coderifts 6.0.0 → 6.0.2

package/CHANGELOG.md

@@ -1,8 +1,33 @@
 # Changelog
 
-## 6.0.0
+## 6.0.2
 
-_Nothing yet._
+### Fixed
+
+- **init --agents wrote 8 of 9 embedded files.** The skill file joined the single source on 2026-08-25 but was never added to EXTRA_RULES_ON_ALL, a second hand-maintained list. Every release since shipped an installer that under-writes, and agent-setup --check was correctly reporting DRIFT the whole time.
+- **The strict workflow pins actions/checkout too.** It runs first and fetches the code every later step reads; the least pinned step in the strict chain was the most load-bearing.
+
+## 6.0.1
+
+### Changed
+- **Guard floor raised to 13, declared range `^13.0.0`.** ADOPTER-FACING: the guard is a direct
+  dependency with no `peerDependencies` and no bundled copy, so this range *is* what a fresh install
+  resolves. `coderifts@5.0.1` declared `^12.0.0`, which resolves to 12.0.0 — the version in which
+  `wrapWriteWithFsCas` measured its expected CAS token INSIDE `executeFactory`, after preflight and
+  after the T2 recheck, and conditioned the write on that self-fetched value. Measured on 12.0.0: a
+  writer landing in that window had its state adopted as the legitimate starting point and the CAS
+  still returned `committed` with `enforced: true`, clobbering it. 13.0.0 threads the
+  authorization-time token, and adds three filesystem defences that were measured absent rather than
+  assumed — `..` refused before resolution, a symlinked final component refused (`stat`/`readFile`
+  measured the link's TARGET while `rename` replaced the LINK, so check and write named different
+  objects), the token read through a single file descriptor, and `dev`+`ino` recorded in the write
+  evidence.
+
+  **Cost measured as zero**, the same way the 11-, 12- and 13-raises were: the CLI imports only
+  `deployGate`, `asVerifiedDeployReceiptView`, `DEPLOY_RECEIPT_VIEW_SPEC` and `matchGlob`, whose
+  implementing modules are byte-identical 12.0.0 → 13.0.0, and all four return identical values
+  under both. Suite staged against 13.0.0 returned an identical 539/518/21 with a byte-identical
+  28-item failure set. Nothing in the CLI calls the CAS or FS adapters.
 
 ## 5.0.1
 

package/dist/cli.js

@@ -3028,7 +3028,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "6.0.0",
+      version: "6.0.2",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -3073,7 +3073,7 @@ var require_package = __commonJS({
         test: "node --test test/*.test.js"
       },
       dependencies: {
-        "@coderifts/agent-guard": "^12.0.0",
+        "@coderifts/agent-guard": "^13.0.0",
         chalk: "^4.1.2",
         "cli-table3": "^0.6.4",
         commander: "^12.0.0",
@@ -67189,6 +67189,9 @@ var require_conditional_write = __commonJS({
         write_style,
         mutating
       };
+      if (ctx.guarantee === "SAME_TRANSACTION" || ctx.guarantee === "CONDITIONAL_EXTERNAL" || ctx.guarantee === "NON_ATOMIC") {
+        basis.guarantee = ctx.guarantee;
+      }
       if (conditional_write === true) {
         if (typeof ctx.conditioned_on_token === "string") {
           basis.conditioned_on_token = ctx.conditioned_on_token;
@@ -67324,8 +67327,11 @@ var require_fs = __commonJS({
       };
     })();
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.tokensEqual = exports2.FS_ABSENT_TOKEN = exports2.FS_VERSION_TOKEN_PREFIX = void 0;
+    exports2.tokensEqual = exports2.UnsafeCasPathError = exports2.FS_ABSENT_TOKEN = exports2.FS_VERSION_TOKEN_PREFIX = void 0;
     exports2.fsTokenContentHash = fsTokenContentHash;
+    exports2.assertSafeCasPath = assertSafeCasPath;
+    exports2.fsObjectIdentity = fsObjectIdentity;
+    exports2.identitiesEqual = identitiesEqual;
     exports2.createFsVersionToken = createFsVersionToken;
     exports2.readVersionedFile = readVersionedFile;
     exports2.writeFileIfUnchanged = writeFileIfUnchanged;
@@ -67354,23 +67360,90 @@ var require_fs = __commonJS({
       const hash = rest.slice(colon + 1);
       return /^[a-f0-9]{64}$/.test(hash) ? hash : null;
     }
+    var UnsafeCasPathError = class extends Error {
+      reason;
+      casPath;
+      constructor(reason, casPath) {
+        super(`unsafe CAS path (${reason}): ${casPath}`);
+        this.name = "UnsafeCasPathError";
+        this.reason = reason;
+        this.casPath = casPath;
+      }
+    };
+    exports2.UnsafeCasPathError = UnsafeCasPathError;
+    async function assertSafeCasPath(filePath) {
+      const segments = filePath.split(/[\\/]+/);
+      if (segments.includes(".."))
+        throw new UnsafeCasPathError("path_traversal", filePath);
+      const resolved = path.resolve(filePath);
+      const dir = path.dirname(resolved);
+      let canonicalDir = dir;
+      try {
+        canonicalDir = await node_fs_1.promises.realpath(dir);
+      } catch (err) {
+        const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
+        if (code !== "ENOENT")
+          throw err;
+      }
+      const target = path.join(canonicalDir, path.basename(resolved));
+      try {
+        const lst = await node_fs_1.promises.lstat(target);
+        if (lst.isSymbolicLink())
+          throw new UnsafeCasPathError("symlink_target", filePath);
+      } catch (err) {
+        if (err instanceof UnsafeCasPathError)
+          throw err;
+        const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
+        if (code !== "ENOENT")
+          throw err;
+      }
+      return target;
+    }
+    async function fsObjectIdentity(filePath) {
+      let fh;
+      try {
+        fh = await node_fs_1.promises.open(filePath, "r");
+        const st = await fh.stat();
+        return { dev: st.dev, ino: st.ino };
+      } catch (err) {
+        const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
+        if (code === "ENOENT")
+          return null;
+        throw err;
+      } finally {
+        if (fh)
+          await fh.close().catch(() => {
+          });
+      }
+    }
+    function identitiesEqual(a, b) {
+      if (!a || !b)
+        return false;
+      return a.dev === b.dev && a.ino === b.ino;
+    }
     async function createFsVersionToken(filePath) {
-      let st;
+      let fh;
       try {
-        st = await node_fs_1.promises.stat(filePath);
+        fh = await node_fs_1.promises.open(filePath, "r");
       } catch (err) {
         const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
         if (code === "ENOENT")
           return exports2.FS_ABSENT_TOKEN;
         throw err;
       }
-      if (!st.isFile()) {
-        throw new Error(`createFsVersionToken: not a regular file: ${filePath}`);
+      try {
+        const st = await fh.stat();
+        if (!st.isFile()) {
+          throw new Error(`createFsVersionToken: not a regular file: ${filePath}`);
+        }
+        const buf = await fh.readFile();
+        const hash = sha256hex(buf);
+        const mtimeMs = Math.trunc(st.mtimeMs);
+        return `${exports2.FS_VERSION_TOKEN_PREFIX}${mtimeMs}:${hash}`;
+      } finally {
+        await fh.close().catch(() => {
+        });
       }
-      const buf = await node_fs_1.promises.readFile(filePath);
-      const hash = sha256hex(buf);
-      const mtimeMs = Math.trunc(st.mtimeMs);
-      return `${exports2.FS_VERSION_TOKEN_PREFIX}${mtimeMs}:${hash}`;
     }
     async function readVersionedFile(filePath) {
       const version_token = await createFsVersionToken(filePath);
@@ -67381,9 +67454,23 @@ var require_fs = __commonJS({
       return { content, version_token };
     }
     async function writeFileIfUnchanged(args) {
-      const target = path.resolve(args.path);
+      const target = await assertSafeCasPath(args.path);
       const body = typeof args.content === "string" ? Buffer.from(args.content, "utf8") : args.content;
       const writtenHash = sha256hex(body);
+      const checkedIdentity = await fsObjectIdentity(target);
+      const hasT1Identity = Object.prototype.hasOwnProperty.call(args, "expected_identity");
+      if (hasT1Identity) {
+        const t1 = args.expected_identity ?? null;
+        const held = t1 === null ? checkedIdentity === null : identitiesEqual(t1, checkedIdentity);
+        if (!held) {
+          return {
+            status: "refused",
+            reason: "stale_version_token",
+            expected_token: args.expected_token,
+            current_token: await createFsVersionToken(target).catch(() => null)
+          };
+        }
+      }
       return (0, conditional_write_js_1.executeIfUnchanged)({
         expected_token: args.expected_token,
         current_token: () => createFsVersionToken(target),
@@ -67402,6 +67489,15 @@ var require_fs = __commonJS({
           const tmp = path.join(dir, `.coderifts-cas-${path.basename(target)}-${process.pid}-${(0, node_crypto_1.randomBytes)(6).toString("hex")}.tmp`);
           try {
             await node_fs_1.promises.writeFile(tmp, body);
+            const stillIdentity = await fsObjectIdentity(target);
+            const identityHeld = checkedIdentity === null ? stillIdentity === null : identitiesEqual(checkedIdentity, stillIdentity);
+            if (!identityHeld) {
+              try {
+                await node_fs_1.promises.unlink(tmp);
+              } catch {
+              }
+              throw new conditional_write_js_1.StaleVersionTokenAbort(await createFsVersionToken(target).catch(() => null));
+            }
             const still = await createFsVersionToken(target);
             if (!(0, conditional_write_js_1.tokensEqual)(args.expected_token, still)) {
               try {
@@ -67420,7 +67516,13 @@ var require_fs = __commonJS({
             }
             throw err;
           }
-          return { path: target, bytes: body.length, written_content_hash: writtenHash };
+          return {
+            path: target,
+            bytes: body.length,
+            written_content_hash: writtenHash,
+            checked_identity: checkedIdentity,
+            committed_identity: await fsObjectIdentity(target)
+          };
         }
       });
     }
@@ -69409,6 +69511,10 @@ var require_cas_attestation = __commonJS({
         const s = x;
         return s.reason === "stale_during_commit" && typeof s.expected_token === "string";
       }
+      if (o.status === "indeterminate") {
+        const i = x;
+        return (i.reason === "response_lost" || i.reason === "ambiguous_provider_reply" || i.reason === "observation_failed") && typeof i.expected_token === "string";
+      }
       return false;
     }
     function freezeExecutionResultHash(h) {
@@ -69431,6 +69537,15 @@ var require_cas_attestation = __commonJS({
           current_token: outcome.current_token == null ? null : outcome.current_token
         });
       }
+      if (outcome.status === "indeterminate") {
+        return Object.freeze({
+          status: "indeterminate",
+          write_ran: "unknown",
+          reason: outcome.reason,
+          expected_token: outcome.expected_token,
+          observed_token: outcome.observed_token == null ? null : outcome.observed_token
+        });
+      }
       return Object.freeze({
         status: "committed_stale_detected",
         write_ran: true,
@@ -69451,6 +69566,7 @@ var require_cas_attestation = __commonJS({
       const write_ran = cas.write_ran === true;
       const stale_during_commit = cas.status === "committed_stale_detected";
       const refused = cas.status === "refused";
+      const indeterminate = cas.status === "indeterminate";
       const cas_evidence = evaluateCasEvidence(outcome, opts);
       let authorized_and_committed = receipt_verified && cas.status === "committed";
       if (opts.profile === "ENFORCING_STRICT") {
@@ -69471,7 +69587,8 @@ var require_cas_attestation = __commonJS({
           authorized_and_committed,
           write_ran,
           stale_during_commit,
-          refused
+          refused,
+          indeterminate
         }),
         cas_evidence,
         limits: LIMITS
@@ -72729,6 +72846,8 @@ var require_fs_default_wire = __commonJS({
     exports2.inferFsPathFromArgs = inferFsPathFromArgs;
     exports2.inferFullFileWriteContent = inferFullFileWriteContent;
     exports2.wrapWriteWithFsCas = wrapWriteWithFsCas;
+    exports2.measureFsAuthorization = measureFsAuthorization;
+    exports2.measureFsAuthorizationToken = measureFsAuthorizationToken;
     var cas_attestation_js_1 = require_cas_attestation();
     var fs_js_1 = require_fs();
     function inferFsPathFromArgs(args) {
@@ -72755,20 +72874,16 @@ var require_fs_default_wire = __commonJS({
       }
       return null;
     }
-    async function wrapWriteWithFsCas(args, write) {
+    async function wrapWriteWithFsCas(args, write, opts) {
       const filePath = inferFsPathFromArgs(args);
       const content = inferFullFileWriteContent(args);
-      if (filePath && content != null) {
-        let expected;
-        try {
-          expected = await (0, fs_js_1.createFsVersionToken)(filePath);
-        } catch {
-          return write();
-        }
+      const expected = opts && typeof opts.expected_token === "string" ? opts.expected_token : null;
+      if (filePath && content != null && expected !== null) {
         return (0, fs_js_1.writeFileIfUnchanged)({
           path: filePath,
           expected_token: expected,
-          content
+          content,
+          ...opts && "expected_identity" in opts ? { expected_identity: opts.expected_identity ?? null } : {}
         });
       }
       const raw = await write();
@@ -72776,6 +72891,24 @@ var require_fs_default_wire = __commonJS({
         return raw;
       return raw;
     }
+    async function measureFsAuthorization(args) {
+      const filePath = inferFsPathFromArgs(args);
+      const content = inferFullFileWriteContent(args);
+      if (!filePath || content == null)
+        return null;
+      try {
+        const target = await (0, fs_js_1.assertSafeCasPath)(filePath);
+        const expected_identity = await (0, fs_js_1.fsObjectIdentity)(target);
+        const expected_token = await (0, fs_js_1.createFsVersionToken)(target);
+        return { expected_token, expected_identity };
+      } catch {
+        return null;
+      }
+    }
+    async function measureFsAuthorizationToken(args) {
+      const m = await measureFsAuthorization(args);
+      return m ? m.expected_token : null;
+    }
   }
 });
 
@@ -72960,6 +73093,11 @@ var require_tool_registry = __commonJS({
             lastDerivation = d.derivation;
             return d.call;
           };
+          const rebindAndRemeasure = async () => {
+            const c = await rebind();
+            casAuth = await (0, fs_default_wire_js_1.measureFsAuthorization)(args);
+            return c;
+          };
           const call = await rebind();
           const refreshContext = async (c) => (0, freshness_js_1.collectFreshnessCallContext)({
             call: {
@@ -72970,16 +73108,17 @@ var require_tool_registry = __commonJS({
             resolvePriorContent: guardCfg.resolvePriorContent
           });
           const fctx = await refreshContext(call);
+          let casAuth = await (0, fs_default_wire_js_1.measureFsAuthorization)(args);
           const factory = async (_envelope, redacted, execution) => {
             const rawArgs = redacted ? redacted.arguments : args;
-            return (0, fs_default_wire_js_1.wrapWriteWithFsCas)(rawArgs, () => execution ? rawExecute(rawArgs, execution) : rawExecute(rawArgs));
+            return (0, fs_default_wire_js_1.wrapWriteWithFsCas)(rawArgs, () => execution ? rawExecute(rawArgs, execution) : rawExecute(rawArgs), casAuth ? { expected_token: casAuth.expected_token, expected_identity: casAuth.expected_identity } : {});
           };
           const outcome = (0, auto_recheck_js_1.normalizeAutoRecheck)(guardCfg.autoRecheck) ? await (0, auto_recheck_js_1.runAutoRecheckLoop)({
             call,
             factory,
             config: guardCfg,
             callContext: fctx,
-            rebind,
+            rebind: rebindAndRemeasure,
             refreshContext
           }) : await (0, guard_js_1.guardToolCall)(call, factory, guardCfg, fctx);
           return (0, auto_derive_js_1.attachDerivation)(outcome, lastDerivation);
@@ -75298,9 +75437,10 @@ var require_cjs4 = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.monitorAttestSigningInput = exports2.kidFromMonitoringAttestation = exports2.tryIssueMonitoringAttestation = exports2.DEFAULT_MONITORING_SINK_TIMEOUT_MS = exports2.ackBytes = exports2.verifyAckHmac = exports2.monitoringDeliveryFailClosed = exports2.formatMonitoringDeliveryLine = exports2.deliverMonitoring = exports2.hashObservedContent = exports2.observeCommit = exports2.deriveKeySignal = exports2.pathClass = exports2.classifyCommand = exports2.projectState = exports2.emptySessionState = exports2.computeTainted = exports2.evaluate = exports2.updateSession = exports2.SESSION_TAINT_VERSION = exports2.SessionTaintTracker = exports2.readDecision = exports2.EXECUTION_TIME_FP_REASONS = exports2.EXECUTION_STATE_UNMEASURABLE_NOTE = exports2.isUnmeasurableExecutionStateReason = exports2.computeCanonicalBundleFingerprint = exports2.authorizedFingerprintFromEnvelope = exports2.checkExecutionTimeFingerprint = exports2.computeBundleFingerprint = exports2.computeArtifactDigest = exports2.evaluateEnvelope = exports2.RECEIPT_PREV_NULL = exports2.decodeReceiptBodyPrev = exports2.previousReceiptCommitment = exports2.verifyReceiptChainLinkage = exports2.canonicalJson = exports2.computeBodyHash = exports2.bindReceiptToEnvelope = exports2.DETECTOR_VERSION = exports2.builtinDetector = exports2.resetPolicyWarnForTests = exports2.warnPolicyAbsentOnce = exports2.observePolicyPresence = exports2.detectPolicyPresence = exports2.policyPresenceOf = exports2.withPolicy = exports2.POLICY_ABSENT_WARN = exports2.POLICY_MARKER = exports2.CODERIFTS_POLICY = exports2.guardToolCall = void 0;
-    exports2.DB_ABSENT_TOKEN = exports2.DB_VERSION_TOKEN_PREFIX = exports2.dbTokenRaw = exports2.writeDbIfUnchanged = exports2.createDbVersionToken = exports2.API_ABSENT_TOKEN = exports2.API_VERSION_TOKEN_PREFIX = exports2.apiTokenRaw = exports2.writeApiIfUnchanged = exports2.createApiVersionToken = exports2.FS_ABSENT_TOKEN = exports2.FS_VERSION_TOKEN_PREFIX = exports2.fsTokenContentHash = exports2.createFsPriorContentResolver = exports2.writeFileIfUnchanged = exports2.readVersionedFile = exports2.createFsVersionToken = exports2.StaleVersionTokenAbort = exports2.executeIfUnchanged = exports2.RESIDUAL_UNCONDITIONAL_WRITE = exports2.conditionalWriteResidual = exports2.tokensEqual = exports2.buildConditionalWriteBasis = exports2.buildFreshnessBasis = exports2.collectFreshnessCallContext = exports2.artifactIdsForResolve = exports2.isMutatingCall = exports2.isWriteStyleCall = exports2.freshnessAllowsEnforce = exports2.computePathSetTreeHash = exports2.contentByteIdentical = exports2.assessWriteStylePrior = exports2.assessFreshness = exports2.deriveProofBanner = exports2.attachProofToAgentResponse = exports2.renderFinalAnswerProof = exports2.EXECUTION_PROOF_SPEC = exports2.assertEnforcedReceiptInvariant = exports2.hashExecutionResult = exports2.buildExecutionProof = exports2.COVERAGE_ATTEST_ENVELOPE_TAG = exports2.COVERAGE_ATTEST_SIGNING_PREFIX = exports2.COVERAGE_ATTEST_VERSION = exports2.coverageAttestSigningInput = exports2.kidFromCoverageAttestation = exports2.tryIssueCoverageAttestation = exports2.MONITOR_ATTEST_ENVELOPE_TAG = exports2.MONITOR_ATTEST_SIGNING_PREFIX = exports2.MONITOR_ATTEST_VERSION = exports2.receiptDigestOfToken = void 0;
-    exports2.freezeCoverageObserved = exports2.createCoverageObserver = exports2.readExecutionGrantToken = exports2.isExecutionGrantEnabled = exports2.guardedFractionAmongRoutes = exports2.foldTableSettledCalls = exports2.withCodeRifts = exports2.AUTO_DERIVE_READ_TIMEOUT_MS = exports2.AUTO_DERIVE_SOURCE = exports2.defaultFsReader = exports2.normalizeAutoDerive = exports2.runAutoDerive = exports2.AUTO_RECHECK_MAX_CAP = exports2.clampMaxAttempts = exports2.normalizeAutoRecheck = exports2.runAutoRecheckLoop = exports2.coverageReport = exports2.DEPLOY_REPAIRABLE_REASONS = exports2.bindDeploy = exports2.verifyDeployReceiptToken = exports2.DEPLOY_RECEIPT_VIEW_SPEC = exports2.isVerifiedDeployReceiptView = exports2.asVerifiedDeployReceiptView = exports2.deployGate = exports2.gateDecision = exports2.RegistryConstructionError = exports2.guardToolRegistry = exports2.globToRegExp = exports2.matchGlob = exports2.blobMapKey = exports2.classifyByName = exports2.resolveArtifacts = exports2.REMEDIATION_LOOP_ATTESTATION_SPEC = exports2.isCasAttestation = exports2.readPriorBlockRemediation = exports2.readRemediationTransaction = exports2.buildRemediationLoopAttestation = exports2.COMMIT_EVIDENCE_MISSING = exports2.CAS_ATTESTATION_SPEC = exports2.strictCommitObservation = exports2.extractExecutorAttestationToken = exports2.evaluateCasEvidence = exports2.isExecuteIfUnchangedOutcome = exports2.isGuardExecutionProof = exports2.buildCasAttestation = exports2.REGISTRY_ABSENT_TOKEN = exports2.REGISTRY_VERSION_TOKEN_PREFIX = exports2.registryTokenRaw = exports2.writeRegistryIfUnchanged = exports2.createRegistryVersionToken = void 0;
-    exports2.kidFromToolsetAttestation = exports2.tryIssueToolsetAttestation = exports2.toolsetAttestSigningInput = exports2.declarationEntriesFromTools = exports2.computeToolsetDigest = exports2.TOOLSET_ATTEST_STATEMENT = exports2.TOOLSET_ATTEST_ENVELOPE_TAG = exports2.TOOLSET_ATTEST_SIGNING_PREFIX = exports2.TOOLSET_ATTEST_VERSION = exports2.surfaceEnvelopeFields = exports2.isGuardOutcome = exports2.executeLangGraphToolCall = exports2.executeGeminiToolCall = exports2.executeAnthropicToolCall = exports2.executeOpenAIToolCall = exports2.executeProtectedTool = exports2.defaultSerializeGeminiToolResult = exports2.bindGeminiGuardOutcome = exports2.protectedToolToFunctionDeclaration = exports2.toGeminiTools = exports2.geminiToolAdapter = exports2.withCodeRiftsGemini = exports2.wrapWriteWithFsCas = exports2.inferFullFileWriteContent = exports2.inferFsPathFromArgs = exports2.FRESHNESS_RESOLVER_FIX = exports2.freshnessRefusalTeaching = exports2.formatGateRefusalBody = exports2.defaultSerializeLangGraphToolResult = exports2.bindLangGraphGuardOutcome = exports2.LangGraphToolsNotStructuredError = exports2.isLangGraphReactAgentTool = exports2.bindLangGraphTools = exports2.protectedToolToLangGraph = exports2.toLangGraphTools = exports2.langGraphToolAdapter = exports2.withCodeRiftsLangGraph = exports2.defaultSerializeAnthropicToolResult = exports2.bindAnthropicGuardOutcome = exports2.protectedToolToAnthropic = exports2.toAnthropicTools = exports2.anthropicToolAdapter = exports2.withCodeRiftsAnthropic = exports2.defaultSerializeOpenAIToolResult = exports2.bindOpenAIGuardOutcome = exports2.protectedToolToOpenAI = exports2.toOpenAITools = exports2.openAIToolAdapter = exports2.withCodeRiftsOpenAI = exports2.formatCoverageObservedLine = void 0;
+    exports2.createDbVersionToken = exports2.API_ABSENT_TOKEN = exports2.API_VERSION_TOKEN_PREFIX = exports2.apiTokenRaw = exports2.writeApiIfUnchanged = exports2.createApiVersionToken = exports2.identitiesEqual = exports2.fsObjectIdentity = exports2.UnsafeCasPathError = exports2.assertSafeCasPath = exports2.FS_ABSENT_TOKEN = exports2.FS_VERSION_TOKEN_PREFIX = exports2.fsTokenContentHash = exports2.createFsPriorContentResolver = exports2.writeFileIfUnchanged = exports2.readVersionedFile = exports2.createFsVersionToken = exports2.StaleVersionTokenAbort = exports2.executeIfUnchanged = exports2.RESIDUAL_UNCONDITIONAL_WRITE = exports2.conditionalWriteResidual = exports2.tokensEqual = exports2.buildConditionalWriteBasis = exports2.buildFreshnessBasis = exports2.collectFreshnessCallContext = exports2.artifactIdsForResolve = exports2.isMutatingCall = exports2.isWriteStyleCall = exports2.freshnessAllowsEnforce = exports2.computePathSetTreeHash = exports2.contentByteIdentical = exports2.assessWriteStylePrior = exports2.assessFreshness = exports2.deriveProofBanner = exports2.attachProofToAgentResponse = exports2.renderFinalAnswerProof = exports2.EXECUTION_PROOF_SPEC = exports2.assertEnforcedReceiptInvariant = exports2.hashExecutionResult = exports2.buildExecutionProof = exports2.COVERAGE_ATTEST_ENVELOPE_TAG = exports2.COVERAGE_ATTEST_SIGNING_PREFIX = exports2.COVERAGE_ATTEST_VERSION = exports2.coverageAttestSigningInput = exports2.kidFromCoverageAttestation = exports2.tryIssueCoverageAttestation = exports2.MONITOR_ATTEST_ENVELOPE_TAG = exports2.MONITOR_ATTEST_SIGNING_PREFIX = exports2.MONITOR_ATTEST_VERSION = exports2.receiptDigestOfToken = void 0;
+    exports2.guardedFractionAmongRoutes = exports2.foldTableSettledCalls = exports2.withCodeRifts = exports2.AUTO_DERIVE_READ_TIMEOUT_MS = exports2.AUTO_DERIVE_SOURCE = exports2.defaultFsReader = exports2.normalizeAutoDerive = exports2.runAutoDerive = exports2.AUTO_RECHECK_MAX_CAP = exports2.clampMaxAttempts = exports2.normalizeAutoRecheck = exports2.runAutoRecheckLoop = exports2.coverageReport = exports2.DEPLOY_REPAIRABLE_REASONS = exports2.bindDeploy = exports2.verifyDeployReceiptToken = exports2.DEPLOY_RECEIPT_VIEW_SPEC = exports2.isVerifiedDeployReceiptView = exports2.asVerifiedDeployReceiptView = exports2.deployGate = exports2.gateDecision = exports2.RegistryConstructionError = exports2.guardToolRegistry = exports2.globToRegExp = exports2.matchGlob = exports2.blobMapKey = exports2.classifyByName = exports2.resolveArtifacts = exports2.REMEDIATION_LOOP_ATTESTATION_SPEC = exports2.isCasAttestation = exports2.readPriorBlockRemediation = exports2.readRemediationTransaction = exports2.buildRemediationLoopAttestation = exports2.COMMIT_EVIDENCE_MISSING = exports2.CAS_ATTESTATION_SPEC = exports2.strictCommitObservation = exports2.extractExecutorAttestationToken = exports2.evaluateCasEvidence = exports2.isExecuteIfUnchangedOutcome = exports2.isGuardExecutionProof = exports2.buildCasAttestation = exports2.REGISTRY_ABSENT_TOKEN = exports2.REGISTRY_VERSION_TOKEN_PREFIX = exports2.registryTokenRaw = exports2.writeRegistryIfUnchanged = exports2.createRegistryVersionToken = exports2.DB_ABSENT_TOKEN = exports2.DB_VERSION_TOKEN_PREFIX = exports2.dbTokenRaw = exports2.writeDbIfUnchanged = void 0;
+    exports2.TOOLSET_ATTEST_ENVELOPE_TAG = exports2.TOOLSET_ATTEST_SIGNING_PREFIX = exports2.TOOLSET_ATTEST_VERSION = exports2.surfaceEnvelopeFields = exports2.isGuardOutcome = exports2.executeLangGraphToolCall = exports2.executeGeminiToolCall = exports2.executeAnthropicToolCall = exports2.executeOpenAIToolCall = exports2.executeProtectedTool = exports2.defaultSerializeGeminiToolResult = exports2.bindGeminiGuardOutcome = exports2.protectedToolToFunctionDeclaration = exports2.toGeminiTools = exports2.geminiToolAdapter = exports2.withCodeRiftsGemini = exports2.measureFsAuthorizationToken = exports2.measureFsAuthorization = exports2.wrapWriteWithFsCas = exports2.inferFullFileWriteContent = exports2.inferFsPathFromArgs = exports2.FRESHNESS_RESOLVER_FIX = exports2.freshnessRefusalTeaching = exports2.formatGateRefusalBody = exports2.defaultSerializeLangGraphToolResult = exports2.bindLangGraphGuardOutcome = exports2.LangGraphToolsNotStructuredError = exports2.isLangGraphReactAgentTool = exports2.bindLangGraphTools = exports2.protectedToolToLangGraph = exports2.toLangGraphTools = exports2.langGraphToolAdapter = exports2.withCodeRiftsLangGraph = exports2.defaultSerializeAnthropicToolResult = exports2.bindAnthropicGuardOutcome = exports2.protectedToolToAnthropic = exports2.toAnthropicTools = exports2.anthropicToolAdapter = exports2.withCodeRiftsAnthropic = exports2.defaultSerializeOpenAIToolResult = exports2.bindOpenAIGuardOutcome = exports2.protectedToolToOpenAI = exports2.toOpenAITools = exports2.openAIToolAdapter = exports2.withCodeRiftsOpenAI = exports2.formatCoverageObservedLine = exports2.freezeCoverageObserved = exports2.createCoverageObserver = exports2.readExecutionGrantToken = exports2.isExecutionGrantEnabled = void 0;
+    exports2.kidFromToolsetAttestation = exports2.tryIssueToolsetAttestation = exports2.toolsetAttestSigningInput = exports2.declarationEntriesFromTools = exports2.computeToolsetDigest = exports2.TOOLSET_ATTEST_STATEMENT = void 0;
     var guard_js_1 = require_guard();
     Object.defineProperty(exports2, "guardToolCall", { enumerable: true, get: function() {
       return guard_js_1.guardToolCall;
@@ -75589,6 +75729,18 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "FS_ABSENT_TOKEN", { enumerable: true, get: function() {
       return fs_js_1.FS_ABSENT_TOKEN;
     } });
+    Object.defineProperty(exports2, "assertSafeCasPath", { enumerable: true, get: function() {
+      return fs_js_1.assertSafeCasPath;
+    } });
+    Object.defineProperty(exports2, "UnsafeCasPathError", { enumerable: true, get: function() {
+      return fs_js_1.UnsafeCasPathError;
+    } });
+    Object.defineProperty(exports2, "fsObjectIdentity", { enumerable: true, get: function() {
+      return fs_js_1.fsObjectIdentity;
+    } });
+    Object.defineProperty(exports2, "identitiesEqual", { enumerable: true, get: function() {
+      return fs_js_1.identitiesEqual;
+    } });
     var api_js_1 = require_api3();
     Object.defineProperty(exports2, "createApiVersionToken", { enumerable: true, get: function() {
       return api_js_1.createApiVersionToken;
@@ -75876,6 +76028,12 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "wrapWriteWithFsCas", { enumerable: true, get: function() {
       return fs_default_wire_js_1.wrapWriteWithFsCas;
     } });
+    Object.defineProperty(exports2, "measureFsAuthorization", { enumerable: true, get: function() {
+      return fs_default_wire_js_1.measureFsAuthorization;
+    } });
+    Object.defineProperty(exports2, "measureFsAuthorizationToken", { enumerable: true, get: function() {
+      return fs_default_wire_js_1.measureFsAuthorizationToken;
+    } });
     var gemini_js_1 = require_gemini();
     Object.defineProperty(exports2, "withCodeRiftsGemini", { enumerable: true, get: function() {
       return gemini_js_1.withCodeRiftsGemini;
@@ -227325,6 +227483,25 @@ var require_gate_pin = __commonJS({
   }
 });
 
+// src/generated/action-pins.json
+var require_action_pins = __commonJS({
+  "src/generated/action-pins.json"(exports2, module2) {
+    module2.exports = {
+      actions: [
+        {
+          action: "actions/checkout",
+          sha: "11d5960a326750d5838078e36cf38b85af677262",
+          tag: "v4",
+          exact_tag: "v4.4.0",
+          resolved_from: "https://github.com/actions/checkout refs/tags/v4",
+          resolved_at: "2026-08-27T13:27:52Z"
+        }
+      ],
+      note: "STRICT template pins these third-party actions to full commit SHAs (only a full SHA is immutable). The DEFAULT template deliberately stays on moving tags. A SHA pin does not receive upstream security fixes until someone bumps it \u2014 Dependabot raises that PR, and a pin nobody bumps is worse than a tag because it rots silently. Re-run scripts/generate-action-pins.js."
+    };
+  }
+});
+
 // src/contract-gate-workflow.js
 var require_contract_gate_workflow = __commonJS({
   "src/contract-gate-workflow.js"(exports2, module2) {
@@ -227334,6 +227511,17 @@ var require_contract_gate_workflow = __commonJS({
     var WORKFLOW_REL = ".github/workflows/coderifts.yml";
     var GATE_ACTION = "coderifts/contract-gate@v0";
     var GATE_PIN = require_gate_pin();
+    var ACTION_PINS = require_action_pins();
+    function pinnedActionRef(action) {
+      const entry = (ACTION_PINS.actions || []).find((a) => a && a.action === action);
+      if (!entry || !/^[0-9a-f]{40}$/.test(String(entry.sha || ""))) {
+        throw new Error(
+          `contract-gate-workflow: no usable SHA pin for ${action} in src/generated/action-pins.json \u2014 run scripts/generate-action-pins.js. Refusing to emit an unpinned STRICT workflow.`
+        );
+      }
+      return `${action}@${entry.sha} # ${entry.exact_tag || entry.tag}`;
+    }
+    var CHECKOUT_STRICT = pinnedActionRef("actions/checkout");
     if (typeof GATE_PIN.sha !== "string" || !/^[0-9a-f]{40}$/.test(GATE_PIN.sha)) {
       throw new Error(
         "contract-gate-workflow: generated/gate-pin.json carries no valid 40-hex sha \u2014 re-run scripts/generate-gate-pin.js. Refusing to emit an unpinned STRICT workflow."
@@ -227368,6 +227556,10 @@ jobs:
   contract-gate:
     runs-on: ubuntu-latest
     steps:
+      # actions/checkout stays on the MOVING TAG @v4 here, deliberately \u2014 the same trade this
+      # template makes for the gate itself. You get upstream fixes without editing this file, and
+      # you accept that the bytes can change under you. \`coderifts init --agents --strict\` pins a
+      # full commit SHA for both. Do not "fix" this to a SHA and do not "fix" strict back to a tag.
       - uses: actions/checkout@v4
         with:
           # REQUIRED: the gate derives the change set from git diff base...head.
@@ -227424,7 +227616,14 @@ jobs:
   contract-gate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      # PINNED, like the gate below it. \`@v4\` is a tag GitHub moves on every release of the
+      # action, so it is not a pin \u2014 and checkout runs FIRST, fetching the code every later step
+      # reads. A strict chain whose first step can change under it is not strict.
+      # MAINTENANCE, stated because a pin has a cost: a SHA-pinned action receives no upstream
+      # fixes, security included, until someone bumps it. Dependabot understands this form and
+      # raises that PR. WITHOUT Dependabot the obligation is yours, and a pin nobody bumps is worse
+      # than a tag, because a tag rots visibly and a pin rots silently.
+      - uses: ${CHECKOUT_STRICT}
         with:
           # REQUIRED: the gate derives the change set from git diff base...head.
           fetch-depth: 0
@@ -227508,6 +227707,9 @@ jobs:
       GATE_ACTION,
       GATE_ACTION_STRICT,
       GATE_PIN,
+      ACTION_PINS,
+      CHECKOUT_STRICT,
+      pinnedActionRef,
       ENFORCEMENT_DOC,
       writeContractGateWorkflow,
       workflowPresent
@@ -227564,7 +227766,8 @@ var require_init_agents = __commonJS({
     var EXTRA_RULES_ON_ALL = Object.freeze([
       ".github/copilot-instructions.md",
       "coderifts-langgraph-policy.js",
-      "openai-agent-instructions.md"
+      "openai-agent-instructions.md",
+      "skills/api-governance/SKILL.md"
     ]);
     var NEXT_MANUAL_STEP_LINES = Object.freeze([
       "  Next manual step",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coderifts",
-  "version": "6.0.0",
+  "version": "6.0.2",
   "description": "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
   "author": "CodeRifts <hello@coderifts.com>",
   "license": "MIT",
@@ -45,7 +45,7 @@
     "test": "node --test test/*.test.js"
   },
   "dependencies": {
-    "@coderifts/agent-guard": "^12.0.0",
+    "@coderifts/agent-guard": "^13.0.0",
     "chalk": "^4.1.2",
     "cli-table3": "^0.6.4",
     "commander": "^12.0.0",

package/scripts/assert-guard-major.js

@@ -45,13 +45,33 @@
  *   raise, and no product code. The floor rises anyway, because a semantics floor is about
  *   what the CLI may RUN against: a guard that silently skips the atomicity demand on an ordinary
  *   edit is exactly the class of difference this gate exists to refuse.)
+ * 6.0.0: floor raised to 13 (the CAS now conditions on the AUTHORIZATION-TIME token. Through 12.0.0
+ *   wrapWriteWithFsCas measured its expected token INSIDE executeFactory — after preflight and after
+ *   the T2 recheck — and conditioned the write on that self-fetched value, which asks whether the
+ *   state changed since a read a microsecond earlier. Measured on 12.0.0: a writer landing in that
+ *   window had its state adopted as the legitimate starting point and the CAS still returned
+ *   committed with enforced:true, clobbering it. 13.0.0 threads the T1 token, and adds three FS
+ *   defences that were measured ABSENT rather than assumed: `..` refused before resolution, a
+ *   symlinked final component refused (stat/readFile measured the TARGET while rename replaced the
+ *   LINK — check and write named different objects), the token read through one file descriptor,
+ *   and dev+ino recorded in the evidence. COST MEASURED AS ZERO, and measured more carefully than
+ *   the last two raises: the CLI imports only deployGate, asVerifiedDeployReceiptView,
+ *   DEPLOY_RECEIPT_VIEW_SPEC and matchGlob, whose implementing modules (deploy-gate.js,
+ *   resolver-glob.js, deploy-receipt-token.js, merge-gate.js) are BYTE-IDENTICAL 12.0.0 -> 13.0.0.
+ *   Note the honest qualifier the earlier raises did not state: requiring the barrel index.js LOADS
+ *   every changed module, so the changed code is in the process — it is simply not on the code path
+ *   of any symbol the CLI calls, and the four symbols return identical values under both versions.
+ *   Suite staged against 13.0.0 returned an identical 539/518/21 with a byte-identical 28-item
+ *   failure set. The floor rises anyway, because a semantics floor is about what the CLI may RUN
+ *   against: a CAS that reports committed after adopting another writer's state is exactly the
+ *   class this gate exists to refuse.)
  */
 
 const fs = require('fs');
 const path = require('path');
 
 /** Minimum acceptable major for @coderifts/agent-guard in THIS package (the CLI). */
-const MIN_GUARD_MAJOR = 12;
+const MIN_GUARD_MAJOR = 13;
 const DEP = '@coderifts/agent-guard';
 
 /**