ctx.pull_request),
         scalar(ctx.policy_profile)
-      ].join(NUL));
-      return `sha256:${sha256hex(parts.join(NUL))}`;
+      ].join(US));
+      return `sha256:${sha256hex(parts.join(US))}`;
     }
     exports2.EXECUTION_TIME_FP_REASONS = Object.freeze({
       MATCH: "match",
@@ -66485,7 +66485,7 @@ var require_enforcement_gate = __commonJS({
     function isAction(v) {
       return v === "CONTINUE" || v === "CONTINUE_WITH_MONITORING" || v === "REQUEST_APPROVAL" || v === "STOP";
     }
-    var NUL = "";
+    var US = "";
     function sha256hex(s) {
       return (0, node_crypto_1.createHash)("sha256").update(s).digest("hex");
     }
@@ -66493,7 +66493,7 @@ var require_enforcement_gate = __commonJS({
       return v == null ? "" : typeof v === "string" ? v : JSON.stringify(v);
     }
     function computeArtifactDigest(artifacts) {
-      const preimage = artifacts.slice().sort((a, b) => `${a.type}${NUL}${a.id}` < `${b.type}${NUL}${b.id}` ? -1 : 1).map((a) => `${sha256hex(specStr(a.before))}${sha256hex(specStr(a.after))}`).join(NUL);
+      const preimage = artifacts.slice().sort((a, b) => `${a.type}${US}${a.id}` < `${b.type}${US}${b.id}` ? -1 : 1).map((a) => `${sha256hex(specStr(a.before))}${sha256hex(specStr(a.after))}`).join(US);
       return `sha256:${sha256hex(preimage)}`;
     }
     function computeBundleFingerprint(artifacts, context) {
@@ -66699,7 +66699,8 @@ var require_execution_proof = __commonJS({
         if (input.preflighted !== true || input.receiptVerified !== true) {
           throw new Error("@coderifts/agent-guard: enforced:true without receiptVerified+preflighted (runtime invariant)");
         }
-        if (input.requireConditionalWrite === true && input.writeStyle === true) {
+        const mutating = input.mutating === void 0 ? input.writeStyle === true : input.mutating === true;
+        if (input.requireConditionalWrite === true && mutating) {
           if (input.conditionalWrite !== true) {
             throw new Error("@coderifts/agent-guard: enforced:true without conditional_write:true under requireConditionalWrite (runtime invariant)");
           }
@@ -66763,6 +66764,7 @@ var require_execution_proof = __commonJS({
         receiptVerified,
         requireConditionalWrite: cwb?.require_conditional_write,
         writeStyle: cwb?.write_style,
+        mutating: cwb?.mutating,
         conditionalWrite: cwb?.conditional_write
       });
       const env = envelopeOf(input.verdict);
@@ -66854,6 +66856,7 @@ var require_freshness = __commonJS({
     exports2.assessWriteStylePrior = assessWriteStylePrior;
     exports2.freshnessAllowsEnforce = freshnessAllowsEnforce;
     exports2.isWriteStyleCall = isWriteStyleCall;
+    exports2.isMutatingCall = isMutatingCall;
     exports2.artifactIdsForResolve = artifactIdsForResolve;
     exports2.collectFreshnessCallContext = collectFreshnessCallContext;
     exports2.buildFreshnessBasis = buildFreshnessBasis;
@@ -66987,6 +66990,24 @@ var require_freshness = __commonJS({
       }
       return false;
     }
+    function isMutatingCall(call) {
+      const arts = call.artifacts;
+      if (Array.isArray(arts)) {
+        for (const a of arts) {
+          if (a && typeof a.after === "string" && a.after.length > 0)
+            return true;
+        }
+      }
+      const args = call.arguments && typeof call.arguments === "object" ? call.arguments : {};
+      for (const k of ["contents", "content", "new_string", "old_string", "patch"]) {
+        const v = args[k];
+        if (typeof v === "string" && v.length > 0)
+          return true;
+      }
+      if (Array.isArray(args.edits) && args.edits.length > 0)
+        return true;
+      return false;
+    }
     function artifactIdsForResolve(call) {
       const ids = [];
       if (Array.isArray(call.artifacts)) {
@@ -67159,12 +67180,14 @@ var require_conditional_write = __commonJS({
     function buildConditionalWriteBasis(input) {
       const require_conditional_write2 = input.requireConditionalWrite === true;
       const write_style = input.writeStyle === true;
+      const mutating = input.mutating === void 0 ? write_style : input.mutating === true;
       const ctx = input.ctx && typeof input.ctx === "object" ? input.ctx : {};
       const conditional_write = normalizeReport(ctx.conditional_write);
       const basis = {
         conditional_write,
         require_conditional_write: require_conditional_write2,
-        write_style
+        write_style,
+        mutating
       };
       if (conditional_write === true) {
         if (typeof ctx.conditioned_on_token === "string") {
@@ -67175,7 +67198,7 @@ var require_conditional_write = __commonJS({
           basis.conditioned_on_token = null;
         }
       }
-      if (write_style && require_conditional_write2 && conditional_write !== true) {
+      if (mutating && require_conditional_write2 && conditional_write !== true) {
         return { basis, blockCause: "CONDITIONAL_WRITE_REQUIRED" };
       }
       return { basis };
@@ -67184,7 +67207,8 @@ var require_conditional_write = __commonJS({
     function conditionalWriteResidual(input) {
       if (input.requireConditionalWrite !== true)
         return null;
-      if (input.writeStyle !== true)
+      const mutating = input.mutating === void 0 ? input.writeStyle === true : input.mutating === true;
+      if (!mutating)
         return null;
       if (input.conditionalWrite === true)
         return null;
@@ -70303,9 +70327,11 @@ var require_guard = __commonJS({
         allowStaleContext: config.allowStaleContext
       });
     }
-    function conditionalWriteFor(config, redacted, ctx) {
+    function conditionalWriteFor(config, redacted, ctx, detectedArts) {
+      const mutating = (0, freshness_js_1.isMutatingCall)(redacted) || Array.isArray(detectedArts) && (0, freshness_js_1.isMutatingCall)({ artifacts: detectedArts });
       return (0, conditional_write_js_1.buildConditionalWriteBasis)({
         writeStyle: (0, freshness_js_1.isWriteStyleCall)(redacted),
+        mutating,
         requireConditionalWrite: config.requireConditionalWrite === true,
         ctx
       });
@@ -70377,7 +70403,7 @@ var require_guard = __commonJS({
         }
       }
       {
-        const { blockCause } = conditionalWriteFor(config, redacted, cwctx);
+        const { blockCause } = conditionalWriteFor(config, redacted, cwctx, detection.artifacts);
         if (blockCause === "CONDITIONAL_WRITE_REQUIRED") {
           breakerRecord(config);
           return closedIntegrity(config, blockCause, failPolicy, fctx, cwctx, redacted, detection.artifacts);
@@ -70388,7 +70414,7 @@ var require_guard = __commonJS({
         const count = breakers.get(config)?.fails.length ?? 0;
         const v = unavailableVerdict({ cause: "MISSING_ARTIFACT_CONTENT", failPolicy, resolution: "CLOSED", action: "STOP" }, count);
         const { basis } = freshnessFor(config, redacted, fctx, detection.artifacts);
-        const { basis: cw } = conditionalWriteFor(config, redacted, cwctx);
+        const { basis: cw } = conditionalWriteFor(config, redacted, cwctx, detection.artifacts);
         return blocked(config, v, false, basis, cw);
       }
       if (failPolicy === "lkg" && !config.lkg) {
@@ -70425,7 +70451,7 @@ var require_guard = __commonJS({
         breakerRecord(config);
         const count = breakers.get(config)?.fails.length ?? 1;
         const { basis } = freshnessFor(config, redacted, fctx, detection.artifacts);
-        const { basis: cw } = conditionalWriteFor(config, redacted, cwctx);
+        const { basis: cw } = conditionalWriteFor(config, redacted, cwctx, detection.artifacts);
         if (pf.integrity) {
           emit(config, { type: "breaker_tripped", at: iso(), cause: pf.cause });
           const v2 = unavailableVerdict({ cause: pf.cause, failPolicy, resolution: "CLOSED", action: "STOP" }, count);
@@ -70493,7 +70519,7 @@ var require_guard = __commonJS({
       }
       if (gate.verdict === "block-strict") {
         const { basis } = freshnessFor(config, redacted, fctx, detection.artifacts);
-        const { basis: cw } = conditionalWriteFor(config, redacted, cwctx);
+        const { basis: cw } = conditionalWriteFor(config, redacted, cwctx, detection.artifacts);
         return gate.decision === "BLOCK" ? blocked(config, { kind: "BLOCK", action: "STOP", envelope, receiptVerified }, true, basis, cw, void 0, void 0, grantObs) : blocked(config, { kind: "APPROVAL", action: "REQUEST_APPROVAL", envelope, receiptVerified }, true, basis, cw, void 0, void 0, grantObs);
       }
       const kind = gate.kind;
@@ -70564,7 +70590,7 @@ var require_guard = __commonJS({
         breakerRecord(config);
         return closedIntegrity(config, freshBlock, failPolicy, fctx, cwctx, redacted, detection.artifacts, void 0, void 0, grantObs);
       }
-      const { basis: cwBasis, blockCause: cwBlock } = conditionalWriteFor(config, redacted, cwctx);
+      const { basis: cwBasis, blockCause: cwBlock } = conditionalWriteFor(config, redacted, cwctx, detection.artifacts);
       if (cwBlock === "CONDITIONAL_WRITE_REQUIRED") {
         breakerRecord(config);
         return closedIntegrity(config, cwBlock, failPolicy, fctx, cwctx, redacted, detection.artifacts, void 0, void 0, grantObs);
@@ -70639,7 +70665,7 @@ var require_guard = __commonJS({
       emit(config, { type: "breaker_tripped", at: iso(), cause });
       const v = unavailableVerdict({ cause, failPolicy, resolution: "CLOSED", action: "STOP" }, count);
       const { basis } = freshnessFor(config, redacted, fctx, arts);
-      const { basis: cw } = conditionalWriteFor(config, redacted, cwctx);
+      const { basis: cw } = conditionalWriteFor(config, redacted, cwctx, arts);
       return blocked(config, v, false, basis, cw, monitoring_delivery, monitoring_attestation, grantObs);
     }
     function isExpired(envelope) {
@@ -74818,7 +74844,8 @@ var require_execute_tool_call = __commonJS({
     var CW_NOT_REPORTED = Object.freeze({
       conditional_write: "not_reported",
       require_conditional_write: false,
-      write_style: false
+      write_style: false,
+      mutating: false
     });
     function notObserved() {
       return {
@@ -75271,9 +75298,9 @@ var require_cjs4 = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.monitorAttestSigningInput = exports2.kidFromMonitoringAttestation = exports2.tryIssueMonitoringAttestation = exports2.DEFAULT_MONITORING_SINK_TIMEOUT_MS = exports2.ackBytes = exports2.verifyAckHmac = exports2.monitoringDeliveryFailClosed = exports2.formatMonitoringDeliveryLine = exports2.deliverMonitoring = exports2.hashObservedContent = exports2.observeCommit = exports2.deriveKeySignal = exports2.pathClass = exports2.classifyCommand = exports2.projectState = exports2.emptySessionState = exports2.computeTainted = exports2.evaluate = exports2.updateSession = exports2.SESSION_TAINT_VERSION = exports2.SessionTaintTracker = exports2.readDecision = exports2.EXECUTION_TIME_FP_REASONS = exports2.EXECUTION_STATE_UNMEASURABLE_NOTE = exports2.isUnmeasurableExecutionStateReason = exports2.computeCanonicalBundleFingerprint = exports2.authorizedFingerprintFromEnvelope = exports2.checkExecutionTimeFingerprint = exports2.computeBundleFingerprint = exports2.computeArtifactDigest = exports2.evaluateEnvelope = exports2.RECEIPT_PREV_NULL = exports2.decodeReceiptBodyPrev = exports2.previousReceiptCommitment = exports2.verifyReceiptChainLinkage = exports2.canonicalJson = exports2.computeBodyHash = exports2.bindReceiptToEnvelope = exports2.DETECTOR_VERSION = exports2.builtinDetector = exports2.resetPolicyWarnForTests = exports2.warnPolicyAbsentOnce = exports2.observePolicyPresence = exports2.detectPolicyPresence = exports2.policyPresenceOf = exports2.withPolicy = exports2.POLICY_ABSENT_WARN = exports2.POLICY_MARKER = exports2.CODERIFTS_POLICY = exports2.guardToolCall = void 0;
-    exports2.createRegistryVersionToken = exports2.DB_ABSENT_TOKEN = exports2.DB_VERSION_TOKEN_PREFIX = exports2.dbTokenRaw = exports2.writeDbIfUnchanged = exports2.createDbVersionToken = exports2.API_ABSENT_TOKEN = exports2.API_VERSION_TOKEN_PREFIX = exports2.apiTokenRaw = exports2.writeApiIfUnchanged = exports2.createApiVersionToken = exports2.FS_ABSENT_TOKEN = exports2.FS_VERSION_TOKEN_PREFIX = exports2.fsTokenContentHash = exports2.createFsPriorContentResolver = exports2.writeFileIfUnchanged = exports2.readVersionedFile = exports2.createFsVersionToken = exports2.StaleVersionTokenAbort = exports2.executeIfUnchanged = exports2.RESIDUAL_UNCONDITIONAL_WRITE = exports2.conditionalWriteResidual = exports2.tokensEqual = exports2.buildConditionalWriteBasis = exports2.buildFreshnessBasis = exports2.collectFreshnessCallContext = exports2.artifactIdsForResolve = exports2.isWriteStyleCall = exports2.freshnessAllowsEnforce = exports2.computePathSetTreeHash = exports2.contentByteIdentical = exports2.assessWriteStylePrior = exports2.assessFreshness = exports2.deriveProofBanner = exports2.attachProofToAgentResponse = exports2.renderFinalAnswerProof = exports2.EXECUTION_PROOF_SPEC = exports2.assertEnforcedReceiptInvariant = exports2.hashExecutionResult = exports2.buildExecutionProof = exports2.COVERAGE_ATTEST_ENVELOPE_TAG = exports2.COVERAGE_ATTEST_SIGNING_PREFIX = exports2.COVERAGE_ATTEST_VERSION = exports2.coverageAttestSigningInput = exports2.kidFromCoverageAttestation = exports2.tryIssueCoverageAttestation = exports2.MONITOR_ATTEST_ENVELOPE_TAG = exports2.MONITOR_ATTEST_SIGNING_PREFIX = exports2.MONITOR_ATTEST_VERSION = exports2.receiptDigestOfToken = void 0;
-    exports2.formatCoverageObservedLine = exports2.freezeCoverageObserved = exports2.createCoverageObserver = exports2.readExecutionGrantToken = exports2.isExecutionGrantEnabled = exports2.guardedFractionAmongRoutes = exports2.foldTableSettledCalls = exports2.withCodeRifts = exports2.AUTO_DERIVE_READ_TIMEOUT_MS = exports2.AUTO_DERIVE_SOURCE = exports2.defaultFsReader = exports2.normalizeAutoDerive = exports2.runAutoDerive = exports2.AUTO_RECHECK_MAX_CAP = exports2.clampMaxAttempts = exports2.normalizeAutoRecheck = exports2.runAutoRecheckLoop = exports2.coverageReport = exports2.DEPLOY_REPAIRABLE_REASONS = exports2.bindDeploy = exports2.verifyDeployReceiptToken = exports2.DEPLOY_RECEIPT_VIEW_SPEC = exports2.isVerifiedDeployReceiptView = exports2.asVerifiedDeployReceiptView = exports2.deployGate = exports2.gateDecision = exports2.RegistryConstructionError = exports2.guardToolRegistry = exports2.globToRegExp = exports2.matchGlob = exports2.blobMapKey = exports2.classifyByName = exports2.resolveArtifacts = exports2.REMEDIATION_LOOP_ATTESTATION_SPEC = exports2.isCasAttestation = exports2.readPriorBlockRemediation = exports2.readRemediationTransaction = exports2.buildRemediationLoopAttestation = exports2.COMMIT_EVIDENCE_MISSING = exports2.CAS_ATTESTATION_SPEC = exports2.strictCommitObservation = exports2.extractExecutorAttestationToken = exports2.evaluateCasEvidence = exports2.isExecuteIfUnchangedOutcome = exports2.isGuardExecutionProof = exports2.buildCasAttestation = exports2.REGISTRY_ABSENT_TOKEN = exports2.REGISTRY_VERSION_TOKEN_PREFIX = exports2.registryTokenRaw = exports2.writeRegistryIfUnchanged = void 0;
-    exports2.kidFromToolsetAttestation = exports2.tryIssueToolsetAttestation = exports2.toolsetAttestSigningInput = exports2.declarationEntriesFromTools = exports2.computeToolsetDigest = exports2.TOOLSET_ATTEST_STATEMENT = exports2.TOOLSET_ATTEST_ENVELOPE_TAG = exports2.TOOLSET_ATTEST_SIGNING_PREFIX = exports2.TOOLSET_ATTEST_VERSION = exports2.surfaceEnvelopeFields = exports2.isGuardOutcome = exports2.executeLangGraphToolCall = exports2.executeGeminiToolCall = exports2.executeAnthropicToolCall = exports2.executeOpenAIToolCall = exports2.executeProtectedTool = exports2.defaultSerializeGeminiToolResult = exports2.bindGeminiGuardOutcome = exports2.protectedToolToFunctionDeclaration = exports2.toGeminiTools = exports2.geminiToolAdapter = exports2.withCodeRiftsGemini = exports2.wrapWriteWithFsCas = exports2.inferFullFileWriteContent = exports2.inferFsPathFromArgs = exports2.FRESHNESS_RESOLVER_FIX = exports2.freshnessRefusalTeaching = exports2.formatGateRefusalBody = exports2.defaultSerializeLangGraphToolResult = exports2.bindLangGraphGuardOutcome = exports2.LangGraphToolsNotStructuredError = exports2.isLangGraphReactAgentTool = exports2.bindLangGraphTools = exports2.protectedToolToLangGraph = exports2.toLangGraphTools = exports2.langGraphToolAdapter = exports2.withCodeRiftsLangGraph = exports2.defaultSerializeAnthropicToolResult = exports2.bindAnthropicGuardOutcome = exports2.protectedToolToAnthropic = exports2.toAnthropicTools = exports2.anthropicToolAdapter = exports2.withCodeRiftsAnthropic = exports2.defaultSerializeOpenAIToolResult = exports2.bindOpenAIGuardOutcome = exports2.protectedToolToOpenAI = exports2.toOpenAITools = exports2.openAIToolAdapter = exports2.withCodeRiftsOpenAI = void 0;
+    exports2.DB_ABSENT_TOKEN = exports2.DB_VERSION_TOKEN_PREFIX = exports2.dbTokenRaw = exports2.writeDbIfUnchanged = exports2.createDbVersionToken = exports2.API_ABSENT_TOKEN = exports2.API_VERSION_TOKEN_PREFIX = exports2.apiTokenRaw = exports2.writeApiIfUnchanged = exports2.createApiVersionToken = exports2.FS_ABSENT_TOKEN = exports2.FS_VERSION_TOKEN_PREFIX = exports2.fsTokenContentHash = exports2.createFsPriorContentResolver = exports2.writeFileIfUnchanged = exports2.readVersionedFile = exports2.createFsVersionToken = exports2.StaleVersionTokenAbort = exports2.executeIfUnchanged = exports2.RESIDUAL_UNCONDITIONAL_WRITE = exports2.conditionalWriteResidual = exports2.tokensEqual = exports2.buildConditionalWriteBasis = exports2.buildFreshnessBasis = exports2.collectFreshnessCallContext = exports2.artifactIdsForResolve = exports2.isMutatingCall = exports2.isWriteStyleCall = exports2.freshnessAllowsEnforce = exports2.computePathSetTreeHash = exports2.contentByteIdentical = exports2.assessWriteStylePrior = exports2.assessFreshness = exports2.deriveProofBanner = exports2.attachProofToAgentResponse = exports2.renderFinalAnswerProof = exports2.EXECUTION_PROOF_SPEC = exports2.assertEnforcedReceiptInvariant = exports2.hashExecutionResult = exports2.buildExecutionProof = exports2.COVERAGE_ATTEST_ENVELOPE_TAG = exports2.COVERAGE_ATTEST_SIGNING_PREFIX = exports2.COVERAGE_ATTEST_VERSION = exports2.coverageAttestSigningInput = exports2.kidFromCoverageAttestation = exports2.tryIssueCoverageAttestation = exports2.MONITOR_ATTEST_ENVELOPE_TAG = exports2.MONITOR_ATTEST_SIGNING_PREFIX = exports2.MONITOR_ATTEST_VERSION = exports2.receiptDigestOfToken = void 0;
+    exports2.freezeCoverageObserved = exports2.createCoverageObserver = exports2.readExecutionGrantToken = exports2.isExecutionGrantEnabled = exports2.guardedFractionAmongRoutes = exports2.foldTableSettledCalls = exports2.withCodeRifts = exports2.AUTO_DERIVE_READ_TIMEOUT_MS = exports2.AUTO_DERIVE_SOURCE = exports2.defaultFsReader = exports2.normalizeAutoDerive = exports2.runAutoDerive = exports2.AUTO_RECHECK_MAX_CAP = exports2.clampMaxAttempts = exports2.normalizeAutoRecheck = exports2.runAutoRecheckLoop = exports2.coverageReport = exports2.DEPLOY_REPAIRABLE_REASONS = exports2.bindDeploy = exports2.verifyDeployReceiptToken = exports2.DEPLOY_RECEIPT_VIEW_SPEC = exports2.isVerifiedDeployReceiptView = exports2.asVerifiedDeployReceiptView = exports2.deployGate = exports2.gateDecision = exports2.RegistryConstructionError = exports2.guardToolRegistry = exports2.globToRegExp = exports2.matchGlob = exports2.blobMapKey = exports2.classifyByName = exports2.resolveArtifacts = exports2.REMEDIATION_LOOP_ATTESTATION_SPEC = exports2.isCasAttestation = exports2.readPriorBlockRemediation = exports2.readRemediationTransaction = exports2.buildRemediationLoopAttestation = exports2.COMMIT_EVIDENCE_MISSING = exports2.CAS_ATTESTATION_SPEC = exports2.strictCommitObservation = exports2.extractExecutorAttestationToken = exports2.evaluateCasEvidence = exports2.isExecuteIfUnchangedOutcome = exports2.isGuardExecutionProof = exports2.buildCasAttestation = exports2.REGISTRY_ABSENT_TOKEN = exports2.REGISTRY_VERSION_TOKEN_PREFIX = exports2.registryTokenRaw = exports2.writeRegistryIfUnchanged = exports2.createRegistryVersionToken = void 0;
+    exports2.kidFromToolsetAttestation = exports2.tryIssueToolsetAttestation = exports2.toolsetAttestSigningInput = exports2.declarationEntriesFromTools = exports2.computeToolsetDigest = exports2.TOOLSET_ATTEST_STATEMENT = exports2.TOOLSET_ATTEST_ENVELOPE_TAG = exports2.TOOLSET_ATTEST_SIGNING_PREFIX = exports2.TOOLSET_ATTEST_VERSION = exports2.surfaceEnvelopeFields = exports2.isGuardOutcome = exports2.executeLangGraphToolCall = exports2.executeGeminiToolCall = exports2.executeAnthropicToolCall = exports2.executeOpenAIToolCall = exports2.executeProtectedTool = exports2.defaultSerializeGeminiToolResult = exports2.bindGeminiGuardOutcome = exports2.protectedToolToFunctionDeclaration = exports2.toGeminiTools = exports2.geminiToolAdapter = exports2.withCodeRiftsGemini = exports2.wrapWriteWithFsCas = exports2.inferFullFileWriteContent = exports2.inferFsPathFromArgs = exports2.FRESHNESS_RESOLVER_FIX = exports2.freshnessRefusalTeaching = exports2.formatGateRefusalBody = exports2.defaultSerializeLangGraphToolResult = exports2.bindLangGraphGuardOutcome = exports2.LangGraphToolsNotStructuredError = exports2.isLangGraphReactAgentTool = exports2.bindLangGraphTools = exports2.protectedToolToLangGraph = exports2.toLangGraphTools = exports2.langGraphToolAdapter = exports2.withCodeRiftsLangGraph = exports2.defaultSerializeAnthropicToolResult = exports2.bindAnthropicGuardOutcome = exports2.protectedToolToAnthropic = exports2.toAnthropicTools = exports2.anthropicToolAdapter = exports2.withCodeRiftsAnthropic = exports2.defaultSerializeOpenAIToolResult = exports2.bindOpenAIGuardOutcome = exports2.protectedToolToOpenAI = exports2.toOpenAITools = exports2.openAIToolAdapter = exports2.withCodeRiftsOpenAI = exports2.formatCoverageObservedLine = void 0;
     var guard_js_1 = require_guard();
     Object.defineProperty(exports2, "guardToolCall", { enumerable: true, get: function() {
       return guard_js_1.guardToolCall;
@@ -75509,6 +75536,9 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "isWriteStyleCall", { enumerable: true, get: function() {
       return freshness_js_1.isWriteStyleCall;
     } });
+    Object.defineProperty(exports2, "isMutatingCall", { enumerable: true, get: function() {
+      return freshness_js_1.isMutatingCall;
+    } });
     Object.defineProperty(exports2, "artifactIdsForResolve", { enumerable: true, get: function() {
       return freshness_js_1.artifactIdsForResolve;
     } });
@@ -253945,6 +253975,16 @@ var require_github_enforcement = __commonJS({
       RULESET_ABSENT: "ruleset_absent",
       /** Rulesets could not be read at all. */
       RULESET_UNREADABLE: "ruleset_unreadable",
+      /** A ruleset requires our context but does not TARGET the branch that matters (1104a). */
+      RULESET_REF_NOT_TARGETED: "ruleset_ref_not_targeted",
+      /** Active, bound, targeted — but strict latest-head is off (1104b). Recorded, not fatal. */
+      RULESET_STRICT_POLICY_OFF: "ruleset_strict_policy_off",
+      /** 1102 — no active targeting ruleset requires a workflow at all. */
+      REQUIRED_WORKFLOW_ABSENT: "required_workflow_absent",
+      /** 1102 — a workflows rule exists but carries no sha, so it names a path and not bytes. */
+      REQUIRED_WORKFLOW_UNPINNED: "required_workflow_unpinned",
+      /** 1102 — a required workflow is pinned to a full commit sha. */
+      REQUIRED_WORKFLOW_SHA_PINNED: "required_workflow_sha_pinned",
       REQUIRED_CHECK_ABSENT: "required_check_absent",
       ACTIVE_JOB: "active_job",
       NO_ACTIVE_JOB: "no_active_job",
@@ -253975,6 +254015,41 @@ var require_github_enforcement = __commonJS({
       const n = Number(value);
       return Number.isInteger(n) && n > 0 ? n : null;
     }
+    function refPatterns(rs, key) {
+      const rn = rs && rs.conditions && rs.conditions.ref_name;
+      if (!rn || !Array.isArray(rn[key])) return null;
+      return rn[key].map((x) => String(x));
+    }
+    function targetsDefaultBranch(entry, defaultBranch) {
+      if (entry.target === "tag") return false;
+      const inc = entry.ref_include;
+      if (!Array.isArray(inc)) return null;
+      const ref = defaultBranch ? `refs/heads/${defaultBranch}` : null;
+      const matches = (pat) => {
+        if (pat === "~ALL" || pat === "~DEFAULT_BRANCH") return true;
+        if (!ref) return null;
+        if (pat === ref) return true;
+        if (!pat.includes("*") && !pat.includes("[") && !pat.includes("?")) return false;
+        const rx = new RegExp(`^${pat.replace(/[.+^${}()|\\]/g, "\\$&").replace(/\*/g, "[^/]*").replace(/\?/g, ".")}$`);
+        return rx.test(ref);
+      };
+      let included = false;
+      for (const pat of inc) {
+        const m = matches(pat);
+        if (m === null) return null;
+        if (m) {
+          included = true;
+          break;
+        }
+      }
+      if (!included) return false;
+      for (const pat of entry.ref_exclude || []) {
+        const m = matches(pat);
+        if (m === null) return null;
+        if (m) return false;
+      }
+      return true;
+    }
     function rulesetRequiredCheckEntries(rulesets) {
       const out = [];
       const list = Array.isArray(rulesets) ? rulesets : [];
@@ -253993,7 +254068,15 @@ var require_github_enforcement = __commonJS({
               enforcement: typeof rs.enforcement === "string" ? rs.enforcement : null,
               integration_id: numericAppId(c && c.integration_id),
               bypass_visible: Object.prototype.hasOwnProperty.call(rs, "bypass_actors"),
-              bypass_count: Array.isArray(rs.bypass_actors) ? rs.bypass_actors.length : null
+              bypass_count: Array.isArray(rs.bypass_actors) ? rs.bypass_actors.length : null,
+              // 1104a — a ruleset can be ACTIVE and target nothing that matters. MEASURED against the
+              // live API: `target` and `conditions.ref_name` are both in the detail document we already
+              // fetch, so this is a grading change and needs no new call.
+              target: typeof rs.target === "string" ? rs.target : null,
+              ref_include: refPatterns(rs, "include"),
+              ref_exclude: refPatterns(rs, "exclude"),
+              // 1104b — same document, one boolean.
+              strict_policy: typeof params.strict_required_status_checks_policy === "boolean" ? params.strict_required_status_checks_policy : null
             });
           }
         }
@@ -254001,7 +254084,7 @@ var require_github_enforcement = __commonJS({
       return out;
     }
     var RULESET_BYPASS_CAVEAT = " Bypass actors were not readable on this surface, so this does not establish that nobody can bypass the ruleset.";
-    function evaluateRuleset(rulesets) {
+    function evaluateRuleset(rulesets, defaultBranch = null) {
       if (rulesets == null) {
         return {
           status: STATUS.UNVERIFIABLE,
@@ -254032,12 +254115,41 @@ var require_github_enforcement = __commonJS({
       }
       const bound = active.find((e) => e.integration_id === ENFORCING_ISSUER_APP_ID);
       if (bound) {
+        const targeted = targetsDefaultBranch(bound, defaultBranch);
+        if (targeted === false) {
+          return {
+            status: STATUS.NOT_VERIFIED,
+            reason_code: REASON.RULESET_REF_NOT_TARGETED,
+            reason: `active ruleset "${bound.ruleset}" requires "${CHECK_NAME}" bound to the enforcing issuer, but its conditions do not target ${defaultBranch ? `refs/heads/${defaultBranch}` : "the default branch"}${bound.target === "tag" ? " (the ruleset targets tags, which never gate a merge to a branch)" : ""} \u2014 include: ${JSON.stringify(bound.ref_include)}, exclude: ${JSON.stringify(bound.ref_exclude || [])}`,
+            ruleset_names: names,
+            app_id: ENFORCING_ISSUER_APP_ID,
+            ref_targeted: false
+          };
+        }
+        if (targeted === null) {
+          return {
+            status: STATUS.UNVERIFIABLE,
+            reason_code: REASON.RULESET_REF_NOT_TARGETED,
+            reason: `active ruleset "${bound.ruleset}" binds "${CHECK_NAME}" to the enforcing issuer, but its ref conditions could not be read, so whether it targets the branch that matters CANNOT BE DETERMINED FROM HERE.${RULESET_BYPASS_CAVEAT}`,
+            ruleset_names: names,
+            app_id: ENFORCING_ISSUER_APP_ID,
+            ref_targeted: null
+          };
+        }
         return {
           status: STATUS.VERIFIED,
           reason_code: REASON.RULESET_ISSUER_BOUND,
-          reason: `active ruleset "${bound.ruleset}" requires "${CHECK_NAME}" bound to integration_id ${ENFORCING_ISSUER_APP_ID} (${GITHUB_ACTIONS_APP_SLUG}) \u2014 the contract-gate Action, which concludes failure and blocks the merge.${RULESET_BYPASS_CAVEAT}`,
+          reason: `active ruleset "${bound.ruleset}" requires "${CHECK_NAME}" bound to integration_id ${ENFORCING_ISSUER_APP_ID} (${GITHUB_ACTIONS_APP_SLUG}) \u2014 the contract-gate Action, which concludes failure and blocks the merge. It targets ${defaultBranch ? `refs/heads/${defaultBranch}` : "the default branch"}.` + (bound.strict_policy === true ? " strict_required_status_checks_policy is ON, so a stale head cannot merge." : bound.strict_policy === false ? " RESIDUAL: strict_required_status_checks_policy is OFF, so a branch whose head is behind the base can merge on a check that passed against older bytes." : " strict_required_status_checks_policy was not readable here.") + RULESET_BYPASS_CAVEAT,
           ruleset_names: names,
-          app_id: ENFORCING_ISSUER_APP_ID
+          app_id: ENFORCING_ISSUER_APP_ID,
+          ref_targeted: true,
+          strict_policy: bound.strict_policy,
+          strict_policy_residual: bound.strict_policy === false ? REASON.RULESET_STRICT_POLICY_OFF : null,
+          // 1104c — NEVER an absence we cannot see. bypass_actors is in the ruleset schema but was
+          // absent from all six live rulesets read without a credential (measured 2026-08-27), so
+          // "not present in the response" is reported as NOT VISIBLE and never as "none configured".
+          bypass_visible: bound.bypass_visible === true,
+          bypass_count: bound.bypass_visible === true ? bound.bypass_count : null
         };
       }
       const other = active.find((e) => e.integration_id != null);
@@ -254058,9 +254170,66 @@ var require_github_enforcement = __commonJS({
         ruleset_names: names
       };
     }
-    function evaluateRequiredCheckAcrossSurfaces(protection, rulesets) {
+    function evaluateRequiredWorkflowPin(rulesets, defaultBranch = null) {
+      if (rulesets == null) {
+        return { status: STATUS.UNVERIFIABLE, reason_code: REASON.RULESET_UNREADABLE, pinned: null, workflows: [] };
+      }
+      const found = [];
+      for (const rs of Array.isArray(rulesets) ? rulesets : []) {
+        if (!rs || typeof rs !== "object") continue;
+        if (rs.enforcement !== "active") continue;
+        const entryShape = {
+          target: typeof rs.target === "string" ? rs.target : null,
+          ref_include: refPatterns(rs, "include"),
+          ref_exclude: refPatterns(rs, "exclude")
+        };
+        if (targetsDefaultBranch(entryShape, defaultBranch) !== true) continue;
+        for (const rule of Array.isArray(rs.rules) ? rs.rules : []) {
+          if (!rule || rule.type !== "workflows") continue;
+          const list = rule.parameters && Array.isArray(rule.parameters.workflows) ? rule.parameters.workflows : [];
+          for (const w of list) {
+            if (!w || typeof w !== "object") continue;
+            found.push({
+              ruleset: String(rs.name || rs.id || "ruleset"),
+              path: typeof w.path === "string" ? w.path : null,
+              repository_id: Number.isInteger(w.repository_id) ? w.repository_id : null,
+              ref: typeof w.ref === "string" ? w.ref : null,
+              // The whole question. sha is optional in the schema, so its ABSENCE is the finding.
+              sha: typeof w.sha === "string" && /^[0-9a-f]{40}$/i.test(w.sha) ? w.sha : null
+            });
+          }
+        }
+      }
+      if (found.length === 0) {
+        return {
+          status: STATUS.NOT_VERIFIED,
+          reason_code: REASON.REQUIRED_WORKFLOW_ABSENT,
+          pinned: false,
+          workflows: [],
+          reason: `no active ruleset targeting this branch requires a workflow, so the check that gates the merge is bound only to the SHARED issuer ${ENFORCING_ISSUER_APP_ID} (${GITHUB_ACTIONS_APP_SLUG}) \u2014 anyone who can edit .github/workflows can post under it`
+        };
+      }
+      const pinned = found.filter((w) => w.sha != null);
+      if (pinned.length === 0) {
+        return {
+          status: STATUS.NOT_VERIFIED,
+          reason_code: REASON.REQUIRED_WORKFLOW_UNPINNED,
+          pinned: false,
+          workflows: found,
+          reason: `a required workflow is configured (${found.map((w) => w.path || "?").join(", ")}) but NONE carries a sha. \`sha\` is optional in the rule schema, and without it the ruleset names a path rather than bytes, so rewriting that file still changes what runs`
+        };
+      }
+      return {
+        status: STATUS.VERIFIED,
+        reason_code: REASON.REQUIRED_WORKFLOW_SHA_PINNED,
+        pinned: true,
+        workflows: found,
+        reason: `active ruleset "${pinned[0].ruleset}" requires workflow ${pinned[0].path} pinned to sha ${pinned[0].sha} in repository_id ${pinned[0].repository_id}. Moving that pin requires editing the ruleset (repository administration), which is a different permission from workflow write. This does NOT establish that any pull request ran it, nor that bypass actors cannot skip the ruleset.`
+      };
+    }
+    function evaluateRequiredCheckAcrossSurfaces(protection, rulesets, defaultBranch = null) {
       const classic = evaluateRequiredCheck(protection);
-      const ruleset = evaluateRuleset(rulesets);
+      const ruleset = evaluateRuleset(rulesets, defaultBranch);
       const merged = (base) => ({
         ...base,
         surfaces_inspected: ["classic_branch_protection", rulesets == null ? "rulesets:unread" : "rulesets"],
@@ -254180,8 +254349,22 @@ var require_github_enforcement = __commonJS({
     var STATUS = Object.freeze({
       VERIFIED: "VERIFIED",
       NOT_VERIFIED: "NOT_VERIFIED",
-      UNVERIFIABLE: "UNVERIFIABLE"
-    });
+      UNVERIFIABLE: "UNVERIFIABLE",
+      UNSUPPORTED_PLAN: "UNSUPPORTED_PLAN",
+      PROVIDER_ERROR: "PROVIDER_ERROR"
+    });
+    var FRESHNESS = Object.freeze({ FRESH: "FRESH", STALE_EVIDENCE: "STALE_EVIDENCE" });
+    function supportsStrongClaim(status) {
+      return status === STATUS.VERIFIED;
+    }
+    var EVIDENCE_TTL_SECONDS = 3600;
+    function evidenceFreshness(report, nowIso) {
+      if (!report || !report.expires_at) return null;
+      const now = Date.parse(nowIso || (/* @__PURE__ */ new Date()).toISOString());
+      const exp = Date.parse(report.expires_at);
+      if (!Number.isFinite(now) || !Number.isFinite(exp)) return null;
+      return now > exp ? FRESHNESS.STALE_EVIDENCE : FRESHNESS.FRESH;
+    }
     function resolveGitHubAuth(env = process.env) {
       const user = String(env && (env.GITHUB_TOKEN || env.GH_TOKEN) || "").trim();
       if (user) {
@@ -254512,6 +254695,10 @@ var require_github_enforcement = __commonJS({
       NO_TOKEN_INSTRUCTION,
       LAYER_IDS,
       STATUS,
+      FRESHNESS,
+      EVIDENCE_TTL_SECONDS,
+      supportsStrongClaim,
+      evidenceFreshness,
       REASON,
       CHECK_NAME,
       GATE_ACTION,
@@ -254525,6 +254712,8 @@ var require_github_enforcement = __commonJS({
       evaluateLayers,
       evaluateRequiredCheck,
       evaluateRuleset,
+      evaluateRequiredWorkflowPin,
+      targetsDefaultBranch,
       evaluateRequiredCheckAcrossSurfaces,
       verifiedRequiresBinding,
       scanLocalWorkflows,
@@ -254911,7 +255100,7 @@ var require_setup_required_check = __commonJS({
         }
       } catch {
       }
-      const rulesetVerdict = evaluateRuleset(rulesetDocs);
+      const rulesetVerdict = evaluateRuleset(rulesetDocs, branch);
       const rulesetNamed = detectRulesetRequiredCheck(rulesetDocs || [], CHECK_NAME);
       const ruleset = {
         enforced: rulesetVerdict.status === STATUS.VERIFIED,
@@ -255284,6 +255473,8 @@ var require_enforce_check = __commonJS({
     var chalk = require_source();
     var {
       EVIDENCE_SPEC,
+      EVIDENCE_TTL_SECONDS,
+      supportsStrongClaim,
       APP_INSTALLATION,
       NO_TOKEN_INSTRUCTION,
       resolveGitHubAuth,
@@ -255295,6 +255486,35 @@ var require_enforce_check = __commonJS({
     var { isValidRepo } = require_status();
     var { resolveOwnerRepo } = require_setup_required_check();
     if (process.env.NO_COLOR) chalk.level = 0;
+    var crypto = require("node:crypto");
+    var EVIDENCE_SCOPE = Object.freeze({
+      grades: "repository configuration \u2014 what the provider would require of any pull request",
+      covers: Object.freeze([
+        "required status check present and named exactly",
+        "the check bound to an issuer that can block (integration_id / app_id)",
+        "ruleset enforcement is active rather than evaluate",
+        "the ruleset targets the branch that matters",
+        "strict latest-head policy recorded",
+        "bypass actors reported as VISIBLE or NOT VISIBLE, never as absent"
+      ]),
+      does_not_cover: Object.freeze([
+        "which GitHub App actually posted a check run on any pull request",
+        "the head_sha a check run executed against",
+        "whether any check run concluded success",
+        "a recomputable external proof hash over a specific run"
+      ]),
+      why_not: "Those are facts about one pull request at one moment, not about configuration. Reading them needs a per-PR check-runs query this command does not make; a passing config is not a passing run."
+    });
+    function responseDigest(read) {
+      if (!read) return null;
+      return {
+        endpoint: read.endpoint ? `GET ${read.endpoint}` : null,
+        http_status: read.status == null ? null : read.status,
+        // Hash of the BODY as we received it. Not the verdict — the INPUT to the verdict, so a
+        // disagreement can be localised to the answer or to our grading of it.
+        body_sha256: read.body === void 0 || read.body === null ? null : `sha256:${crypto.createHash("sha256").update(JSON.stringify(read.body)).digest("hex")}`
+      };
+    }
     var USAGE = [
       "Usage: coderifts enforce --check --repo owner/repo [--env <github-environment>] [--branch <name>] [--json]",
       "",
@@ -255407,7 +255627,12 @@ var require_enforce_check = __commonJS({
         const report2 = {
           command: "enforce --check",
           spec: EVIDENCE_SPEC,
+          // OBSERVED_AT WAS NOT ADDED. `queried_at` already carries exactly that fact, and a
+          // second name for one fact is the defect this round was told to look for.
           queried_at: queriedAt,
+          expires_at: new Date(Date.parse(queriedAt) + EVIDENCE_TTL_SECONDS * 1e3).toISOString(),
+          evidence_ttl_seconds: EVIDENCE_TTL_SECONDS,
+          evidence_scope: EVIDENCE_SCOPE,
           repo: `${ownerRepo.owner}/${ownerRepo.repo}`,
           branch: options.branch || null,
           environment: environmentName,
@@ -255451,14 +255676,33 @@ var require_enforce_check = __commonJS({
       const report = {
         command: "enforce --check",
         spec: EVIDENCE_SPEC,
+        // OBSERVED_AT WAS NOT ADDED. `queried_at` already carries exactly that fact, and a
+        // second name for one fact is the defect this round was told to look for.
         queried_at: queriedAt,
+        expires_at: new Date(Date.parse(queriedAt) + EVIDENCE_TTL_SECONDS * 1e3).toISOString(),
+        evidence_ttl_seconds: EVIDENCE_TTL_SECONDS,
+        evidence_scope: EVIDENCE_SCOPE,
         repo: `${ownerRepo.owner}/${ownerRepo.repo}`,
         branch,
         environment: environmentName,
         provider: "github",
         auth: authPublic,
+        // The raw answers behind the verdict, so a disagreement can be localised to the provider's
+        // response or to our grading of it.
+        responses: {
+          protection: responseDigest(protectionRead),
+          environment: responseDigest(environmentRead)
+        },
         ...evaluated
       };
+      if (report.claim && report.claim.inescapable_deploy === true) {
+        const unsupported = (report.layers || []).filter((l) => !supportsStrongClaim(l.status));
+        if (unsupported.length > 0) {
+          throw new Error(
+            `enforce --check: inescapable_deploy is true with ${unsupported.length} layer(s) not VERIFIED (${unsupported.map((l) => `${l.id}=${l.status}`).join(", ")}) \u2014 refusing to emit`
+          );
+        }
+      }
       if (options.json) log(JSON.stringify(report, null, 2));
       else log(renderHuman(report));
       return { exitCode: 0, report };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coderifts",
-  "version": "5.0.0",
+  "version": "6.0.0",
   "description": "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
   "author": "CodeRifts <hello@coderifts.com>",
   "license": "MIT",
@@ -39,13 +39,13 @@
   },
   "scripts": {
     "build": "node scripts/copy-corpus.js && node scripts/build.js",
-    "prepublishOnly": "node scripts/assert-guard-major.js && bash ../../scripts/freeze-gate.sh && npm run build",
+    "prepublishOnly": "node scripts/assert-guard-major.js && node scripts/assert-changelog-version.js && bash ../../scripts/freeze-gate.sh && npm run build",
     "assert-guard-major": "node scripts/assert-guard-major.js",
     "postinstall": "node scripts/postinstall.js",
     "test": "node --test test/*.test.js"
   },
   "dependencies": {
-    "@coderifts/agent-guard": "^11.0.0",
+    "@coderifts/agent-guard": "^12.0.0",
     "chalk": "^4.1.2",
     "cli-table3": "^0.6.4",
     "commander": "^12.0.0",

package/scripts/assert-changelog-version.js

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * CLI release gate (prepublishOnly): refuse to publish a version the CHANGELOG does not name.
+ *
+ * WHY THIS EXISTS — measured, not hypothetical. On 2026-08-27 packages/cli/CHANGELOG.md listed
+ * 4.10.0 and then "Unreleased", while npm carried 4.11.0, 4.12.0, 5.0.0 and 5.0.1. Four published
+ * versions were undocumented and a fifth (5.0.0) was published while still labelled Unreleased.
+ * Two distinct failure modes produced that, and BOTH are caught by the one check below:
+ *
+ *   1. The bump commit never touched the changelog at all. Measured: of the last eight CLI version
+ *      bumps, four omitted it (4.11.0, 4.12.0, 4.13.0, 5.0.1) — and those four are exactly the
+ *      versions that went missing. The correlation is not partial.
+ *   2. The bump commit DID write the entry, but under "## Unreleased", and nobody retitled it at
+ *      publish. Atomicity alone does not save you: @coderifts/agent-guard 12.0.0 was written
+ *      atomically and still shipped as "Unreleased", and 11.0.1 before it had to retitle a stale
+ *      heading by hand.
+ *
+ * So the invariant is NOT "the bump touched the changelog" — it is that the version being published
+ * appears as its own heading. A human step that must be remembered at publish time is the step that
+ * gets skipped; this makes it fail the publish instead.
+ *
+ * Dependency-free on purpose: a publish gate that needs an install to run is a gate that stops
+ * running (same reasoning as assert-guard-major.js).
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const PKG_PATH = path.join(__dirname, '..', 'package.json');
+const CHANGELOG_PATH = path.join(__dirname, '..', 'CHANGELOG.md');
+
+function fail(msg) {
+  console.error(`assert-changelog-version: FAIL — ${msg}`);
+  process.exit(1);
+}
+
+/**
+ * Headings this file recognises as "this version is documented".
+ * A heading may carry a trailing note (e.g. "## 4.13.0 — never published"), so match the version
+ * token at a word boundary rather than requiring the line to be exactly the version.
+ */
+function headingNamesVersion(line, version) {
+  if (!/^##\s+/.test(line)) return false;
+  const rest = line.replace(/^##\s+/, '').trim();
+  const esc = version.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(`^v?${esc}(\\b|$)`).test(rest);
+}
+
+function main() {
+  if (!fs.existsSync(PKG_PATH)) fail(`package.json not found at ${PKG_PATH}`);
+  if (!fs.existsSync(CHANGELOG_PATH)) fail(`CHANGELOG.md not found at ${CHANGELOG_PATH}`);
+
+  let version;
+  try {
+    version = JSON.parse(fs.readFileSync(PKG_PATH, 'utf8')).version;
+  } catch (err) {
+    fail(`package.json is not readable JSON: ${err.message}`);
+  }
+  if (typeof version !== 'string' || !version.trim()) fail('package.json has no version string');
+
+  const lines = fs.readFileSync(CHANGELOG_PATH, 'utf8').split('\n');
+  const headings = lines.filter((l) => /^##\s+/.test(l));
+  if (headings.length === 0) fail('CHANGELOG.md has no "## " headings at all');
+
+  const match = headings.find((l) => headingNamesVersion(l, version));
+  if (!match) {
+    const listed = headings.slice(0, 4).map((h) => h.replace(/^##\s+/, '').trim());
+    fail(
+      `package.json is ${version} but CHANGELOG.md has no "## ${version}" heading.\n`
+      + `  Top headings are: ${listed.join(' · ')}\n`
+      + '  Publishing now is how a version goes undocumented. Retitle the Unreleased section to\n'
+      + `  ${version}, or add its section, then publish.`,
+    );
+  }
+
+  // "Unreleased" must never be the section that documents the version being published.
+  if (/^##\s+unreleased\b/i.test(match)) {
+    fail(`the section naming ${version} is the Unreleased heading — retitle it before publishing`);
+  }
+
+  console.log(`assert-changelog-version: OK — ${version} is documented ("${match.trim()}")`);
+}
+
+main();
+
+module.exports = { headingNamesVersion, PKG_PATH, CHANGELOG_PATH };

package/scripts/assert-guard-major.js

@@ -25,13 +25,33 @@
  *   rises anyway, because a semantics floor is about what the CLI may RUN against, not about what
  *   it happens to import today — a fingerprint that disagrees with the server is exactly the class
  *   of difference this gate exists to refuse.)
+ * 5.0.0: floor raised to 12 (requireConditionalWrite now FIRES on an ordinary mutation. Through
+ *   11.0.1 the policy gated on isWriteStyleCall, which answers "did the caller supply a both-sides
+ *   snapshot" — the right question for FRESHNESS, which it was written for, and the wrong one for
+ *   atomicity. So a mutation carrying artifacts[] with non-empty before AND after classified as
+ *   not-write-style and the demand never fired: reproduced against the published 11.0.1 tarball,
+ *   where the side effect RAN with enforced:true and conditional_write:"not_reported". It bites on
+ *   the NORMAL path, not an exotic config, because the tool-registry defaultBinder lifts
+ *   old_string/new_string and edits[] into exactly that shape — so an agent editing a contract
+ *   artifact under ENFORCING_STRICT wrote unconditionally. 12.0.0 adds isMutatingCall and gates on
+ *   it; ConditionalWriteBasis gains a required `mutating` field. COST MEASURED AS ZERO, the same
+ *   way the 11-raise was: the CLI imports only deployGate, asVerifiedDeployReceiptView,
+ *   DEPLOY_RECEIPT_VIEW_SPEC and matchGlob, whose implementing modules (deploy-gate.js,
+ *   resolver-glob.js, deploy-receipt-token.js) are BYTE-IDENTICAL 11.0.1 -> 12.0.0; the CLI
+ *   constructs no ConditionalWriteBasis and never sets requireConditionalWrite, so the one
+ *   type-level break cannot reach it — it is JS besides. Suite on 12.0.0: 556/554/2, identical to
+ *   11.0.0 with a byte-identical failure set; the only edits the raise needed were this gate's own
+ *   two value-pins in assert-guard-major-coverage.test.js, which exist to move with each recorded
+ *   raise, and no product code. The floor rises anyway, because a semantics floor is about
+ *   what the CLI may RUN against: a guard that silently skips the atomicity demand on an ordinary
+ *   edit is exactly the class of difference this gate exists to refuse.)
  */
 
 const fs = require('fs');
 const path = require('path');
 
 /** Minimum acceptable major for @coderifts/agent-guard in THIS package (the CLI). */
-const MIN_GUARD_MAJOR = 11;
+const MIN_GUARD_MAJOR = 12;
 const DEP = '@coderifts/agent-guard';
 
 /**
@@ -91,6 +111,18 @@ const CHECKOUTS = [
      * 11 makes the bump neither easier nor harder — the blocker is unchanged and the deferral still
      * holds for exactly the reason above, not for a residual shape that moved.
      *
+     *
+     * WHAT THE RESOLVED-RANGE CHECK SAYS ABOUT THIS ENTRY: NOTHING, and that is the correct
+     * answer rather than a lucky one. The check added for the 5.0.0 finding grades whether the
+     * DECLARED range and the RESOLVED install AGREE. The root declares ^3.0.0 and resolves 3.0.0,
+     * so they agree exactly and it reports "in range". The root's gap is not drift between its
+     * manifest and its tree — it is a deliberately LOW FLOOR, and a floor is a human decision this
+     * gate records rather than derives. That decision lives in `floor: 3` and the reason above.
+     *
+     * A check that DID flag it — "resolved major must equal the newest published major" — was
+     * considered and rejected: it would force exactly the bump the paragraphs above say must not
+     * be forced before the residual-precedence reconciliation. The gate must not legislate a
+     * decision it is only supposed to remember.
      * WHAT THE BUMP ROUND MUST DECIDE: whether the guard should emit all holding residuals (then
      * the app consumes gateOut.residuals and collectBindingResiduals is deleted), or whether the
      * single-slot shape is deliberate (then the app keeps its collector and the duplication is
@@ -148,6 +180,94 @@ function resolvedVersionFor(startDir) {
   return null;
 }
 
+/**
+ * RESOLVED-VERSION GRADING — the half the floor check cannot do.
+ *
+ * WHY THIS EXISTS. coderifts@5.0.0 published declaring `@coderifts/agent-guard: ^11.0.0` while
+ * guard 12.0.0 was already out carrying a semantics break (requireConditionalWrite began firing on
+ * ordinary mutations). This gate PASSED, and it was not wrong to: it graded the declared floor
+ * (11 >= 11) and the resolved version (11.0.0 >= 11) against a constant a human maintains by hand.
+ * Both facts were true. Both were stale. A gate that can only compare against the last floor
+ * someone remembered to raise cannot notice a major it has never been told about.
+ *
+ * So the constant is not the whole gate. What CAN be checked without a registry call is whether
+ * the tree and the manifest AGREE — and they must agree in both directions:
+ *
+ *   · resolved BELOW the declared range  → a stale install. The suite measured an older guard than
+ *     the one we ship against, so every "cost measured as zero" conclusion is about the wrong
+ *     package.
+ *   · resolved ABOVE the declared range  → the more dangerous direction, and the one that produced
+ *     this finding's shape. Staging a NEWER guard into node_modules to measure a raise, then
+ *     publishing with the old range, means the suite proved something adopters never receive: they
+ *     resolve the range, not our node_modules. A green suite over a version we do not declare is a
+ *     false confidence, not a measurement.
+ *
+ * NOT RESOLVED IS A FAILURE, not a pass. The previous code returned a success line reading
+ * "not resolved in tree" — "we could not look" recorded as "we looked and it is fine", which is
+ * the exact fail-open class this repository refuses elsewhere (a 404 on the source_ref anchor is
+ * deliberately on the FAIL side for the same reason). A publish gate that verifies nothing must
+ * say so by failing.
+ *
+ * WHAT THIS STILL CANNOT DO, named rather than implied: it makes no network call, so it cannot
+ * know that a newer major exists. Raising the floor stays a human act with a recorded reason. This
+ * check only guarantees that what we measured is what we declare.
+ */
+
+/** Parse "1.2.3" (ignoring any prerelease/build suffix) to [1,2,3], or null. */
+function parseVersion(v) {
+  const m = /^(\d+)\.(\d+)\.(\d+)/.exec(String(v || '').trim());
+  return m ? [parseInt(m[1], 10), parseInt(m[2], 10), parseInt(m[3], 10)] : null;
+}
+
+/** -1 / 0 / 1 over [maj,min,pat] triples. */
+function compareVersions(a, b) {
+  for (let i = 0; i < 3; i += 1) {
+    if (a[i] !== b[i]) return a[i] < b[i] ? -1 : 1;
+  }
+  return 0;
+}
+
+/**
+ * Inclusive lower bound and EXCLUSIVE upper bound for the range forms this gate already accepts.
+ * Deliberately dependency-free — the rest of this file is, and a publish gate that needs an
+ * install to run is a gate that stops running.
+ *
+ * ^1.2.3 -> [1.2.3, 2.0.0)   ~1.2.3 -> [1.2.3, 1.3.0)   >=1.2.3 -> [1.2.3, inf)
+ * 1.2.3  -> [1.2.3, 1.2.4)   1.x    -> [1.0.0, 2.0.0)
+ * Anything else -> null (caller treats an unparseable range as unverifiable, never as satisfied).
+ */
+function rangeBounds(range) {
+  const s = String(range || '').trim();
+  const m = /^(\^|~|>=|=)?\s*(\d+)(?:\.(\d+|x|\*))?(?:\.(\d+|x|\*))?/.exec(s);
+  if (!m) return null;
+  const op = m[1] || '';
+  const maj = parseInt(m[2], 10);
+  const minRaw = m[3];
+  const patRaw = m[4];
+  const wild = (t) => t === undefined || t === 'x' || t === '*';
+  const min = wild(minRaw) ? 0 : parseInt(minRaw, 10);
+  const pat = wild(patRaw) ? 0 : parseInt(patRaw, 10);
+  const lower = [maj, min, pat];
+  if (wild(minRaw)) return { lower, upper: [maj + 1, 0, 0] };      // 1.x
+  if (op === '^') return { lower, upper: [maj + 1, 0, 0] };
+  if (op === '~') return { lower, upper: [maj, min + 1, 0] };
+  if (op === '>=') return { lower, upper: null };
+  if (wild(patRaw)) return { lower, upper: [maj, min + 1, 0] };    // 1.2.x
+  return { lower, upper: [maj, min, pat + 1] };                    // exact
+}
+
+/**
+ * @returns {'in'|'below'|'above'|'unknown'} where `version` sits relative to `range`.
+ */
+function versionVsRange(version, range) {
+  const v = parseVersion(version);
+  const b = rangeBounds(range);
+  if (!v || !b) return 'unknown';
+  if (compareVersions(v, b.lower) < 0) return 'below';
+  if (b.upper && compareVersions(v, b.upper) >= 0) return 'above';
+  return 'in';
+}
+
 /** Check ONE checkout. Returns a line for the summary; calls fail() and exits on a violation. */
 function checkCheckout(c) {
   if (!fs.existsSync(c.pkgPath)) {
@@ -173,7 +293,15 @@ function checkCheckout(c) {
 
   const resolved = resolvedVersionFor(path.dirname(c.pkgPath));
   if (!resolved) {
-    return `${c.label}: declared ${range} (floor ${floor} >= ${c.floor}); not resolved in tree`;
+    // FAIL-CLOSED, with NO opt-out. An `allowUnresolved` flag was written and then removed on
+    // purpose: the first time this fires in CI the cheapest response is to set the flag, and the
+    // hole is back with a config line to justify it. If a checkout ever legitimately ships
+    // uninstalled, add the exemption THEN, with the measurement that earned it.
+    fail(
+      `${c.label}: ${DEP} is declared ${JSON.stringify(range)} but is NOT RESOLVABLE from `
+      + `${path.dirname(c.pkgPath)}. This gate cannot verify what will ship, and an unverified `
+      + 'publish is not a verified one. Install dependencies for this checkout and re-run.',
+    );
   }
   const rm = /^(\d+)/.exec(resolved);
   const rMajor = rm ? parseInt(rm[1], 10) : null;
@@ -183,7 +311,32 @@ function checkCheckout(c) {
   if (rMajor < floor) {
     fail(`${c.label}: resolved ${DEP}@${resolved} major ${rMajor} is below declared range floor ${floor}`);
   }
-  return `${c.label}: declared ${range} (floor ${floor} >= ${c.floor}); resolved ${resolved}`;
+
+  // THE DECLARED RANGE AND THE INSTALLED TREE MUST AGREE — both directions, full precision.
+  const where = versionVsRange(resolved, range);
+  if (where === 'below') {
+    fail(
+      `${c.label}: resolved ${DEP}@${resolved} is BELOW the declared range ${JSON.stringify(range)} `
+      + '— a stale install. Every cost measured against this tree describes an older guard than the '
+      + 'one this package declares. Run npm install for this checkout and re-measure.',
+    );
+  }
+  if (where === 'above') {
+    fail(
+      `${c.label}: resolved ${DEP}@${resolved} is ABOVE the declared range ${JSON.stringify(range)}. `
+      + 'The tree runs a guard this package does not declare, so the suite measured a version '
+      + 'adopters will never receive — they resolve the range, not our node_modules. Either raise '
+      + `the declared range to admit ${resolved} (and record WHY in the history block), or remove `
+      + 'the staged install.',
+    );
+  }
+  if (where === 'unknown') {
+    fail(
+      `${c.label}: cannot decide whether resolved ${DEP}@${resolved} satisfies declared range `
+      + `${JSON.stringify(range)} — unparseable. A range this gate cannot grade must not ship.`,
+    );
+  }
+  return `${c.label}: declared ${range} (floor ${floor} >= ${c.floor}); resolved ${resolved} (in range)`;
 }
 
 function main() {
@@ -206,4 +359,7 @@ function main() {
 // floorMajorFromRange without triggering a process.exit.
 if (require.main === module) main();
 
-module.exports = { CHECKOUTS, floorMajorFromRange, MIN_GUARD_MAJOR, DEP };
+module.exports = {
+  CHECKOUTS, floorMajorFromRange, MIN_GUARD_MAJOR, DEP,
+  parseVersion, compareVersions, rangeBounds, versionVsRange, resolvedVersionFor,
+};