coderifts 5.0.1 → 6.0.0

package/CHANGELOG.md

@@ -1,6 +1,34 @@
 # Changelog
 
-## Unreleased
+## 6.0.0
+
+_Nothing yet._
+
+## 5.0.1
+
+### Fixed
+- **A fresh install shipped the guard with the conditional-write hole.**
+  `coderifts@5.0.0` declared `@coderifts/agent-guard: ^11.0.0`, which resolved to
+  11.0.1 — precisely the tarball the guard's own 12.0.0 round reproduced the
+  defect against, where `requireConditionalWrite` did not fire on an ordinary
+  mutation and the side effect **ran** with `enforced: true`. The guard is a
+  **direct** dependency with no `peerDependencies` and no bundled copy, so this
+  range *is* the adopter's resolution, not advice. Now `^12.0.0`, with
+  `MIN_GUARD_MAJOR` raised to 12. Cost measured as zero: the CLI imports only
+  `deployGate`, `asVerifiedDeployReceiptView`, `DEPLOY_RECEIPT_VIEW_SPEC` and
+  `matchGlob`, whose modules are byte-identical 11.0.1 → 12.0.0.
+- **Two defects in the publish gate itself**, both proven by replaying the real
+  script. The resolved check only ever compared *downward* — `resolved >= floor`,
+  never whether the resolved version sits **inside** the declared range — so
+  declaring `^11.0.0` with 12.0.0 staged for a cost measurement printed OK and
+  exited 0, which is exactly the shape that makes "we measured 12 and shipped
+  ^11" indistinguishable from a correct release. And an unresolvable install was
+  a **pass**. Three failure modes added (resolved below the declared range at
+  full precision, resolved above it, and not resolvable at all), with no
+  opt-out — an `allowUnresolved` flag was written and deliberately removed, and
+  a test asserts it stays absent.
+
+## 5.0.0
 
 ### Fixed
 - **P0 — `setup-required-check --apply` no longer reports `APPLIED` over a
@@ -59,6 +87,63 @@
   template is unchanged and stays non-blocking; it carries the same three lines
   commented, with a note saying why the two differ.
 
+## 4.13.0 — never published (folded into 5.0.0)
+
+Bumped in-repo (`917611d`) but never tagged or released to npm; 5.0.0 superseded
+it, so adopters received this content **as part of 5.0.0**. Recorded separately
+because the version number appears in the source history and in
+`assert-guard-major.js`'s floor-raise log.
+
+### Changed
+- **Guard floor raised to 11.** Cost measured as zero the way the 10-raise was —
+  the CLI imports only `deployGate`, `asVerifiedDeployReceiptView`,
+  `DEPLOY_RECEIPT_VIEW_SPEC` and `matchGlob`, none of which 11.0.0 touched, and
+  the suite staged against 11 returned an identical 532/530/2 with a
+  byte-identical failure set. It rises anyway, because a semantics floor is about
+  what the CLI may **run** against, not what it happens to import today: 10.x's
+  `computeBundleFingerprint` disagreed with the server, which is exactly the
+  class this gate exists to refuse.
+- The two tests pinning the old floor were updated, and the invariant made
+  explicit: **the floor only ever rises**.
+
+### Added
+- `/api/v1/agent/preflight` returns `scorer_version` — the one field that makes
+  the single-spec fingerprint reproducible by a consumer holding their own
+  before/after/policy. Purely additive; no surface moves and `tools_sha256` is
+  unchanged.
+
+## 4.12.0
+
+### Changed
+- **Guard floor raised to 10.** Cost measured as zero: the CLI imports only
+  `deployGate`, `asVerifiedDeployReceiptView`, `DEPLOY_RECEIPT_VIEW_SPEC` and
+  `matchGlob` — never `withCodeRifts` — so 10.0.0's strict-composition break
+  cannot reach it. Verified by staging guard 10 into the install and running the
+  suite (guard-conformance 6/6, the same two pre-existing failures as the guard-9
+  baseline). The gate was satisfied, not weakened: before the install it
+  correctly reported FAIL on the stale resolve.
+
+## 4.11.0
+
+### Fixed
+- **P0 — the issuer binding pointed at a check that cannot block.** GitHub passes
+  a required status check on `success`, `skipped` **or `neutral`**, so our App's
+  advisory check genuinely cannot block; a false comment in
+  `webhook-integration.js` claiming otherwise is what produced the regression.
+  The enforcing issuer is `app_id 15368` (github-actions), which the contract-gate
+  Action posts under, so that binding is now VERIFIED — with the shared-identity
+  residual **named** rather than implied: anyone who can edit
+  `.github/workflows` can post under it. A binding to our own App id grades
+  UNVERIFIABLE rather than NOT_VERIFIED, because `MERGEGATE_ENFORCE` is
+  server-side and invisible from here.
+- **P0 — the installer wrote what our own verifier rejects.** It now writes
+  `checks[]` with an explicit `app_id`, because an omitted `app_id` silently
+  resolves to whoever posted last, which is unauditable. It never re-binds
+  another team's existing check, and the success path prints what it does **not**
+  achieve. A coupling test asserts the installer's and the verifier's issuer
+  constants are equal. The verifier was not weakened — the name-only and
+  legacy-contexts paths are byte-identical, asserted by two unchanged tests.
+
 ## 4.10.0
 
 ### Added

package/dist/cli.js

@@ -3028,7 +3028,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "5.0.1",
+      version: "6.0.0",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -3067,7 +3067,7 @@ var require_package = __commonJS({
       },
       scripts: {
         build: "node scripts/copy-corpus.js && node scripts/build.js",
-        prepublishOnly: "node scripts/assert-guard-major.js && bash ../../scripts/freeze-gate.sh && npm run build",
+        prepublishOnly: "node scripts/assert-guard-major.js && node scripts/assert-changelog-version.js && bash ../../scripts/freeze-gate.sh && npm run build",
         "assert-guard-major": "node scripts/assert-guard-major.js",
         postinstall: "node scripts/postinstall.js",
         test: "node --test test/*.test.js"
@@ -253975,6 +253975,16 @@ var require_github_enforcement = __commonJS({
       RULESET_ABSENT: "ruleset_absent",
       /** Rulesets could not be read at all. */
       RULESET_UNREADABLE: "ruleset_unreadable",
+      /** A ruleset requires our context but does not TARGET the branch that matters (1104a). */
+      RULESET_REF_NOT_TARGETED: "ruleset_ref_not_targeted",
+      /** Active, bound, targeted — but strict latest-head is off (1104b). Recorded, not fatal. */
+      RULESET_STRICT_POLICY_OFF: "ruleset_strict_policy_off",
+      /** 1102 — no active targeting ruleset requires a workflow at all. */
+      REQUIRED_WORKFLOW_ABSENT: "required_workflow_absent",
+      /** 1102 — a workflows rule exists but carries no sha, so it names a path and not bytes. */
+      REQUIRED_WORKFLOW_UNPINNED: "required_workflow_unpinned",
+      /** 1102 — a required workflow is pinned to a full commit sha. */
+      REQUIRED_WORKFLOW_SHA_PINNED: "required_workflow_sha_pinned",
       REQUIRED_CHECK_ABSENT: "required_check_absent",
       ACTIVE_JOB: "active_job",
       NO_ACTIVE_JOB: "no_active_job",
@@ -254005,6 +254015,41 @@ var require_github_enforcement = __commonJS({
       const n = Number(value);
       return Number.isInteger(n) && n > 0 ? n : null;
     }
+    function refPatterns(rs, key) {
+      const rn = rs && rs.conditions && rs.conditions.ref_name;
+      if (!rn || !Array.isArray(rn[key])) return null;
+      return rn[key].map((x) => String(x));
+    }
+    function targetsDefaultBranch(entry, defaultBranch) {
+      if (entry.target === "tag") return false;
+      const inc = entry.ref_include;
+      if (!Array.isArray(inc)) return null;
+      const ref = defaultBranch ? `refs/heads/${defaultBranch}` : null;
+      const matches = (pat) => {
+        if (pat === "~ALL" || pat === "~DEFAULT_BRANCH") return true;
+        if (!ref) return null;
+        if (pat === ref) return true;
+        if (!pat.includes("*") && !pat.includes("[") && !pat.includes("?")) return false;
+        const rx = new RegExp(`^${pat.replace(/[.+^${}()|\\]/g, "\\$&").replace(/\*/g, "[^/]*").replace(/\?/g, ".")}$`);
+        return rx.test(ref);
+      };
+      let included = false;
+      for (const pat of inc) {
+        const m = matches(pat);
+        if (m === null) return null;
+        if (m) {
+          included = true;
+          break;
+        }
+      }
+      if (!included) return false;
+      for (const pat of entry.ref_exclude || []) {
+        const m = matches(pat);
+        if (m === null) return null;
+        if (m) return false;
+      }
+      return true;
+    }
     function rulesetRequiredCheckEntries(rulesets) {
       const out = [];
       const list = Array.isArray(rulesets) ? rulesets : [];
@@ -254023,7 +254068,15 @@ var require_github_enforcement = __commonJS({
               enforcement: typeof rs.enforcement === "string" ? rs.enforcement : null,
               integration_id: numericAppId(c && c.integration_id),
               bypass_visible: Object.prototype.hasOwnProperty.call(rs, "bypass_actors"),
-              bypass_count: Array.isArray(rs.bypass_actors) ? rs.bypass_actors.length : null
+              bypass_count: Array.isArray(rs.bypass_actors) ? rs.bypass_actors.length : null,
+              // 1104a — a ruleset can be ACTIVE and target nothing that matters. MEASURED against the
+              // live API: `target` and `conditions.ref_name` are both in the detail document we already
+              // fetch, so this is a grading change and needs no new call.
+              target: typeof rs.target === "string" ? rs.target : null,
+              ref_include: refPatterns(rs, "include"),
+              ref_exclude: refPatterns(rs, "exclude"),
+              // 1104b — same document, one boolean.
+              strict_policy: typeof params.strict_required_status_checks_policy === "boolean" ? params.strict_required_status_checks_policy : null
             });
           }
         }
@@ -254031,7 +254084,7 @@ var require_github_enforcement = __commonJS({
       return out;
     }
     var RULESET_BYPASS_CAVEAT = " Bypass actors were not readable on this surface, so this does not establish that nobody can bypass the ruleset.";
-    function evaluateRuleset(rulesets) {
+    function evaluateRuleset(rulesets, defaultBranch = null) {
       if (rulesets == null) {
         return {
           status: STATUS.UNVERIFIABLE,
@@ -254062,12 +254115,41 @@ var require_github_enforcement = __commonJS({
       }
       const bound = active.find((e) => e.integration_id === ENFORCING_ISSUER_APP_ID);
       if (bound) {
+        const targeted = targetsDefaultBranch(bound, defaultBranch);
+        if (targeted === false) {
+          return {
+            status: STATUS.NOT_VERIFIED,
+            reason_code: REASON.RULESET_REF_NOT_TARGETED,
+            reason: `active ruleset "${bound.ruleset}" requires "${CHECK_NAME}" bound to the enforcing issuer, but its conditions do not target ${defaultBranch ? `refs/heads/${defaultBranch}` : "the default branch"}${bound.target === "tag" ? " (the ruleset targets tags, which never gate a merge to a branch)" : ""} \u2014 include: ${JSON.stringify(bound.ref_include)}, exclude: ${JSON.stringify(bound.ref_exclude || [])}`,
+            ruleset_names: names,
+            app_id: ENFORCING_ISSUER_APP_ID,
+            ref_targeted: false
+          };
+        }
+        if (targeted === null) {
+          return {
+            status: STATUS.UNVERIFIABLE,
+            reason_code: REASON.RULESET_REF_NOT_TARGETED,
+            reason: `active ruleset "${bound.ruleset}" binds "${CHECK_NAME}" to the enforcing issuer, but its ref conditions could not be read, so whether it targets the branch that matters CANNOT BE DETERMINED FROM HERE.${RULESET_BYPASS_CAVEAT}`,
+            ruleset_names: names,
+            app_id: ENFORCING_ISSUER_APP_ID,
+            ref_targeted: null
+          };
+        }
         return {
           status: STATUS.VERIFIED,
           reason_code: REASON.RULESET_ISSUER_BOUND,
-          reason: `active ruleset "${bound.ruleset}" requires "${CHECK_NAME}" bound to integration_id ${ENFORCING_ISSUER_APP_ID} (${GITHUB_ACTIONS_APP_SLUG}) \u2014 the contract-gate Action, which concludes failure and blocks the merge.${RULESET_BYPASS_CAVEAT}`,
+          reason: `active ruleset "${bound.ruleset}" requires "${CHECK_NAME}" bound to integration_id ${ENFORCING_ISSUER_APP_ID} (${GITHUB_ACTIONS_APP_SLUG}) \u2014 the contract-gate Action, which concludes failure and blocks the merge. It targets ${defaultBranch ? `refs/heads/${defaultBranch}` : "the default branch"}.` + (bound.strict_policy === true ? " strict_required_status_checks_policy is ON, so a stale head cannot merge." : bound.strict_policy === false ? " RESIDUAL: strict_required_status_checks_policy is OFF, so a branch whose head is behind the base can merge on a check that passed against older bytes." : " strict_required_status_checks_policy was not readable here.") + RULESET_BYPASS_CAVEAT,
           ruleset_names: names,
-          app_id: ENFORCING_ISSUER_APP_ID
+          app_id: ENFORCING_ISSUER_APP_ID,
+          ref_targeted: true,
+          strict_policy: bound.strict_policy,
+          strict_policy_residual: bound.strict_policy === false ? REASON.RULESET_STRICT_POLICY_OFF : null,
+          // 1104c — NEVER an absence we cannot see. bypass_actors is in the ruleset schema but was
+          // absent from all six live rulesets read without a credential (measured 2026-08-27), so
+          // "not present in the response" is reported as NOT VISIBLE and never as "none configured".
+          bypass_visible: bound.bypass_visible === true,
+          bypass_count: bound.bypass_visible === true ? bound.bypass_count : null
         };
       }
       const other = active.find((e) => e.integration_id != null);
@@ -254088,9 +254170,66 @@ var require_github_enforcement = __commonJS({
         ruleset_names: names
       };
     }
-    function evaluateRequiredCheckAcrossSurfaces(protection, rulesets) {
+    function evaluateRequiredWorkflowPin(rulesets, defaultBranch = null) {
+      if (rulesets == null) {
+        return { status: STATUS.UNVERIFIABLE, reason_code: REASON.RULESET_UNREADABLE, pinned: null, workflows: [] };
+      }
+      const found = [];
+      for (const rs of Array.isArray(rulesets) ? rulesets : []) {
+        if (!rs || typeof rs !== "object") continue;
+        if (rs.enforcement !== "active") continue;
+        const entryShape = {
+          target: typeof rs.target === "string" ? rs.target : null,
+          ref_include: refPatterns(rs, "include"),
+          ref_exclude: refPatterns(rs, "exclude")
+        };
+        if (targetsDefaultBranch(entryShape, defaultBranch) !== true) continue;
+        for (const rule of Array.isArray(rs.rules) ? rs.rules : []) {
+          if (!rule || rule.type !== "workflows") continue;
+          const list = rule.parameters && Array.isArray(rule.parameters.workflows) ? rule.parameters.workflows : [];
+          for (const w of list) {
+            if (!w || typeof w !== "object") continue;
+            found.push({
+              ruleset: String(rs.name || rs.id || "ruleset"),
+              path: typeof w.path === "string" ? w.path : null,
+              repository_id: Number.isInteger(w.repository_id) ? w.repository_id : null,
+              ref: typeof w.ref === "string" ? w.ref : null,
+              // The whole question. sha is optional in the schema, so its ABSENCE is the finding.
+              sha: typeof w.sha === "string" && /^[0-9a-f]{40}$/i.test(w.sha) ? w.sha : null
+            });
+          }
+        }
+      }
+      if (found.length === 0) {
+        return {
+          status: STATUS.NOT_VERIFIED,
+          reason_code: REASON.REQUIRED_WORKFLOW_ABSENT,
+          pinned: false,
+          workflows: [],
+          reason: `no active ruleset targeting this branch requires a workflow, so the check that gates the merge is bound only to the SHARED issuer ${ENFORCING_ISSUER_APP_ID} (${GITHUB_ACTIONS_APP_SLUG}) \u2014 anyone who can edit .github/workflows can post under it`
+        };
+      }
+      const pinned = found.filter((w) => w.sha != null);
+      if (pinned.length === 0) {
+        return {
+          status: STATUS.NOT_VERIFIED,
+          reason_code: REASON.REQUIRED_WORKFLOW_UNPINNED,
+          pinned: false,
+          workflows: found,
+          reason: `a required workflow is configured (${found.map((w) => w.path || "?").join(", ")}) but NONE carries a sha. \`sha\` is optional in the rule schema, and without it the ruleset names a path rather than bytes, so rewriting that file still changes what runs`
+        };
+      }
+      return {
+        status: STATUS.VERIFIED,
+        reason_code: REASON.REQUIRED_WORKFLOW_SHA_PINNED,
+        pinned: true,
+        workflows: found,
+        reason: `active ruleset "${pinned[0].ruleset}" requires workflow ${pinned[0].path} pinned to sha ${pinned[0].sha} in repository_id ${pinned[0].repository_id}. Moving that pin requires editing the ruleset (repository administration), which is a different permission from workflow write. This does NOT establish that any pull request ran it, nor that bypass actors cannot skip the ruleset.`
+      };
+    }
+    function evaluateRequiredCheckAcrossSurfaces(protection, rulesets, defaultBranch = null) {
       const classic = evaluateRequiredCheck(protection);
-      const ruleset = evaluateRuleset(rulesets);
+      const ruleset = evaluateRuleset(rulesets, defaultBranch);
       const merged = (base) => ({
         ...base,
         surfaces_inspected: ["classic_branch_protection", rulesets == null ? "rulesets:unread" : "rulesets"],
@@ -254210,8 +254349,22 @@ var require_github_enforcement = __commonJS({
     var STATUS = Object.freeze({
       VERIFIED: "VERIFIED",
       NOT_VERIFIED: "NOT_VERIFIED",
-      UNVERIFIABLE: "UNVERIFIABLE"
-    });
+      UNVERIFIABLE: "UNVERIFIABLE",
+      UNSUPPORTED_PLAN: "UNSUPPORTED_PLAN",
+      PROVIDER_ERROR: "PROVIDER_ERROR"
+    });
+    var FRESHNESS = Object.freeze({ FRESH: "FRESH", STALE_EVIDENCE: "STALE_EVIDENCE" });
+    function supportsStrongClaim(status) {
+      return status === STATUS.VERIFIED;
+    }
+    var EVIDENCE_TTL_SECONDS = 3600;
+    function evidenceFreshness(report, nowIso) {
+      if (!report || !report.expires_at) return null;
+      const now = Date.parse(nowIso || (/* @__PURE__ */ new Date()).toISOString());
+      const exp = Date.parse(report.expires_at);
+      if (!Number.isFinite(now) || !Number.isFinite(exp)) return null;
+      return now > exp ? FRESHNESS.STALE_EVIDENCE : FRESHNESS.FRESH;
+    }
     function resolveGitHubAuth(env = process.env) {
       const user = String(env && (env.GITHUB_TOKEN || env.GH_TOKEN) || "").trim();
       if (user) {
@@ -254542,6 +254695,10 @@ var require_github_enforcement = __commonJS({
       NO_TOKEN_INSTRUCTION,
       LAYER_IDS,
       STATUS,
+      FRESHNESS,
+      EVIDENCE_TTL_SECONDS,
+      supportsStrongClaim,
+      evidenceFreshness,
       REASON,
       CHECK_NAME,
       GATE_ACTION,
@@ -254555,6 +254712,8 @@ var require_github_enforcement = __commonJS({
       evaluateLayers,
       evaluateRequiredCheck,
       evaluateRuleset,
+      evaluateRequiredWorkflowPin,
+      targetsDefaultBranch,
       evaluateRequiredCheckAcrossSurfaces,
       verifiedRequiresBinding,
       scanLocalWorkflows,
@@ -254941,7 +255100,7 @@ var require_setup_required_check = __commonJS({
         }
       } catch {
       }
-      const rulesetVerdict = evaluateRuleset(rulesetDocs);
+      const rulesetVerdict = evaluateRuleset(rulesetDocs, branch);
       const rulesetNamed = detectRulesetRequiredCheck(rulesetDocs || [], CHECK_NAME);
       const ruleset = {
         enforced: rulesetVerdict.status === STATUS.VERIFIED,
@@ -255314,6 +255473,8 @@ var require_enforce_check = __commonJS({
     var chalk = require_source();
     var {
       EVIDENCE_SPEC,
+      EVIDENCE_TTL_SECONDS,
+      supportsStrongClaim,
       APP_INSTALLATION,
       NO_TOKEN_INSTRUCTION,
       resolveGitHubAuth,
@@ -255325,6 +255486,35 @@ var require_enforce_check = __commonJS({
     var { isValidRepo } = require_status();
     var { resolveOwnerRepo } = require_setup_required_check();
     if (process.env.NO_COLOR) chalk.level = 0;
+    var crypto = require("node:crypto");
+    var EVIDENCE_SCOPE = Object.freeze({
+      grades: "repository configuration \u2014 what the provider would require of any pull request",
+      covers: Object.freeze([
+        "required status check present and named exactly",
+        "the check bound to an issuer that can block (integration_id / app_id)",
+        "ruleset enforcement is active rather than evaluate",
+        "the ruleset targets the branch that matters",
+        "strict latest-head policy recorded",
+        "bypass actors reported as VISIBLE or NOT VISIBLE, never as absent"
+      ]),
+      does_not_cover: Object.freeze([
+        "which GitHub App actually posted a check run on any pull request",
+        "the head_sha a check run executed against",
+        "whether any check run concluded success",
+        "a recomputable external proof hash over a specific run"
+      ]),
+      why_not: "Those are facts about one pull request at one moment, not about configuration. Reading them needs a per-PR check-runs query this command does not make; a passing config is not a passing run."
+    });
+    function responseDigest(read) {
+      if (!read) return null;
+      return {
+        endpoint: read.endpoint ? `GET ${read.endpoint}` : null,
+        http_status: read.status == null ? null : read.status,
+        // Hash of the BODY as we received it. Not the verdict — the INPUT to the verdict, so a
+        // disagreement can be localised to the answer or to our grading of it.
+        body_sha256: read.body === void 0 || read.body === null ? null : `sha256:${crypto.createHash("sha256").update(JSON.stringify(read.body)).digest("hex")}`
+      };
+    }
     var USAGE = [
       "Usage: coderifts enforce --check --repo owner/repo [--env <github-environment>] [--branch <name>] [--json]",
       "",
@@ -255437,7 +255627,12 @@ var require_enforce_check = __commonJS({
         const report2 = {
           command: "enforce --check",
           spec: EVIDENCE_SPEC,
+          // OBSERVED_AT WAS NOT ADDED. `queried_at` already carries exactly that fact, and a
+          // second name for one fact is the defect this round was told to look for.
           queried_at: queriedAt,
+          expires_at: new Date(Date.parse(queriedAt) + EVIDENCE_TTL_SECONDS * 1e3).toISOString(),
+          evidence_ttl_seconds: EVIDENCE_TTL_SECONDS,
+          evidence_scope: EVIDENCE_SCOPE,
           repo: `${ownerRepo.owner}/${ownerRepo.repo}`,
           branch: options.branch || null,
           environment: environmentName,
@@ -255481,14 +255676,33 @@ var require_enforce_check = __commonJS({
       const report = {
         command: "enforce --check",
         spec: EVIDENCE_SPEC,
+        // OBSERVED_AT WAS NOT ADDED. `queried_at` already carries exactly that fact, and a
+        // second name for one fact is the defect this round was told to look for.
         queried_at: queriedAt,
+        expires_at: new Date(Date.parse(queriedAt) + EVIDENCE_TTL_SECONDS * 1e3).toISOString(),
+        evidence_ttl_seconds: EVIDENCE_TTL_SECONDS,
+        evidence_scope: EVIDENCE_SCOPE,
         repo: `${ownerRepo.owner}/${ownerRepo.repo}`,
         branch,
         environment: environmentName,
         provider: "github",
         auth: authPublic,
+        // The raw answers behind the verdict, so a disagreement can be localised to the provider's
+        // response or to our grading of it.
+        responses: {
+          protection: responseDigest(protectionRead),
+          environment: responseDigest(environmentRead)
+        },
         ...evaluated
       };
+      if (report.claim && report.claim.inescapable_deploy === true) {
+        const unsupported = (report.layers || []).filter((l) => !supportsStrongClaim(l.status));
+        if (unsupported.length > 0) {
+          throw new Error(
+            `enforce --check: inescapable_deploy is true with ${unsupported.length} layer(s) not VERIFIED (${unsupported.map((l) => `${l.id}=${l.status}`).join(", ")}) \u2014 refusing to emit`
+          );
+        }
+      }
       if (options.json) log(JSON.stringify(report, null, 2));
       else log(renderHuman(report));
       return { exitCode: 0, report };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coderifts",
-  "version": "5.0.1",
+  "version": "6.0.0",
   "description": "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
   "author": "CodeRifts <hello@coderifts.com>",
   "license": "MIT",
@@ -39,7 +39,7 @@
   },
   "scripts": {
     "build": "node scripts/copy-corpus.js && node scripts/build.js",
-    "prepublishOnly": "node scripts/assert-guard-major.js && bash ../../scripts/freeze-gate.sh && npm run build",
+    "prepublishOnly": "node scripts/assert-guard-major.js && node scripts/assert-changelog-version.js && bash ../../scripts/freeze-gate.sh && npm run build",
     "assert-guard-major": "node scripts/assert-guard-major.js",
     "postinstall": "node scripts/postinstall.js",
     "test": "node --test test/*.test.js"

package/scripts/assert-changelog-version.js

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * CLI release gate (prepublishOnly): refuse to publish a version the CHANGELOG does not name.
+ *
+ * WHY THIS EXISTS — measured, not hypothetical. On 2026-08-27 packages/cli/CHANGELOG.md listed
+ * 4.10.0 and then "Unreleased", while npm carried 4.11.0, 4.12.0, 5.0.0 and 5.0.1. Four published
+ * versions were undocumented and a fifth (5.0.0) was published while still labelled Unreleased.
+ * Two distinct failure modes produced that, and BOTH are caught by the one check below:
+ *
+ *   1. The bump commit never touched the changelog at all. Measured: of the last eight CLI version
+ *      bumps, four omitted it (4.11.0, 4.12.0, 4.13.0, 5.0.1) — and those four are exactly the
+ *      versions that went missing. The correlation is not partial.
+ *   2. The bump commit DID write the entry, but under "## Unreleased", and nobody retitled it at
+ *      publish. Atomicity alone does not save you: @coderifts/agent-guard 12.0.0 was written
+ *      atomically and still shipped as "Unreleased", and 11.0.1 before it had to retitle a stale
+ *      heading by hand.
+ *
+ * So the invariant is NOT "the bump touched the changelog" — it is that the version being published
+ * appears as its own heading. A human step that must be remembered at publish time is the step that
+ * gets skipped; this makes it fail the publish instead.
+ *
+ * Dependency-free on purpose: a publish gate that needs an install to run is a gate that stops
+ * running (same reasoning as assert-guard-major.js).
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const PKG_PATH = path.join(__dirname, '..', 'package.json');
+const CHANGELOG_PATH = path.join(__dirname, '..', 'CHANGELOG.md');
+
+function fail(msg) {
+  console.error(`assert-changelog-version: FAIL — ${msg}`);
+  process.exit(1);
+}
+
+/**
+ * Headings this file recognises as "this version is documented".
+ * A heading may carry a trailing note (e.g. "## 4.13.0 — never published"), so match the version
+ * token at a word boundary rather than requiring the line to be exactly the version.
+ */
+function headingNamesVersion(line, version) {
+  if (!/^##\s+/.test(line)) return false;
+  const rest = line.replace(/^##\s+/, '').trim();
+  const esc = version.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(`^v?${esc}(\\b|$)`).test(rest);
+}
+
+function main() {
+  if (!fs.existsSync(PKG_PATH)) fail(`package.json not found at ${PKG_PATH}`);
+  if (!fs.existsSync(CHANGELOG_PATH)) fail(`CHANGELOG.md not found at ${CHANGELOG_PATH}`);
+
+  let version;
+  try {
+    version = JSON.parse(fs.readFileSync(PKG_PATH, 'utf8')).version;
+  } catch (err) {
+    fail(`package.json is not readable JSON: ${err.message}`);
+  }
+  if (typeof version !== 'string' || !version.trim()) fail('package.json has no version string');
+
+  const lines = fs.readFileSync(CHANGELOG_PATH, 'utf8').split('\n');
+  const headings = lines.filter((l) => /^##\s+/.test(l));
+  if (headings.length === 0) fail('CHANGELOG.md has no "## " headings at all');
+
+  const match = headings.find((l) => headingNamesVersion(l, version));
+  if (!match) {
+    const listed = headings.slice(0, 4).map((h) => h.replace(/^##\s+/, '').trim());
+    fail(
+      `package.json is ${version} but CHANGELOG.md has no "## ${version}" heading.\n`
+      + `  Top headings are: ${listed.join(' · ')}\n`
+      + '  Publishing now is how a version goes undocumented. Retitle the Unreleased section to\n'
+      + `  ${version}, or add its section, then publish.`,
+    );
+  }
+
+  // "Unreleased" must never be the section that documents the version being published.
+  if (/^##\s+unreleased\b/i.test(match)) {
+    fail(`the section naming ${version} is the Unreleased heading — retitle it before publishing`);
+  }
+
+  console.log(`assert-changelog-version: OK — ${version} is documented ("${match.trim()}")`);
+}
+
+main();
+
+module.exports = { headingNamesVersion, PKG_PATH, CHANGELOG_PATH };