coderifts 5.0.1 → 6.0.1

package/CHANGELOG.md

@@ -1,6 +1,52 @@
 # Changelog
 
-## Unreleased
+## 6.0.1
+
+### Changed
+- **Guard floor raised to 13, declared range `^13.0.0`.** ADOPTER-FACING: the guard is a direct
+  dependency with no `peerDependencies` and no bundled copy, so this range *is* what a fresh install
+  resolves. `coderifts@5.0.1` declared `^12.0.0`, which resolves to 12.0.0 — the version in which
+  `wrapWriteWithFsCas` measured its expected CAS token INSIDE `executeFactory`, after preflight and
+  after the T2 recheck, and conditioned the write on that self-fetched value. Measured on 12.0.0: a
+  writer landing in that window had its state adopted as the legitimate starting point and the CAS
+  still returned `committed` with `enforced: true`, clobbering it. 13.0.0 threads the
+  authorization-time token, and adds three filesystem defences that were measured absent rather than
+  assumed — `..` refused before resolution, a symlinked final component refused (`stat`/`readFile`
+  measured the link's TARGET while `rename` replaced the LINK, so check and write named different
+  objects), the token read through a single file descriptor, and `dev`+`ino` recorded in the write
+  evidence.
+
+  **Cost measured as zero**, the same way the 11-, 12- and 13-raises were: the CLI imports only
+  `deployGate`, `asVerifiedDeployReceiptView`, `DEPLOY_RECEIPT_VIEW_SPEC` and `matchGlob`, whose
+  implementing modules are byte-identical 12.0.0 → 13.0.0, and all four return identical values
+  under both. Suite staged against 13.0.0 returned an identical 539/518/21 with a byte-identical
+  28-item failure set. Nothing in the CLI calls the CAS or FS adapters.
+
+## 5.0.1
+
+### Fixed
+- **A fresh install shipped the guard with the conditional-write hole.**
+  `coderifts@5.0.0` declared `@coderifts/agent-guard: ^11.0.0`, which resolved to
+  11.0.1 — precisely the tarball the guard's own 12.0.0 round reproduced the
+  defect against, where `requireConditionalWrite` did not fire on an ordinary
+  mutation and the side effect **ran** with `enforced: true`. The guard is a
+  **direct** dependency with no `peerDependencies` and no bundled copy, so this
+  range *is* the adopter's resolution, not advice. Now `^12.0.0`, with
+  `MIN_GUARD_MAJOR` raised to 12. Cost measured as zero: the CLI imports only
+  `deployGate`, `asVerifiedDeployReceiptView`, `DEPLOY_RECEIPT_VIEW_SPEC` and
+  `matchGlob`, whose modules are byte-identical 11.0.1 → 12.0.0.
+- **Two defects in the publish gate itself**, both proven by replaying the real
+  script. The resolved check only ever compared *downward* — `resolved >= floor`,
+  never whether the resolved version sits **inside** the declared range — so
+  declaring `^11.0.0` with 12.0.0 staged for a cost measurement printed OK and
+  exited 0, which is exactly the shape that makes "we measured 12 and shipped
+  ^11" indistinguishable from a correct release. And an unresolvable install was
+  a **pass**. Three failure modes added (resolved below the declared range at
+  full precision, resolved above it, and not resolvable at all), with no
+  opt-out — an `allowUnresolved` flag was written and deliberately removed, and
+  a test asserts it stays absent.
+
+## 5.0.0
 
 ### Fixed
 - **P0 — `setup-required-check --apply` no longer reports `APPLIED` over a
@@ -59,6 +105,63 @@
   template is unchanged and stays non-blocking; it carries the same three lines
   commented, with a note saying why the two differ.
 
+## 4.13.0 — never published (folded into 5.0.0)
+
+Bumped in-repo (`917611d`) but never tagged or released to npm; 5.0.0 superseded
+it, so adopters received this content **as part of 5.0.0**. Recorded separately
+because the version number appears in the source history and in
+`assert-guard-major.js`'s floor-raise log.
+
+### Changed
+- **Guard floor raised to 11.** Cost measured as zero the way the 10-raise was —
+  the CLI imports only `deployGate`, `asVerifiedDeployReceiptView`,
+  `DEPLOY_RECEIPT_VIEW_SPEC` and `matchGlob`, none of which 11.0.0 touched, and
+  the suite staged against 11 returned an identical 532/530/2 with a
+  byte-identical failure set. It rises anyway, because a semantics floor is about
+  what the CLI may **run** against, not what it happens to import today: 10.x's
+  `computeBundleFingerprint` disagreed with the server, which is exactly the
+  class this gate exists to refuse.
+- The two tests pinning the old floor were updated, and the invariant made
+  explicit: **the floor only ever rises**.
+
+### Added
+- `/api/v1/agent/preflight` returns `scorer_version` — the one field that makes
+  the single-spec fingerprint reproducible by a consumer holding their own
+  before/after/policy. Purely additive; no surface moves and `tools_sha256` is
+  unchanged.
+
+## 4.12.0
+
+### Changed
+- **Guard floor raised to 10.** Cost measured as zero: the CLI imports only
+  `deployGate`, `asVerifiedDeployReceiptView`, `DEPLOY_RECEIPT_VIEW_SPEC` and
+  `matchGlob` — never `withCodeRifts` — so 10.0.0's strict-composition break
+  cannot reach it. Verified by staging guard 10 into the install and running the
+  suite (guard-conformance 6/6, the same two pre-existing failures as the guard-9
+  baseline). The gate was satisfied, not weakened: before the install it
+  correctly reported FAIL on the stale resolve.
+
+## 4.11.0
+
+### Fixed
+- **P0 — the issuer binding pointed at a check that cannot block.** GitHub passes
+  a required status check on `success`, `skipped` **or `neutral`**, so our App's
+  advisory check genuinely cannot block; a false comment in
+  `webhook-integration.js` claiming otherwise is what produced the regression.
+  The enforcing issuer is `app_id 15368` (github-actions), which the contract-gate
+  Action posts under, so that binding is now VERIFIED — with the shared-identity
+  residual **named** rather than implied: anyone who can edit
+  `.github/workflows` can post under it. A binding to our own App id grades
+  UNVERIFIABLE rather than NOT_VERIFIED, because `MERGEGATE_ENFORCE` is
+  server-side and invisible from here.
+- **P0 — the installer wrote what our own verifier rejects.** It now writes
+  `checks[]` with an explicit `app_id`, because an omitted `app_id` silently
+  resolves to whoever posted last, which is unauditable. It never re-binds
+  another team's existing check, and the success path prints what it does **not**
+  achieve. A coupling test asserts the installer's and the verifier's issuer
+  constants are equal. The verifier was not weakened — the name-only and
+  legacy-contexts paths are byte-identical, asserted by two unchanged tests.
+
 ## 4.10.0
 
 ### Added

package/dist/cli.js

@@ -3028,7 +3028,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "5.0.1",
+      version: "6.0.1",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -3067,13 +3067,13 @@ var require_package = __commonJS({
       },
       scripts: {
         build: "node scripts/copy-corpus.js && node scripts/build.js",
-        prepublishOnly: "node scripts/assert-guard-major.js && bash ../../scripts/freeze-gate.sh && npm run build",
+        prepublishOnly: "node scripts/assert-guard-major.js && node scripts/assert-changelog-version.js && bash ../../scripts/freeze-gate.sh && npm run build",
         "assert-guard-major": "node scripts/assert-guard-major.js",
         postinstall: "node scripts/postinstall.js",
         test: "node --test test/*.test.js"
       },
       dependencies: {
-        "@coderifts/agent-guard": "^12.0.0",
+        "@coderifts/agent-guard": "^13.0.0",
         chalk: "^4.1.2",
         "cli-table3": "^0.6.4",
         commander: "^12.0.0",
@@ -67189,6 +67189,9 @@ var require_conditional_write = __commonJS({
         write_style,
         mutating
       };
+      if (ctx.guarantee === "SAME_TRANSACTION" || ctx.guarantee === "CONDITIONAL_EXTERNAL" || ctx.guarantee === "NON_ATOMIC") {
+        basis.guarantee = ctx.guarantee;
+      }
       if (conditional_write === true) {
         if (typeof ctx.conditioned_on_token === "string") {
           basis.conditioned_on_token = ctx.conditioned_on_token;
@@ -67324,8 +67327,11 @@ var require_fs = __commonJS({
       };
     })();
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.tokensEqual = exports2.FS_ABSENT_TOKEN = exports2.FS_VERSION_TOKEN_PREFIX = void 0;
+    exports2.tokensEqual = exports2.UnsafeCasPathError = exports2.FS_ABSENT_TOKEN = exports2.FS_VERSION_TOKEN_PREFIX = void 0;
     exports2.fsTokenContentHash = fsTokenContentHash;
+    exports2.assertSafeCasPath = assertSafeCasPath;
+    exports2.fsObjectIdentity = fsObjectIdentity;
+    exports2.identitiesEqual = identitiesEqual;
     exports2.createFsVersionToken = createFsVersionToken;
     exports2.readVersionedFile = readVersionedFile;
     exports2.writeFileIfUnchanged = writeFileIfUnchanged;
@@ -67354,23 +67360,90 @@ var require_fs = __commonJS({
       const hash = rest.slice(colon + 1);
       return /^[a-f0-9]{64}$/.test(hash) ? hash : null;
     }
+    var UnsafeCasPathError = class extends Error {
+      reason;
+      casPath;
+      constructor(reason, casPath) {
+        super(`unsafe CAS path (${reason}): ${casPath}`);
+        this.name = "UnsafeCasPathError";
+        this.reason = reason;
+        this.casPath = casPath;
+      }
+    };
+    exports2.UnsafeCasPathError = UnsafeCasPathError;
+    async function assertSafeCasPath(filePath) {
+      const segments = filePath.split(/[\\/]+/);
+      if (segments.includes(".."))
+        throw new UnsafeCasPathError("path_traversal", filePath);
+      const resolved = path.resolve(filePath);
+      const dir = path.dirname(resolved);
+      let canonicalDir = dir;
+      try {
+        canonicalDir = await node_fs_1.promises.realpath(dir);
+      } catch (err) {
+        const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
+        if (code !== "ENOENT")
+          throw err;
+      }
+      const target = path.join(canonicalDir, path.basename(resolved));
+      try {
+        const lst = await node_fs_1.promises.lstat(target);
+        if (lst.isSymbolicLink())
+          throw new UnsafeCasPathError("symlink_target", filePath);
+      } catch (err) {
+        if (err instanceof UnsafeCasPathError)
+          throw err;
+        const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
+        if (code !== "ENOENT")
+          throw err;
+      }
+      return target;
+    }
+    async function fsObjectIdentity(filePath) {
+      let fh;
+      try {
+        fh = await node_fs_1.promises.open(filePath, "r");
+        const st = await fh.stat();
+        return { dev: st.dev, ino: st.ino };
+      } catch (err) {
+        const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
+        if (code === "ENOENT")
+          return null;
+        throw err;
+      } finally {
+        if (fh)
+          await fh.close().catch(() => {
+          });
+      }
+    }
+    function identitiesEqual(a, b) {
+      if (!a || !b)
+        return false;
+      return a.dev === b.dev && a.ino === b.ino;
+    }
     async function createFsVersionToken(filePath) {
-      let st;
+      let fh;
       try {
-        st = await node_fs_1.promises.stat(filePath);
+        fh = await node_fs_1.promises.open(filePath, "r");
       } catch (err) {
         const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
         if (code === "ENOENT")
           return exports2.FS_ABSENT_TOKEN;
         throw err;
       }
-      if (!st.isFile()) {
-        throw new Error(`createFsVersionToken: not a regular file: ${filePath}`);
+      try {
+        const st = await fh.stat();
+        if (!st.isFile()) {
+          throw new Error(`createFsVersionToken: not a regular file: ${filePath}`);
+        }
+        const buf = await fh.readFile();
+        const hash = sha256hex(buf);
+        const mtimeMs = Math.trunc(st.mtimeMs);
+        return `${exports2.FS_VERSION_TOKEN_PREFIX}${mtimeMs}:${hash}`;
+      } finally {
+        await fh.close().catch(() => {
+        });
       }
-      const buf = await node_fs_1.promises.readFile(filePath);
-      const hash = sha256hex(buf);
-      const mtimeMs = Math.trunc(st.mtimeMs);
-      return `${exports2.FS_VERSION_TOKEN_PREFIX}${mtimeMs}:${hash}`;
     }
     async function readVersionedFile(filePath) {
       const version_token = await createFsVersionToken(filePath);
@@ -67381,9 +67454,23 @@ var require_fs = __commonJS({
       return { content, version_token };
     }
     async function writeFileIfUnchanged(args) {
-      const target = path.resolve(args.path);
+      const target = await assertSafeCasPath(args.path);
       const body = typeof args.content === "string" ? Buffer.from(args.content, "utf8") : args.content;
       const writtenHash = sha256hex(body);
+      const checkedIdentity = await fsObjectIdentity(target);
+      const hasT1Identity = Object.prototype.hasOwnProperty.call(args, "expected_identity");
+      if (hasT1Identity) {
+        const t1 = args.expected_identity ?? null;
+        const held = t1 === null ? checkedIdentity === null : identitiesEqual(t1, checkedIdentity);
+        if (!held) {
+          return {
+            status: "refused",
+            reason: "stale_version_token",
+            expected_token: args.expected_token,
+            current_token: await createFsVersionToken(target).catch(() => null)
+          };
+        }
+      }
       return (0, conditional_write_js_1.executeIfUnchanged)({
         expected_token: args.expected_token,
         current_token: () => createFsVersionToken(target),
@@ -67402,6 +67489,15 @@ var require_fs = __commonJS({
           const tmp = path.join(dir, `.coderifts-cas-${path.basename(target)}-${process.pid}-${(0, node_crypto_1.randomBytes)(6).toString("hex")}.tmp`);
           try {
             await node_fs_1.promises.writeFile(tmp, body);
+            const stillIdentity = await fsObjectIdentity(target);
+            const identityHeld = checkedIdentity === null ? stillIdentity === null : identitiesEqual(checkedIdentity, stillIdentity);
+            if (!identityHeld) {
+              try {
+                await node_fs_1.promises.unlink(tmp);
+              } catch {
+              }
+              throw new conditional_write_js_1.StaleVersionTokenAbort(await createFsVersionToken(target).catch(() => null));
+            }
             const still = await createFsVersionToken(target);
             if (!(0, conditional_write_js_1.tokensEqual)(args.expected_token, still)) {
               try {
@@ -67420,7 +67516,13 @@ var require_fs = __commonJS({
             }
             throw err;
           }
-          return { path: target, bytes: body.length, written_content_hash: writtenHash };
+          return {
+            path: target,
+            bytes: body.length,
+            written_content_hash: writtenHash,
+            checked_identity: checkedIdentity,
+            committed_identity: await fsObjectIdentity(target)
+          };
         }
       });
     }
@@ -69409,6 +69511,10 @@ var require_cas_attestation = __commonJS({
         const s = x;
         return s.reason === "stale_during_commit" && typeof s.expected_token === "string";
       }
+      if (o.status === "indeterminate") {
+        const i = x;
+        return (i.reason === "response_lost" || i.reason === "ambiguous_provider_reply" || i.reason === "observation_failed") && typeof i.expected_token === "string";
+      }
       return false;
     }
     function freezeExecutionResultHash(h) {
@@ -69431,6 +69537,15 @@ var require_cas_attestation = __commonJS({
           current_token: outcome.current_token == null ? null : outcome.current_token
         });
       }
+      if (outcome.status === "indeterminate") {
+        return Object.freeze({
+          status: "indeterminate",
+          write_ran: "unknown",
+          reason: outcome.reason,
+          expected_token: outcome.expected_token,
+          observed_token: outcome.observed_token == null ? null : outcome.observed_token
+        });
+      }
       return Object.freeze({
         status: "committed_stale_detected",
         write_ran: true,
@@ -69451,6 +69566,7 @@ var require_cas_attestation = __commonJS({
       const write_ran = cas.write_ran === true;
       const stale_during_commit = cas.status === "committed_stale_detected";
       const refused = cas.status === "refused";
+      const indeterminate = cas.status === "indeterminate";
       const cas_evidence = evaluateCasEvidence(outcome, opts);
       let authorized_and_committed = receipt_verified && cas.status === "committed";
       if (opts.profile === "ENFORCING_STRICT") {
@@ -69471,7 +69587,8 @@ var require_cas_attestation = __commonJS({
           authorized_and_committed,
           write_ran,
           stale_during_commit,
-          refused
+          refused,
+          indeterminate
         }),
         cas_evidence,
         limits: LIMITS
@@ -72729,6 +72846,8 @@ var require_fs_default_wire = __commonJS({
     exports2.inferFsPathFromArgs = inferFsPathFromArgs;
     exports2.inferFullFileWriteContent = inferFullFileWriteContent;
     exports2.wrapWriteWithFsCas = wrapWriteWithFsCas;
+    exports2.measureFsAuthorization = measureFsAuthorization;
+    exports2.measureFsAuthorizationToken = measureFsAuthorizationToken;
     var cas_attestation_js_1 = require_cas_attestation();
     var fs_js_1 = require_fs();
     function inferFsPathFromArgs(args) {
@@ -72755,20 +72874,16 @@ var require_fs_default_wire = __commonJS({
       }
       return null;
     }
-    async function wrapWriteWithFsCas(args, write) {
+    async function wrapWriteWithFsCas(args, write, opts) {
       const filePath = inferFsPathFromArgs(args);
       const content = inferFullFileWriteContent(args);
-      if (filePath && content != null) {
-        let expected;
-        try {
-          expected = await (0, fs_js_1.createFsVersionToken)(filePath);
-        } catch {
-          return write();
-        }
+      const expected = opts && typeof opts.expected_token === "string" ? opts.expected_token : null;
+      if (filePath && content != null && expected !== null) {
         return (0, fs_js_1.writeFileIfUnchanged)({
           path: filePath,
           expected_token: expected,
-          content
+          content,
+          ...opts && "expected_identity" in opts ? { expected_identity: opts.expected_identity ?? null } : {}
         });
       }
       const raw = await write();
@@ -72776,6 +72891,24 @@ var require_fs_default_wire = __commonJS({
         return raw;
       return raw;
     }
+    async function measureFsAuthorization(args) {
+      const filePath = inferFsPathFromArgs(args);
+      const content = inferFullFileWriteContent(args);
+      if (!filePath || content == null)
+        return null;
+      try {
+        const target = await (0, fs_js_1.assertSafeCasPath)(filePath);
+        const expected_identity = await (0, fs_js_1.fsObjectIdentity)(target);
+        const expected_token = await (0, fs_js_1.createFsVersionToken)(target);
+        return { expected_token, expected_identity };
+      } catch {
+        return null;
+      }
+    }
+    async function measureFsAuthorizationToken(args) {
+      const m = await measureFsAuthorization(args);
+      return m ? m.expected_token : null;
+    }
   }
 });
 
@@ -72960,6 +73093,11 @@ var require_tool_registry = __commonJS({
             lastDerivation = d.derivation;
             return d.call;
           };
+          const rebindAndRemeasure = async () => {
+            const c = await rebind();
+            casAuth = await (0, fs_default_wire_js_1.measureFsAuthorization)(args);
+            return c;
+          };
           const call = await rebind();
           const refreshContext = async (c) => (0, freshness_js_1.collectFreshnessCallContext)({
             call: {
@@ -72970,16 +73108,17 @@ var require_tool_registry = __commonJS({
             resolvePriorContent: guardCfg.resolvePriorContent
           });
           const fctx = await refreshContext(call);
+          let casAuth = await (0, fs_default_wire_js_1.measureFsAuthorization)(args);
           const factory = async (_envelope, redacted, execution) => {
             const rawArgs = redacted ? redacted.arguments : args;
-            return (0, fs_default_wire_js_1.wrapWriteWithFsCas)(rawArgs, () => execution ? rawExecute(rawArgs, execution) : rawExecute(rawArgs));
+            return (0, fs_default_wire_js_1.wrapWriteWithFsCas)(rawArgs, () => execution ? rawExecute(rawArgs, execution) : rawExecute(rawArgs), casAuth ? { expected_token: casAuth.expected_token, expected_identity: casAuth.expected_identity } : {});
           };
           const outcome = (0, auto_recheck_js_1.normalizeAutoRecheck)(guardCfg.autoRecheck) ? await (0, auto_recheck_js_1.runAutoRecheckLoop)({
             call,
             factory,
             config: guardCfg,
             callContext: fctx,
-            rebind,
+            rebind: rebindAndRemeasure,
             refreshContext
           }) : await (0, guard_js_1.guardToolCall)(call, factory, guardCfg, fctx);
           return (0, auto_derive_js_1.attachDerivation)(outcome, lastDerivation);
@@ -75298,9 +75437,10 @@ var require_cjs4 = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.monitorAttestSigningInput = exports2.kidFromMonitoringAttestation = exports2.tryIssueMonitoringAttestation = exports2.DEFAULT_MONITORING_SINK_TIMEOUT_MS = exports2.ackBytes = exports2.verifyAckHmac = exports2.monitoringDeliveryFailClosed = exports2.formatMonitoringDeliveryLine = exports2.deliverMonitoring = exports2.hashObservedContent = exports2.observeCommit = exports2.deriveKeySignal = exports2.pathClass = exports2.classifyCommand = exports2.projectState = exports2.emptySessionState = exports2.computeTainted = exports2.evaluate = exports2.updateSession = exports2.SESSION_TAINT_VERSION = exports2.SessionTaintTracker = exports2.readDecision = exports2.EXECUTION_TIME_FP_REASONS = exports2.EXECUTION_STATE_UNMEASURABLE_NOTE = exports2.isUnmeasurableExecutionStateReason = exports2.computeCanonicalBundleFingerprint = exports2.authorizedFingerprintFromEnvelope = exports2.checkExecutionTimeFingerprint = exports2.computeBundleFingerprint = exports2.computeArtifactDigest = exports2.evaluateEnvelope = exports2.RECEIPT_PREV_NULL = exports2.decodeReceiptBodyPrev = exports2.previousReceiptCommitment = exports2.verifyReceiptChainLinkage = exports2.canonicalJson = exports2.computeBodyHash = exports2.bindReceiptToEnvelope = exports2.DETECTOR_VERSION = exports2.builtinDetector = exports2.resetPolicyWarnForTests = exports2.warnPolicyAbsentOnce = exports2.observePolicyPresence = exports2.detectPolicyPresence = exports2.policyPresenceOf = exports2.withPolicy = exports2.POLICY_ABSENT_WARN = exports2.POLICY_MARKER = exports2.CODERIFTS_POLICY = exports2.guardToolCall = void 0;
-    exports2.DB_ABSENT_TOKEN = exports2.DB_VERSION_TOKEN_PREFIX = exports2.dbTokenRaw = exports2.writeDbIfUnchanged = exports2.createDbVersionToken = exports2.API_ABSENT_TOKEN = exports2.API_VERSION_TOKEN_PREFIX = exports2.apiTokenRaw = exports2.writeApiIfUnchanged = exports2.createApiVersionToken = exports2.FS_ABSENT_TOKEN = exports2.FS_VERSION_TOKEN_PREFIX = exports2.fsTokenContentHash = exports2.createFsPriorContentResolver = exports2.writeFileIfUnchanged = exports2.readVersionedFile = exports2.createFsVersionToken = exports2.StaleVersionTokenAbort = exports2.executeIfUnchanged = exports2.RESIDUAL_UNCONDITIONAL_WRITE = exports2.conditionalWriteResidual = exports2.tokensEqual = exports2.buildConditionalWriteBasis = exports2.buildFreshnessBasis = exports2.collectFreshnessCallContext = exports2.artifactIdsForResolve = exports2.isMutatingCall = exports2.isWriteStyleCall = exports2.freshnessAllowsEnforce = exports2.computePathSetTreeHash = exports2.contentByteIdentical = exports2.assessWriteStylePrior = exports2.assessFreshness = exports2.deriveProofBanner = exports2.attachProofToAgentResponse = exports2.renderFinalAnswerProof = exports2.EXECUTION_PROOF_SPEC = exports2.assertEnforcedReceiptInvariant = exports2.hashExecutionResult = exports2.buildExecutionProof = exports2.COVERAGE_ATTEST_ENVELOPE_TAG = exports2.COVERAGE_ATTEST_SIGNING_PREFIX = exports2.COVERAGE_ATTEST_VERSION = exports2.coverageAttestSigningInput = exports2.kidFromCoverageAttestation = exports2.tryIssueCoverageAttestation = exports2.MONITOR_ATTEST_ENVELOPE_TAG = exports2.MONITOR_ATTEST_SIGNING_PREFIX = exports2.MONITOR_ATTEST_VERSION = exports2.receiptDigestOfToken = void 0;
-    exports2.freezeCoverageObserved = exports2.createCoverageObserver = exports2.readExecutionGrantToken = exports2.isExecutionGrantEnabled = exports2.guardedFractionAmongRoutes = exports2.foldTableSettledCalls = exports2.withCodeRifts = exports2.AUTO_DERIVE_READ_TIMEOUT_MS = exports2.AUTO_DERIVE_SOURCE = exports2.defaultFsReader = exports2.normalizeAutoDerive = exports2.runAutoDerive = exports2.AUTO_RECHECK_MAX_CAP = exports2.clampMaxAttempts = exports2.normalizeAutoRecheck = exports2.runAutoRecheckLoop = exports2.coverageReport = exports2.DEPLOY_REPAIRABLE_REASONS = exports2.bindDeploy = exports2.verifyDeployReceiptToken = exports2.DEPLOY_RECEIPT_VIEW_SPEC = exports2.isVerifiedDeployReceiptView = exports2.asVerifiedDeployReceiptView = exports2.deployGate = exports2.gateDecision = exports2.RegistryConstructionError = exports2.guardToolRegistry = exports2.globToRegExp = exports2.matchGlob = exports2.blobMapKey = exports2.classifyByName = exports2.resolveArtifacts = exports2.REMEDIATION_LOOP_ATTESTATION_SPEC = exports2.isCasAttestation = exports2.readPriorBlockRemediation = exports2.readRemediationTransaction = exports2.buildRemediationLoopAttestation = exports2.COMMIT_EVIDENCE_MISSING = exports2.CAS_ATTESTATION_SPEC = exports2.strictCommitObservation = exports2.extractExecutorAttestationToken = exports2.evaluateCasEvidence = exports2.isExecuteIfUnchangedOutcome = exports2.isGuardExecutionProof = exports2.buildCasAttestation = exports2.REGISTRY_ABSENT_TOKEN = exports2.REGISTRY_VERSION_TOKEN_PREFIX = exports2.registryTokenRaw = exports2.writeRegistryIfUnchanged = exports2.createRegistryVersionToken = void 0;
-    exports2.kidFromToolsetAttestation = exports2.tryIssueToolsetAttestation = exports2.toolsetAttestSigningInput = exports2.declarationEntriesFromTools = exports2.computeToolsetDigest = exports2.TOOLSET_ATTEST_STATEMENT = exports2.TOOLSET_ATTEST_ENVELOPE_TAG = exports2.TOOLSET_ATTEST_SIGNING_PREFIX = exports2.TOOLSET_ATTEST_VERSION = exports2.surfaceEnvelopeFields = exports2.isGuardOutcome = exports2.executeLangGraphToolCall = exports2.executeGeminiToolCall = exports2.executeAnthropicToolCall = exports2.executeOpenAIToolCall = exports2.executeProtectedTool = exports2.defaultSerializeGeminiToolResult = exports2.bindGeminiGuardOutcome = exports2.protectedToolToFunctionDeclaration = exports2.toGeminiTools = exports2.geminiToolAdapter = exports2.withCodeRiftsGemini = exports2.wrapWriteWithFsCas = exports2.inferFullFileWriteContent = exports2.inferFsPathFromArgs = exports2.FRESHNESS_RESOLVER_FIX = exports2.freshnessRefusalTeaching = exports2.formatGateRefusalBody = exports2.defaultSerializeLangGraphToolResult = exports2.bindLangGraphGuardOutcome = exports2.LangGraphToolsNotStructuredError = exports2.isLangGraphReactAgentTool = exports2.bindLangGraphTools = exports2.protectedToolToLangGraph = exports2.toLangGraphTools = exports2.langGraphToolAdapter = exports2.withCodeRiftsLangGraph = exports2.defaultSerializeAnthropicToolResult = exports2.bindAnthropicGuardOutcome = exports2.protectedToolToAnthropic = exports2.toAnthropicTools = exports2.anthropicToolAdapter = exports2.withCodeRiftsAnthropic = exports2.defaultSerializeOpenAIToolResult = exports2.bindOpenAIGuardOutcome = exports2.protectedToolToOpenAI = exports2.toOpenAITools = exports2.openAIToolAdapter = exports2.withCodeRiftsOpenAI = exports2.formatCoverageObservedLine = void 0;
+    exports2.createDbVersionToken = exports2.API_ABSENT_TOKEN = exports2.API_VERSION_TOKEN_PREFIX = exports2.apiTokenRaw = exports2.writeApiIfUnchanged = exports2.createApiVersionToken = exports2.identitiesEqual = exports2.fsObjectIdentity = exports2.UnsafeCasPathError = exports2.assertSafeCasPath = exports2.FS_ABSENT_TOKEN = exports2.FS_VERSION_TOKEN_PREFIX = exports2.fsTokenContentHash = exports2.createFsPriorContentResolver = exports2.writeFileIfUnchanged = exports2.readVersionedFile = exports2.createFsVersionToken = exports2.StaleVersionTokenAbort = exports2.executeIfUnchanged = exports2.RESIDUAL_UNCONDITIONAL_WRITE = exports2.conditionalWriteResidual = exports2.tokensEqual = exports2.buildConditionalWriteBasis = exports2.buildFreshnessBasis = exports2.collectFreshnessCallContext = exports2.artifactIdsForResolve = exports2.isMutatingCall = exports2.isWriteStyleCall = exports2.freshnessAllowsEnforce = exports2.computePathSetTreeHash = exports2.contentByteIdentical = exports2.assessWriteStylePrior = exports2.assessFreshness = exports2.deriveProofBanner = exports2.attachProofToAgentResponse = exports2.renderFinalAnswerProof = exports2.EXECUTION_PROOF_SPEC = exports2.assertEnforcedReceiptInvariant = exports2.hashExecutionResult = exports2.buildExecutionProof = exports2.COVERAGE_ATTEST_ENVELOPE_TAG = exports2.COVERAGE_ATTEST_SIGNING_PREFIX = exports2.COVERAGE_ATTEST_VERSION = exports2.coverageAttestSigningInput = exports2.kidFromCoverageAttestation = exports2.tryIssueCoverageAttestation = exports2.MONITOR_ATTEST_ENVELOPE_TAG = exports2.MONITOR_ATTEST_SIGNING_PREFIX = exports2.MONITOR_ATTEST_VERSION = exports2.receiptDigestOfToken = void 0;
+    exports2.guardedFractionAmongRoutes = exports2.foldTableSettledCalls = exports2.withCodeRifts = exports2.AUTO_DERIVE_READ_TIMEOUT_MS = exports2.AUTO_DERIVE_SOURCE = exports2.defaultFsReader = exports2.normalizeAutoDerive = exports2.runAutoDerive = exports2.AUTO_RECHECK_MAX_CAP = exports2.clampMaxAttempts = exports2.normalizeAutoRecheck = exports2.runAutoRecheckLoop = exports2.coverageReport = exports2.DEPLOY_REPAIRABLE_REASONS = exports2.bindDeploy = exports2.verifyDeployReceiptToken = exports2.DEPLOY_RECEIPT_VIEW_SPEC = exports2.isVerifiedDeployReceiptView = exports2.asVerifiedDeployReceiptView = exports2.deployGate = exports2.gateDecision = exports2.RegistryConstructionError = exports2.guardToolRegistry = exports2.globToRegExp = exports2.matchGlob = exports2.blobMapKey = exports2.classifyByName = exports2.resolveArtifacts = exports2.REMEDIATION_LOOP_ATTESTATION_SPEC = exports2.isCasAttestation = exports2.readPriorBlockRemediation = exports2.readRemediationTransaction = exports2.buildRemediationLoopAttestation = exports2.COMMIT_EVIDENCE_MISSING = exports2.CAS_ATTESTATION_SPEC = exports2.strictCommitObservation = exports2.extractExecutorAttestationToken = exports2.evaluateCasEvidence = exports2.isExecuteIfUnchangedOutcome = exports2.isGuardExecutionProof = exports2.buildCasAttestation = exports2.REGISTRY_ABSENT_TOKEN = exports2.REGISTRY_VERSION_TOKEN_PREFIX = exports2.registryTokenRaw = exports2.writeRegistryIfUnchanged = exports2.createRegistryVersionToken = exports2.DB_ABSENT_TOKEN = exports2.DB_VERSION_TOKEN_PREFIX = exports2.dbTokenRaw = exports2.writeDbIfUnchanged = void 0;
+    exports2.TOOLSET_ATTEST_ENVELOPE_TAG = exports2.TOOLSET_ATTEST_SIGNING_PREFIX = exports2.TOOLSET_ATTEST_VERSION = exports2.surfaceEnvelopeFields = exports2.isGuardOutcome = exports2.executeLangGraphToolCall = exports2.executeGeminiToolCall = exports2.executeAnthropicToolCall = exports2.executeOpenAIToolCall = exports2.executeProtectedTool = exports2.defaultSerializeGeminiToolResult = exports2.bindGeminiGuardOutcome = exports2.protectedToolToFunctionDeclaration = exports2.toGeminiTools = exports2.geminiToolAdapter = exports2.withCodeRiftsGemini = exports2.measureFsAuthorizationToken = exports2.measureFsAuthorization = exports2.wrapWriteWithFsCas = exports2.inferFullFileWriteContent = exports2.inferFsPathFromArgs = exports2.FRESHNESS_RESOLVER_FIX = exports2.freshnessRefusalTeaching = exports2.formatGateRefusalBody = exports2.defaultSerializeLangGraphToolResult = exports2.bindLangGraphGuardOutcome = exports2.LangGraphToolsNotStructuredError = exports2.isLangGraphReactAgentTool = exports2.bindLangGraphTools = exports2.protectedToolToLangGraph = exports2.toLangGraphTools = exports2.langGraphToolAdapter = exports2.withCodeRiftsLangGraph = exports2.defaultSerializeAnthropicToolResult = exports2.bindAnthropicGuardOutcome = exports2.protectedToolToAnthropic = exports2.toAnthropicTools = exports2.anthropicToolAdapter = exports2.withCodeRiftsAnthropic = exports2.defaultSerializeOpenAIToolResult = exports2.bindOpenAIGuardOutcome = exports2.protectedToolToOpenAI = exports2.toOpenAITools = exports2.openAIToolAdapter = exports2.withCodeRiftsOpenAI = exports2.formatCoverageObservedLine = exports2.freezeCoverageObserved = exports2.createCoverageObserver = exports2.readExecutionGrantToken = exports2.isExecutionGrantEnabled = void 0;
+    exports2.kidFromToolsetAttestation = exports2.tryIssueToolsetAttestation = exports2.toolsetAttestSigningInput = exports2.declarationEntriesFromTools = exports2.computeToolsetDigest = exports2.TOOLSET_ATTEST_STATEMENT = void 0;
     var guard_js_1 = require_guard();
     Object.defineProperty(exports2, "guardToolCall", { enumerable: true, get: function() {
       return guard_js_1.guardToolCall;
@@ -75589,6 +75729,18 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "FS_ABSENT_TOKEN", { enumerable: true, get: function() {
       return fs_js_1.FS_ABSENT_TOKEN;
     } });
+    Object.defineProperty(exports2, "assertSafeCasPath", { enumerable: true, get: function() {
+      return fs_js_1.assertSafeCasPath;
+    } });
+    Object.defineProperty(exports2, "UnsafeCasPathError", { enumerable: true, get: function() {
+      return fs_js_1.UnsafeCasPathError;
+    } });
+    Object.defineProperty(exports2, "fsObjectIdentity", { enumerable: true, get: function() {
+      return fs_js_1.fsObjectIdentity;
+    } });
+    Object.defineProperty(exports2, "identitiesEqual", { enumerable: true, get: function() {
+      return fs_js_1.identitiesEqual;
+    } });
     var api_js_1 = require_api3();
     Object.defineProperty(exports2, "createApiVersionToken", { enumerable: true, get: function() {
       return api_js_1.createApiVersionToken;
@@ -75876,6 +76028,12 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "wrapWriteWithFsCas", { enumerable: true, get: function() {
       return fs_default_wire_js_1.wrapWriteWithFsCas;
     } });
+    Object.defineProperty(exports2, "measureFsAuthorization", { enumerable: true, get: function() {
+      return fs_default_wire_js_1.measureFsAuthorization;
+    } });
+    Object.defineProperty(exports2, "measureFsAuthorizationToken", { enumerable: true, get: function() {
+      return fs_default_wire_js_1.measureFsAuthorizationToken;
+    } });
     var gemini_js_1 = require_gemini();
     Object.defineProperty(exports2, "withCodeRiftsGemini", { enumerable: true, get: function() {
       return gemini_js_1.withCodeRiftsGemini;
@@ -253975,6 +254133,16 @@ var require_github_enforcement = __commonJS({
       RULESET_ABSENT: "ruleset_absent",
       /** Rulesets could not be read at all. */
       RULESET_UNREADABLE: "ruleset_unreadable",
+      /** A ruleset requires our context but does not TARGET the branch that matters (1104a). */
+      RULESET_REF_NOT_TARGETED: "ruleset_ref_not_targeted",
+      /** Active, bound, targeted — but strict latest-head is off (1104b). Recorded, not fatal. */
+      RULESET_STRICT_POLICY_OFF: "ruleset_strict_policy_off",
+      /** 1102 — no active targeting ruleset requires a workflow at all. */
+      REQUIRED_WORKFLOW_ABSENT: "required_workflow_absent",
+      /** 1102 — a workflows rule exists but carries no sha, so it names a path and not bytes. */
+      REQUIRED_WORKFLOW_UNPINNED: "required_workflow_unpinned",
+      /** 1102 — a required workflow is pinned to a full commit sha. */
+      REQUIRED_WORKFLOW_SHA_PINNED: "required_workflow_sha_pinned",
       REQUIRED_CHECK_ABSENT: "required_check_absent",
       ACTIVE_JOB: "active_job",
       NO_ACTIVE_JOB: "no_active_job",
@@ -254005,6 +254173,41 @@ var require_github_enforcement = __commonJS({
       const n = Number(value);
       return Number.isInteger(n) && n > 0 ? n : null;
     }
+    function refPatterns(rs, key) {
+      const rn = rs && rs.conditions && rs.conditions.ref_name;
+      if (!rn || !Array.isArray(rn[key])) return null;
+      return rn[key].map((x) => String(x));
+    }
+    function targetsDefaultBranch(entry, defaultBranch) {
+      if (entry.target === "tag") return false;
+      const inc = entry.ref_include;
+      if (!Array.isArray(inc)) return null;
+      const ref = defaultBranch ? `refs/heads/${defaultBranch}` : null;
+      const matches = (pat) => {
+        if (pat === "~ALL" || pat === "~DEFAULT_BRANCH") return true;
+        if (!ref) return null;
+        if (pat === ref) return true;
+        if (!pat.includes("*") && !pat.includes("[") && !pat.includes("?")) return false;
+        const rx = new RegExp(`^${pat.replace(/[.+^${}()|\\]/g, "\\$&").replace(/\*/g, "[^/]*").replace(/\?/g, ".")}$`);
+        return rx.test(ref);
+      };
+      let included = false;
+      for (const pat of inc) {
+        const m = matches(pat);
+        if (m === null) return null;
+        if (m) {
+          included = true;
+          break;
+        }
+      }
+      if (!included) return false;
+      for (const pat of entry.ref_exclude || []) {
+        const m = matches(pat);
+        if (m === null) return null;
+        if (m) return false;
+      }
+      return true;
+    }
     function rulesetRequiredCheckEntries(rulesets) {
       const out = [];
       const list = Array.isArray(rulesets) ? rulesets : [];
@@ -254023,7 +254226,15 @@ var require_github_enforcement = __commonJS({
               enforcement: typeof rs.enforcement === "string" ? rs.enforcement : null,
               integration_id: numericAppId(c && c.integration_id),
               bypass_visible: Object.prototype.hasOwnProperty.call(rs, "bypass_actors"),
-              bypass_count: Array.isArray(rs.bypass_actors) ? rs.bypass_actors.length : null
+              bypass_count: Array.isArray(rs.bypass_actors) ? rs.bypass_actors.length : null,
+              // 1104a — a ruleset can be ACTIVE and target nothing that matters. MEASURED against the
+              // live API: `target` and `conditions.ref_name` are both in the detail document we already
+              // fetch, so this is a grading change and needs no new call.
+              target: typeof rs.target === "string" ? rs.target : null,
+              ref_include: refPatterns(rs, "include"),
+              ref_exclude: refPatterns(rs, "exclude"),
+              // 1104b — same document, one boolean.
+              strict_policy: typeof params.strict_required_status_checks_policy === "boolean" ? params.strict_required_status_checks_policy : null
             });
           }
         }
@@ -254031,7 +254242,7 @@ var require_github_enforcement = __commonJS({
       return out;
     }
     var RULESET_BYPASS_CAVEAT = " Bypass actors were not readable on this surface, so this does not establish that nobody can bypass the ruleset.";
-    function evaluateRuleset(rulesets) {
+    function evaluateRuleset(rulesets, defaultBranch = null) {
       if (rulesets == null) {
         return {
           status: STATUS.UNVERIFIABLE,
@@ -254062,12 +254273,41 @@ var require_github_enforcement = __commonJS({
       }
       const bound = active.find((e) => e.integration_id === ENFORCING_ISSUER_APP_ID);
       if (bound) {
+        const targeted = targetsDefaultBranch(bound, defaultBranch);
+        if (targeted === false) {
+          return {
+            status: STATUS.NOT_VERIFIED,
+            reason_code: REASON.RULESET_REF_NOT_TARGETED,
+            reason: `active ruleset "${bound.ruleset}" requires "${CHECK_NAME}" bound to the enforcing issuer, but its conditions do not target ${defaultBranch ? `refs/heads/${defaultBranch}` : "the default branch"}${bound.target === "tag" ? " (the ruleset targets tags, which never gate a merge to a branch)" : ""} \u2014 include: ${JSON.stringify(bound.ref_include)}, exclude: ${JSON.stringify(bound.ref_exclude || [])}`,
+            ruleset_names: names,
+            app_id: ENFORCING_ISSUER_APP_ID,
+            ref_targeted: false
+          };
+        }
+        if (targeted === null) {
+          return {
+            status: STATUS.UNVERIFIABLE,
+            reason_code: REASON.RULESET_REF_NOT_TARGETED,
+            reason: `active ruleset "${bound.ruleset}" binds "${CHECK_NAME}" to the enforcing issuer, but its ref conditions could not be read, so whether it targets the branch that matters CANNOT BE DETERMINED FROM HERE.${RULESET_BYPASS_CAVEAT}`,
+            ruleset_names: names,
+            app_id: ENFORCING_ISSUER_APP_ID,
+            ref_targeted: null
+          };
+        }
         return {
           status: STATUS.VERIFIED,
           reason_code: REASON.RULESET_ISSUER_BOUND,
-          reason: `active ruleset "${bound.ruleset}" requires "${CHECK_NAME}" bound to integration_id ${ENFORCING_ISSUER_APP_ID} (${GITHUB_ACTIONS_APP_SLUG}) \u2014 the contract-gate Action, which concludes failure and blocks the merge.${RULESET_BYPASS_CAVEAT}`,
+          reason: `active ruleset "${bound.ruleset}" requires "${CHECK_NAME}" bound to integration_id ${ENFORCING_ISSUER_APP_ID} (${GITHUB_ACTIONS_APP_SLUG}) \u2014 the contract-gate Action, which concludes failure and blocks the merge. It targets ${defaultBranch ? `refs/heads/${defaultBranch}` : "the default branch"}.` + (bound.strict_policy === true ? " strict_required_status_checks_policy is ON, so a stale head cannot merge." : bound.strict_policy === false ? " RESIDUAL: strict_required_status_checks_policy is OFF, so a branch whose head is behind the base can merge on a check that passed against older bytes." : " strict_required_status_checks_policy was not readable here.") + RULESET_BYPASS_CAVEAT,
           ruleset_names: names,
-          app_id: ENFORCING_ISSUER_APP_ID
+          app_id: ENFORCING_ISSUER_APP_ID,
+          ref_targeted: true,
+          strict_policy: bound.strict_policy,
+          strict_policy_residual: bound.strict_policy === false ? REASON.RULESET_STRICT_POLICY_OFF : null,
+          // 1104c — NEVER an absence we cannot see. bypass_actors is in the ruleset schema but was
+          // absent from all six live rulesets read without a credential (measured 2026-08-27), so
+          // "not present in the response" is reported as NOT VISIBLE and never as "none configured".
+          bypass_visible: bound.bypass_visible === true,
+          bypass_count: bound.bypass_visible === true ? bound.bypass_count : null
         };
       }
       const other = active.find((e) => e.integration_id != null);
@@ -254088,9 +254328,66 @@ var require_github_enforcement = __commonJS({
         ruleset_names: names
       };
     }
-    function evaluateRequiredCheckAcrossSurfaces(protection, rulesets) {
+    function evaluateRequiredWorkflowPin(rulesets, defaultBranch = null) {
+      if (rulesets == null) {
+        return { status: STATUS.UNVERIFIABLE, reason_code: REASON.RULESET_UNREADABLE, pinned: null, workflows: [] };
+      }
+      const found = [];
+      for (const rs of Array.isArray(rulesets) ? rulesets : []) {
+        if (!rs || typeof rs !== "object") continue;
+        if (rs.enforcement !== "active") continue;
+        const entryShape = {
+          target: typeof rs.target === "string" ? rs.target : null,
+          ref_include: refPatterns(rs, "include"),
+          ref_exclude: refPatterns(rs, "exclude")
+        };
+        if (targetsDefaultBranch(entryShape, defaultBranch) !== true) continue;
+        for (const rule of Array.isArray(rs.rules) ? rs.rules : []) {
+          if (!rule || rule.type !== "workflows") continue;
+          const list = rule.parameters && Array.isArray(rule.parameters.workflows) ? rule.parameters.workflows : [];
+          for (const w of list) {
+            if (!w || typeof w !== "object") continue;
+            found.push({
+              ruleset: String(rs.name || rs.id || "ruleset"),
+              path: typeof w.path === "string" ? w.path : null,
+              repository_id: Number.isInteger(w.repository_id) ? w.repository_id : null,
+              ref: typeof w.ref === "string" ? w.ref : null,
+              // The whole question. sha is optional in the schema, so its ABSENCE is the finding.
+              sha: typeof w.sha === "string" && /^[0-9a-f]{40}$/i.test(w.sha) ? w.sha : null
+            });
+          }
+        }
+      }
+      if (found.length === 0) {
+        return {
+          status: STATUS.NOT_VERIFIED,
+          reason_code: REASON.REQUIRED_WORKFLOW_ABSENT,
+          pinned: false,
+          workflows: [],
+          reason: `no active ruleset targeting this branch requires a workflow, so the check that gates the merge is bound only to the SHARED issuer ${ENFORCING_ISSUER_APP_ID} (${GITHUB_ACTIONS_APP_SLUG}) \u2014 anyone who can edit .github/workflows can post under it`
+        };
+      }
+      const pinned = found.filter((w) => w.sha != null);
+      if (pinned.length === 0) {
+        return {
+          status: STATUS.NOT_VERIFIED,
+          reason_code: REASON.REQUIRED_WORKFLOW_UNPINNED,
+          pinned: false,
+          workflows: found,
+          reason: `a required workflow is configured (${found.map((w) => w.path || "?").join(", ")}) but NONE carries a sha. \`sha\` is optional in the rule schema, and without it the ruleset names a path rather than bytes, so rewriting that file still changes what runs`
+        };
+      }
+      return {
+        status: STATUS.VERIFIED,
+        reason_code: REASON.REQUIRED_WORKFLOW_SHA_PINNED,
+        pinned: true,
+        workflows: found,
+        reason: `active ruleset "${pinned[0].ruleset}" requires workflow ${pinned[0].path} pinned to sha ${pinned[0].sha} in repository_id ${pinned[0].repository_id}. Moving that pin requires editing the ruleset (repository administration), which is a different permission from workflow write. This does NOT establish that any pull request ran it, nor that bypass actors cannot skip the ruleset.`
+      };
+    }
+    function evaluateRequiredCheckAcrossSurfaces(protection, rulesets, defaultBranch = null) {
       const classic = evaluateRequiredCheck(protection);
-      const ruleset = evaluateRuleset(rulesets);
+      const ruleset = evaluateRuleset(rulesets, defaultBranch);
       const merged = (base) => ({
         ...base,
         surfaces_inspected: ["classic_branch_protection", rulesets == null ? "rulesets:unread" : "rulesets"],
@@ -254210,8 +254507,22 @@ var require_github_enforcement = __commonJS({
     var STATUS = Object.freeze({
       VERIFIED: "VERIFIED",
       NOT_VERIFIED: "NOT_VERIFIED",
-      UNVERIFIABLE: "UNVERIFIABLE"
-    });
+      UNVERIFIABLE: "UNVERIFIABLE",
+      UNSUPPORTED_PLAN: "UNSUPPORTED_PLAN",
+      PROVIDER_ERROR: "PROVIDER_ERROR"
+    });
+    var FRESHNESS = Object.freeze({ FRESH: "FRESH", STALE_EVIDENCE: "STALE_EVIDENCE" });
+    function supportsStrongClaim(status) {
+      return status === STATUS.VERIFIED;
+    }
+    var EVIDENCE_TTL_SECONDS = 3600;
+    function evidenceFreshness(report, nowIso) {
+      if (!report || !report.expires_at) return null;
+      const now = Date.parse(nowIso || (/* @__PURE__ */ new Date()).toISOString());
+      const exp = Date.parse(report.expires_at);
+      if (!Number.isFinite(now) || !Number.isFinite(exp)) return null;
+      return now > exp ? FRESHNESS.STALE_EVIDENCE : FRESHNESS.FRESH;
+    }
     function resolveGitHubAuth(env = process.env) {
       const user = String(env && (env.GITHUB_TOKEN || env.GH_TOKEN) || "").trim();
       if (user) {
@@ -254542,6 +254853,10 @@ var require_github_enforcement = __commonJS({
       NO_TOKEN_INSTRUCTION,
       LAYER_IDS,
       STATUS,
+      FRESHNESS,
+      EVIDENCE_TTL_SECONDS,
+      supportsStrongClaim,
+      evidenceFreshness,
       REASON,
       CHECK_NAME,
       GATE_ACTION,
@@ -254555,6 +254870,8 @@ var require_github_enforcement = __commonJS({
       evaluateLayers,
       evaluateRequiredCheck,
       evaluateRuleset,
+      evaluateRequiredWorkflowPin,
+      targetsDefaultBranch,
       evaluateRequiredCheckAcrossSurfaces,
       verifiedRequiresBinding,
       scanLocalWorkflows,
@@ -254941,7 +255258,7 @@ var require_setup_required_check = __commonJS({
         }
       } catch {
       }
-      const rulesetVerdict = evaluateRuleset(rulesetDocs);
+      const rulesetVerdict = evaluateRuleset(rulesetDocs, branch);
       const rulesetNamed = detectRulesetRequiredCheck(rulesetDocs || [], CHECK_NAME);
       const ruleset = {
         enforced: rulesetVerdict.status === STATUS.VERIFIED,
@@ -255314,6 +255631,8 @@ var require_enforce_check = __commonJS({
     var chalk = require_source();
     var {
       EVIDENCE_SPEC,
+      EVIDENCE_TTL_SECONDS,
+      supportsStrongClaim,
       APP_INSTALLATION,
       NO_TOKEN_INSTRUCTION,
       resolveGitHubAuth,
@@ -255325,6 +255644,35 @@ var require_enforce_check = __commonJS({
     var { isValidRepo } = require_status();
     var { resolveOwnerRepo } = require_setup_required_check();
     if (process.env.NO_COLOR) chalk.level = 0;
+    var crypto = require("node:crypto");
+    var EVIDENCE_SCOPE = Object.freeze({
+      grades: "repository configuration \u2014 what the provider would require of any pull request",
+      covers: Object.freeze([
+        "required status check present and named exactly",
+        "the check bound to an issuer that can block (integration_id / app_id)",
+        "ruleset enforcement is active rather than evaluate",
+        "the ruleset targets the branch that matters",
+        "strict latest-head policy recorded",
+        "bypass actors reported as VISIBLE or NOT VISIBLE, never as absent"
+      ]),
+      does_not_cover: Object.freeze([
+        "which GitHub App actually posted a check run on any pull request",
+        "the head_sha a check run executed against",
+        "whether any check run concluded success",
+        "a recomputable external proof hash over a specific run"
+      ]),
+      why_not: "Those are facts about one pull request at one moment, not about configuration. Reading them needs a per-PR check-runs query this command does not make; a passing config is not a passing run."
+    });
+    function responseDigest(read) {
+      if (!read) return null;
+      return {
+        endpoint: read.endpoint ? `GET ${read.endpoint}` : null,
+        http_status: read.status == null ? null : read.status,
+        // Hash of the BODY as we received it. Not the verdict — the INPUT to the verdict, so a
+        // disagreement can be localised to the answer or to our grading of it.
+        body_sha256: read.body === void 0 || read.body === null ? null : `sha256:${crypto.createHash("sha256").update(JSON.stringify(read.body)).digest("hex")}`
+      };
+    }
     var USAGE = [
       "Usage: coderifts enforce --check --repo owner/repo [--env <github-environment>] [--branch <name>] [--json]",
       "",
@@ -255437,7 +255785,12 @@ var require_enforce_check = __commonJS({
         const report2 = {
           command: "enforce --check",
           spec: EVIDENCE_SPEC,
+          // OBSERVED_AT WAS NOT ADDED. `queried_at` already carries exactly that fact, and a
+          // second name for one fact is the defect this round was told to look for.
           queried_at: queriedAt,
+          expires_at: new Date(Date.parse(queriedAt) + EVIDENCE_TTL_SECONDS * 1e3).toISOString(),
+          evidence_ttl_seconds: EVIDENCE_TTL_SECONDS,
+          evidence_scope: EVIDENCE_SCOPE,
           repo: `${ownerRepo.owner}/${ownerRepo.repo}`,
           branch: options.branch || null,
           environment: environmentName,
@@ -255481,14 +255834,33 @@ var require_enforce_check = __commonJS({
       const report = {
         command: "enforce --check",
         spec: EVIDENCE_SPEC,
+        // OBSERVED_AT WAS NOT ADDED. `queried_at` already carries exactly that fact, and a
+        // second name for one fact is the defect this round was told to look for.
         queried_at: queriedAt,
+        expires_at: new Date(Date.parse(queriedAt) + EVIDENCE_TTL_SECONDS * 1e3).toISOString(),
+        evidence_ttl_seconds: EVIDENCE_TTL_SECONDS,
+        evidence_scope: EVIDENCE_SCOPE,
         repo: `${ownerRepo.owner}/${ownerRepo.repo}`,
         branch,
         environment: environmentName,
         provider: "github",
         auth: authPublic,
+        // The raw answers behind the verdict, so a disagreement can be localised to the provider's
+        // response or to our grading of it.
+        responses: {
+          protection: responseDigest(protectionRead),
+          environment: responseDigest(environmentRead)
+        },
         ...evaluated
       };
+      if (report.claim && report.claim.inescapable_deploy === true) {
+        const unsupported = (report.layers || []).filter((l) => !supportsStrongClaim(l.status));
+        if (unsupported.length > 0) {
+          throw new Error(
+            `enforce --check: inescapable_deploy is true with ${unsupported.length} layer(s) not VERIFIED (${unsupported.map((l) => `${l.id}=${l.status}`).join(", ")}) \u2014 refusing to emit`
+          );
+        }
+      }
       if (options.json) log(JSON.stringify(report, null, 2));
       else log(renderHuman(report));
       return { exitCode: 0, report };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coderifts",
-  "version": "5.0.1",
+  "version": "6.0.1",
   "description": "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
   "author": "CodeRifts <hello@coderifts.com>",
   "license": "MIT",
@@ -39,13 +39,13 @@
   },
   "scripts": {
     "build": "node scripts/copy-corpus.js && node scripts/build.js",
-    "prepublishOnly": "node scripts/assert-guard-major.js && bash ../../scripts/freeze-gate.sh && npm run build",
+    "prepublishOnly": "node scripts/assert-guard-major.js && node scripts/assert-changelog-version.js && bash ../../scripts/freeze-gate.sh && npm run build",
     "assert-guard-major": "node scripts/assert-guard-major.js",
     "postinstall": "node scripts/postinstall.js",
     "test": "node --test test/*.test.js"
   },
   "dependencies": {
-    "@coderifts/agent-guard": "^12.0.0",
+    "@coderifts/agent-guard": "^13.0.0",
     "chalk": "^4.1.2",
     "cli-table3": "^0.6.4",
     "commander": "^12.0.0",

package/scripts/assert-changelog-version.js

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * CLI release gate (prepublishOnly): refuse to publish a version the CHANGELOG does not name.
+ *
+ * WHY THIS EXISTS — measured, not hypothetical. On 2026-08-27 packages/cli/CHANGELOG.md listed
+ * 4.10.0 and then "Unreleased", while npm carried 4.11.0, 4.12.0, 5.0.0 and 5.0.1. Four published
+ * versions were undocumented and a fifth (5.0.0) was published while still labelled Unreleased.
+ * Two distinct failure modes produced that, and BOTH are caught by the one check below:
+ *
+ *   1. The bump commit never touched the changelog at all. Measured: of the last eight CLI version
+ *      bumps, four omitted it (4.11.0, 4.12.0, 4.13.0, 5.0.1) — and those four are exactly the
+ *      versions that went missing. The correlation is not partial.
+ *   2. The bump commit DID write the entry, but under "## Unreleased", and nobody retitled it at
+ *      publish. Atomicity alone does not save you: @coderifts/agent-guard 12.0.0 was written
+ *      atomically and still shipped as "Unreleased", and 11.0.1 before it had to retitle a stale
+ *      heading by hand.
+ *
+ * So the invariant is NOT "the bump touched the changelog" — it is that the version being published
+ * appears as its own heading. A human step that must be remembered at publish time is the step that
+ * gets skipped; this makes it fail the publish instead.
+ *
+ * Dependency-free on purpose: a publish gate that needs an install to run is a gate that stops
+ * running (same reasoning as assert-guard-major.js).
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const PKG_PATH = path.join(__dirname, '..', 'package.json');
+const CHANGELOG_PATH = path.join(__dirname, '..', 'CHANGELOG.md');
+
+function fail(msg) {
+  console.error(`assert-changelog-version: FAIL — ${msg}`);
+  process.exit(1);
+}
+
+/**
+ * Headings this file recognises as "this version is documented".
+ * A heading may carry a trailing note (e.g. "## 4.13.0 — never published"), so match the version
+ * token at a word boundary rather than requiring the line to be exactly the version.
+ */
+function headingNamesVersion(line, version) {
+  if (!/^##\s+/.test(line)) return false;
+  const rest = line.replace(/^##\s+/, '').trim();
+  const esc = version.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(`^v?${esc}(\\b|$)`).test(rest);
+}
+
+function main() {
+  if (!fs.existsSync(PKG_PATH)) fail(`package.json not found at ${PKG_PATH}`);
+  if (!fs.existsSync(CHANGELOG_PATH)) fail(`CHANGELOG.md not found at ${CHANGELOG_PATH}`);
+
+  let version;
+  try {
+    version = JSON.parse(fs.readFileSync(PKG_PATH, 'utf8')).version;
+  } catch (err) {
+    fail(`package.json is not readable JSON: ${err.message}`);
+  }
+  if (typeof version !== 'string' || !version.trim()) fail('package.json has no version string');
+
+  const lines = fs.readFileSync(CHANGELOG_PATH, 'utf8').split('\n');
+  const headings = lines.filter((l) => /^##\s+/.test(l));
+  if (headings.length === 0) fail('CHANGELOG.md has no "## " headings at all');
+
+  const match = headings.find((l) => headingNamesVersion(l, version));
+  if (!match) {
+    const listed = headings.slice(0, 4).map((h) => h.replace(/^##\s+/, '').trim());
+    fail(
+      `package.json is ${version} but CHANGELOG.md has no "## ${version}" heading.\n`
+      + `  Top headings are: ${listed.join(' · ')}\n`
+      + '  Publishing now is how a version goes undocumented. Retitle the Unreleased section to\n'
+      + `  ${version}, or add its section, then publish.`,
+    );
+  }
+
+  // "Unreleased" must never be the section that documents the version being published.
+  if (/^##\s+unreleased\b/i.test(match)) {
+    fail(`the section naming ${version} is the Unreleased heading — retitle it before publishing`);
+  }
+
+  console.log(`assert-changelog-version: OK — ${version} is documented ("${match.trim()}")`);
+}
+
+main();
+
+module.exports = { headingNamesVersion, PKG_PATH, CHANGELOG_PATH };

package/scripts/assert-guard-major.js

@@ -45,13 +45,33 @@
  *   raise, and no product code. The floor rises anyway, because a semantics floor is about
  *   what the CLI may RUN against: a guard that silently skips the atomicity demand on an ordinary
  *   edit is exactly the class of difference this gate exists to refuse.)
+ * 6.0.0: floor raised to 13 (the CAS now conditions on the AUTHORIZATION-TIME token. Through 12.0.0
+ *   wrapWriteWithFsCas measured its expected token INSIDE executeFactory — after preflight and after
+ *   the T2 recheck — and conditioned the write on that self-fetched value, which asks whether the
+ *   state changed since a read a microsecond earlier. Measured on 12.0.0: a writer landing in that
+ *   window had its state adopted as the legitimate starting point and the CAS still returned
+ *   committed with enforced:true, clobbering it. 13.0.0 threads the T1 token, and adds three FS
+ *   defences that were measured ABSENT rather than assumed: `..` refused before resolution, a
+ *   symlinked final component refused (stat/readFile measured the TARGET while rename replaced the
+ *   LINK — check and write named different objects), the token read through one file descriptor,
+ *   and dev+ino recorded in the evidence. COST MEASURED AS ZERO, and measured more carefully than
+ *   the last two raises: the CLI imports only deployGate, asVerifiedDeployReceiptView,
+ *   DEPLOY_RECEIPT_VIEW_SPEC and matchGlob, whose implementing modules (deploy-gate.js,
+ *   resolver-glob.js, deploy-receipt-token.js, merge-gate.js) are BYTE-IDENTICAL 12.0.0 -> 13.0.0.
+ *   Note the honest qualifier the earlier raises did not state: requiring the barrel index.js LOADS
+ *   every changed module, so the changed code is in the process — it is simply not on the code path
+ *   of any symbol the CLI calls, and the four symbols return identical values under both versions.
+ *   Suite staged against 13.0.0 returned an identical 539/518/21 with a byte-identical 28-item
+ *   failure set. The floor rises anyway, because a semantics floor is about what the CLI may RUN
+ *   against: a CAS that reports committed after adopting another writer's state is exactly the
+ *   class this gate exists to refuse.)
  */
 
 const fs = require('fs');
 const path = require('path');
 
 /** Minimum acceptable major for @coderifts/agent-guard in THIS package (the CLI). */
-const MIN_GUARD_MAJOR = 12;
+const MIN_GUARD_MAJOR = 13;
 const DEP = '@coderifts/agent-guard';
 
 /**