coderifts 7.0.0 → 8.0.0

package/dist/cli.js

@@ -3028,7 +3028,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "7.0.0",
+      version: "8.0.0",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -3074,7 +3074,7 @@ var require_package = __commonJS({
         test: "node --test test/*.test.js"
       },
       dependencies: {
-        "@coderifts/agent-guard": "^14.0.0",
+        "@coderifts/agent-guard": "^15.0.0",
         chalk: "^4.1.2",
         "cli-table3": "^0.6.4",
         commander: "^12.0.0",
@@ -70000,7 +70000,7 @@ var require_policy2 = __commonJS({
     exports2.observePolicyPresence = observePolicyPresence;
     exports2.resetPolicyWarnForTests = resetPolicyWarnForTests;
     exports2.POLICY_MARKER = "A receipt authorizes ONE operation: a merge receipt does not authorize a deploy.";
-    exports2.CODERIFTS_POLICY = 'Call `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".';
+    exports2.CODERIFTS_POLICY = 'Call `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".';
     exports2.POLICY_ABSENT_WARN = "CodeRifts policy text not detected in the system prompt. The agent will still see the tools, but measured evidence shows operation-scope misuse is markedly more likely without it. See https://github.com/coderifts/agent-guard#policy-delivery.";
     function textHasMarker(text) {
       return text.includes(exports2.POLICY_MARKER);
@@ -70079,16 +70079,167 @@ var require_policy2 = __commonJS({
   }
 });
 
+// node_modules/@coderifts/agent-guard/dist/cjs/deny-remedy.js
+var require_deny_remedy = __commonJS({
+  "node_modules/@coderifts/agent-guard/dist/cjs/deny-remedy.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.ARGS_SHAPE = exports2.DOES_NOT_PROMISE = exports2.DENY_ERROR = void 0;
+    exports2.buildDenyRemedy = buildDenyRemedy;
+    exports2.denyErrorForReason = denyErrorForReason;
+    exports2.DENY_ERROR = Object.freeze({
+      GRANT_REQUIRED: "CODERIFTS_GRANT_REQUIRED",
+      GRANT_INVALID: "CODERIFTS_GRANT_INVALID",
+      GRANT_MISMATCH: "CODERIFTS_GRANT_MISMATCH"
+    });
+    exports2.DOES_NOT_PROMISE = "a grant does not guarantee execution (CAS may still fail)";
+    exports2.ARGS_SHAPE = Object.freeze({
+      artifacts: "Array<{ id, type, before, after }> \u2014 the change set being authorized",
+      context: "{ operation, environment?, repository?, branch?, pull_request? } \u2014 operation is required for authorize"
+    });
+    var FINGERPRINT_RE = /^sha256:[0-9a-f]{64}$/;
+    function buildDenyRemedy({ error, target = null, fingerprint = null, observed = null }) {
+      if (!error || !Object.values(exports2.DENY_ERROR).includes(error))
+        return null;
+      const remedy = {
+        error,
+        // Null, never a wildcard: a surface that cannot name what it refused must
+        // not emit a value a reader could take for "everything".
+        target: typeof target === "string" && target.length > 0 ? target : null,
+        // Only a well-formed fingerprint. A malformed one is dropped rather than
+        // passed through, because a caller comparing it would get a false mismatch.
+        fingerprint: typeof fingerprint === "string" && FINGERPRINT_RE.test(fingerprint) ? fingerprint : null,
+        action_required: {
+          tool: "preflight_change_set",
+          mode: "authorize",
+          args_shape: { ...exports2.ARGS_SHAPE }
+        },
+        does_not_promise: exports2.DOES_NOT_PROMISE
+      };
+      if (observed && typeof observed === "object")
+        remedy.observed = observed;
+      return remedy;
+    }
+    function denyErrorForReason(reason) {
+      switch (String(reason || "").toLowerCase()) {
+        // Nothing was presented.
+        case "receipt_missing":
+        case "missing_receipt":
+        case "missing_grant_header":
+        case "decision_missing":
+        case "missing_decision_result":
+        case "no_preflight_response":
+        case "grant_not_supplied":
+          return exports2.DENY_ERROR.GRANT_REQUIRED;
+        // Something was presented and did not hold up.
+        case "receipt_invalid":
+        case "receipt_unverified":
+        case "invalid_signature":
+        case "unknown_key":
+        case "unknown_kid":
+        case "dsse_malformed":
+        case "dsse_unsupported":
+        case "dsse_predicate_mismatch":
+        case "malformed":
+        case "grant_malformed":
+        case "grant_unverified":
+        case "grant_expired":
+          return exports2.DENY_ERROR.GRANT_INVALID;
+        // It held up, but it is not about this request.
+        case "scope_mismatch":
+        case "target_mismatch":
+        case "operation_mismatch":
+        case "grant_scope_mismatch":
+        case "mode_mismatch":
+        case "repo_mismatch":
+        case "base_mismatch":
+        case "head_mismatch":
+        case "grant_does_not_cover_path":
+        case "grant_bound_elsewhere":
+        case "receipt_envelope_mismatch":
+        case "artifact_mismatch":
+        case "grant_unbound":
+        case "grant_wrong_audience":
+          return exports2.DENY_ERROR.GRANT_MISMATCH;
+        default:
+          return null;
+      }
+    }
+  }
+});
+
 // node_modules/@coderifts/agent-guard/dist/cjs/execution-grant.js
 var require_execution_grant2 = __commonJS({
   "node_modules/@coderifts/agent-guard/dist/cjs/execution-grant.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.V2_WIRE_FIELDS = exports2.V2_FIELD_KEYS = void 0;
+    exports2.resolveV2Fields = resolveV2Fields;
+    exports2.v2WireFields = v2WireFields;
     exports2.isExecutionGrantEnabled = isExecutionGrantEnabled;
     exports2.readExecutionGrantToken = readExecutionGrantToken;
     exports2.firstArtifactId = firstArtifactId;
     exports2.isSignerUnavailableError = isSignerUnavailableError;
     exports2.resolveStateNonceForCall = resolveStateNonceForCall;
+    exports2.V2_FIELD_KEYS = Object.freeze([
+      "executorId",
+      "adapterId",
+      "targetUri",
+      "tenantId",
+      "policyHash",
+      "audienceHash"
+    ]);
+    function resolveV2Fields(input) {
+      const top = input || {};
+      const nested = input && input.executionGrant || {};
+      const out = {};
+      const conflicts = [];
+      for (const key of exports2.V2_FIELD_KEYS) {
+        const t = typeof top[key] === "string" && top[key].length > 0 ? top[key] : void 0;
+        const n = typeof nested[key] === "string" && nested[key].length > 0 ? nested[key] : void 0;
+        if (t !== void 0 && n !== void 0 && t !== n) {
+          conflicts.push(`  ${key}: top-level ${JSON.stringify(t)} vs executionGrant.${key} ${JSON.stringify(n)}`);
+          continue;
+        }
+        const v = t !== void 0 ? t : n;
+        if (v !== void 0)
+          out[key] = v;
+      }
+      if (conflicts.length > 0) {
+        const err = new Error(`withCodeRifts: the V2 identity fields are configured in two places and they disagree.
+${conflicts.join("\n")}
+
+These feed DIFFERENT halves of the system \u2014 the top level binds the ATOMIC construction check and the posture receipt, the executionGrant copy goes on the authorize request \u2014 so a disagreement builds a grant against one identity and verifies against another. Set each field ONCE, at the top level; the executionGrant spelling is a deprecated alias.`);
+        err.code = "V2_FIELDS_CONFLICT";
+        throw err;
+      }
+      return out;
+    }
+    exports2.V2_WIRE_FIELDS = Object.freeze([
+      ["executor_id", "executorId"],
+      ["adapter_id", "adapterId"],
+      ["target_uri", "targetUri"],
+      ["tenant_id", "tenantId"],
+      ["policy_hash", "policyHash"],
+      ["audience_hash", "audienceHash"]
+    ]);
+    function v2WireFields(config) {
+      const g = config && config.executionGrant;
+      const fields = {};
+      const absent = [];
+      if (!g || g.grantVersion !== "v2") {
+        return { fields, absent: exports2.V2_WIRE_FIELDS.map(([wire]) => wire) };
+      }
+      const resolved = resolveV2Fields(config);
+      for (const [wire, key] of exports2.V2_WIRE_FIELDS) {
+        const v = resolved[key];
+        if (typeof v === "string" && v.length > 0)
+          fields[wire] = v;
+        else
+          absent.push(wire);
+      }
+      return { fields, absent };
+    }
     function isExecutionGrantEnabled(config) {
       return !!(config && config.executionGrant && config.executionGrant.enabled === true);
     }
@@ -70163,6 +70314,7 @@ var require_guard = __commonJS({
     var monitoring_delivery_js_1 = require_monitoring_delivery();
     var monitoring_attestation_js_1 = require_monitoring_attestation2();
     var policy_js_1 = require_policy2();
+    var deny_remedy_js_1 = require_deny_remedy();
     var execution_grant_js_1 = require_execution_grant2();
     var breakers = /* @__PURE__ */ new WeakMap();
     var nowMs = () => Date.now();
@@ -70333,7 +70485,7 @@ var require_guard = __commonJS({
     function coverageOutcomeFieldsFrom(s) {
       return s.coverageObserved ? { coverage_observed: s.coverageObserved } : {};
     }
-    function blocked(config, verdict, preflighted, freshness, conditional_write, monitoring_delivery, monitoring_attestation, grantObs) {
+    function blocked(config, verdict, preflighted, freshness, conditional_write, monitoring_delivery, monitoring_attestation, grantObs, call) {
       const commit_observation = {
         status: "not_observed",
         observed_at: iso(),
@@ -70341,6 +70493,14 @@ var require_guard = __commonJS({
       };
       const base = { executionAttempted: false, executed: false, enforced: false, verdict, preflighted };
       const cov = coverageSnap(config);
+      const cause = "cause" in verdict ? verdict.cause : null;
+      const remedy = call ? (0, deny_remedy_js_1.buildDenyRemedy)({
+        error: (0, deny_remedy_js_1.denyErrorForReason)(cause),
+        target: call.toolName || null,
+        // The guard's own input fingerprint, already sha256:<hex>.
+        fingerprint: fingerprint(call),
+        observed: { cause, resolution: "resolution" in verdict ? verdict.resolution : null }
+      }) : null;
       const out = {
         ...base,
         proof: (0, execution_proof_js_1.buildExecutionProof)({
@@ -70357,7 +70517,8 @@ var require_guard = __commonJS({
         ...monitoring_delivery ? { monitoring_delivery } : {},
         ...monitoring_attestation ? { monitoring_attestation } : {},
         ...coverageOutcomeFieldsFrom(cov),
-        ...grantObs ? { execution_grant: grantObs } : {}
+        ...grantObs ? { execution_grant: grantObs } : {},
+        ...remedy ? { remedy } : {}
       };
       return attachPolicyPresence(out, config);
     }
@@ -70565,7 +70726,7 @@ var require_guard = __commonJS({
         const v = unavailableVerdict({ cause: "MISSING_ARTIFACT_CONTENT", failPolicy, resolution: "CLOSED", action: "STOP" }, count);
         const { basis } = freshnessFor(config, redacted, fctx, detection.artifacts);
         const { basis: cw } = conditionalWriteFor(config, redacted, cwctx, detection.artifacts);
-        return blocked(config, v, false, basis, cw);
+        return blocked(config, v, false, basis, cw, void 0, void 0, void 0, redacted);
       }
       if (failPolicy === "lkg" && !config.lkg) {
         breakerRecord(config);
@@ -70589,6 +70750,20 @@ var require_guard = __commonJS({
         request.include_execution_grant = true;
         if (nonceRes.nonce)
           request.state_nonce = nonceRes.nonce;
+        const wire = (0, execution_grant_js_1.v2WireFields)(config);
+        if (config.executionGrant?.grantVersion === "v2") {
+          request.grant_version = "v2";
+          for (const [k, v] of Object.entries(wire.fields))
+            request[k] = v;
+        }
+        if (config.executionGrant?.grantVersion === "v2") {
+          grantObs = {
+            ...grantObs,
+            grant_version: "v2",
+            v2_fields_sent: Object.keys(wire.fields),
+            v2_fields_absent: wire.absent
+          };
+        }
       }
       const cap = config.maxPayloadBytes ?? 1e6;
       if (Buffer.byteLength(JSON.stringify(request), "utf8") > cap) {
@@ -70605,14 +70780,14 @@ var require_guard = __commonJS({
         if (pf.integrity) {
           emit(config, { type: "breaker_tripped", at: iso(), cause: pf.cause });
           const v2 = unavailableVerdict({ cause: pf.cause, failPolicy, resolution: "CLOSED", action: "STOP" }, count);
-          return blocked(config, v2, false, basis, cw, void 0, void 0, grantObs);
+          return blocked(config, v2, false, basis, cw, void 0, void 0, grantObs, redacted);
         }
         const availCause = pf.cause;
         if (grantObs && grantObs.requested) {
           if (breakerTripped(config))
             emit(config, { type: "breaker_tripped", at: iso(), cause: availCause });
           const v2 = unavailableVerdict({ cause: availCause, failPolicy, resolution: "CLOSED", action: "STOP" }, count);
-          return blocked(config, v2, false, basis, cw, void 0, void 0, grantObs);
+          return blocked(config, v2, false, basis, cw, void 0, void 0, grantObs, redacted);
         }
         if (failPolicy === "open" && !breakerTripped(config)) {
           emit(config, { type: "preflight_unavailable", at: iso(), cause: availCause, action: "CONTINUE" });
@@ -70630,7 +70805,7 @@ var require_guard = __commonJS({
         if (breakerTripped(config))
           emit(config, { type: "breaker_tripped", at: iso(), cause: availCause });
         const v = unavailableVerdict({ cause: availCause, failPolicy, resolution: "CLOSED", action: "STOP" }, count);
-        return blocked(config, v, false, basis, cw, void 0, void 0, grantObs);
+        return blocked(config, v, false, basis, cw, void 0, void 0, grantObs, redacted);
       }
       const rd = (0, read_decision_js_1.readDecision)(pf.response);
       if (rd.reason === "EXECUTION_ACTION_UNRECOGNISED") {
@@ -70670,7 +70845,7 @@ var require_guard = __commonJS({
       if (gate.verdict === "block-strict") {
         const { basis } = freshnessFor(config, redacted, fctx, detection.artifacts);
         const { basis: cw } = conditionalWriteFor(config, redacted, cwctx, detection.artifacts);
-        return gate.decision === "BLOCK" ? blocked(config, { kind: "BLOCK", action: "STOP", envelope, receiptVerified }, true, basis, cw, void 0, void 0, grantObs) : blocked(config, { kind: "APPROVAL", action: "REQUEST_APPROVAL", envelope, receiptVerified }, true, basis, cw, void 0, void 0, grantObs);
+        return gate.decision === "BLOCK" ? blocked(config, { kind: "BLOCK", action: "STOP", envelope, receiptVerified }, true, basis, cw, void 0, void 0, grantObs, redacted) : blocked(config, { kind: "APPROVAL", action: "REQUEST_APPROVAL", envelope, receiptVerified }, true, basis, cw, void 0, void 0, grantObs, redacted);
       }
       const kind = gate.kind;
       if (grantObs && grantObs.requested) {
@@ -70816,7 +70991,7 @@ var require_guard = __commonJS({
       const v = unavailableVerdict({ cause, failPolicy, resolution: "CLOSED", action: "STOP" }, count);
       const { basis } = freshnessFor(config, redacted, fctx, arts);
       const { basis: cw } = conditionalWriteFor(config, redacted, cwctx, arts);
-      return blocked(config, v, false, basis, cw, monitoring_delivery, monitoring_attestation, grantObs);
+      return blocked(config, v, false, basis, cw, monitoring_delivery, monitoring_attestation, grantObs, redacted);
     }
     function isExpired(envelope) {
       const exp = envelope.expires_at;
@@ -73427,6 +73602,31 @@ var require_deploy_receipt_token = __commonJS({
       }
       return v1;
     }
+    function deriveKeyWithdrawalStatus(ts, keyMeta) {
+      const KNOWN_STATUSES = ["active", "retired", "revoked", null];
+      if (!KNOWN_STATUSES.includes(keyMeta.status))
+        return "UNKNOWN_KEY_STATUS";
+      if (typeof keyMeta.revoked_at === "string" && keyMeta.revoked_at.length > 0)
+        return "KEY_REVOKED";
+      if (typeof keyMeta.retired_at === "string" && keyMeta.retired_at.length > 0 && ts) {
+        const issued = Date.parse(ts);
+        const retired = Date.parse(keyMeta.retired_at);
+        if (Number.isFinite(issued) && Number.isFinite(retired) && issued >= retired) {
+          return "KEY_RETIRED_AFTER_SIGNING";
+        }
+      }
+      if (keyMeta.status === "revoked") {
+        const at = keyMeta.compromised_at;
+        if (typeof at !== "string" || at.length === 0)
+          return "REVOKED_KEY_UNDECIDABLE";
+        const boundary = Date.parse(at);
+        const issued = typeof ts === "string" ? Date.parse(ts) : NaN;
+        if (!Number.isFinite(boundary) || !Number.isFinite(issued))
+          return "REVOKED_KEY_UNDECIDABLE";
+        return issued >= boundary ? "REVOKED_KEY" : "REVOKED_KEY_UNDECIDABLE";
+      }
+      return null;
+    }
     function isIssueTimeWithinKeyWindow(ts, keyMeta) {
       if (!keyMeta || keyMeta.status === "active")
         return true;
@@ -73451,6 +73651,12 @@ var require_deploy_receipt_token = __commonJS({
         return false;
       return true;
     }
+    function optionalString(source, field) {
+      if (!source || typeof source !== "object")
+        return null;
+      const v = source[field];
+      return typeof v === "string" && v.length > 0 ? v : null;
+    }
     function resolveKey(kid, registry, pinnedKeyPem) {
       if (typeof pinnedKeyPem === "string" && pinnedKeyPem.trim().length > 0) {
         try {
@@ -73458,7 +73664,9 @@ var require_deploy_receipt_token = __commonJS({
             publicKey: (0, node_crypto_1.createPublicKey)(pinnedKeyPem),
             status: "active",
             valid_from: null,
-            retired_at: null
+            retired_at: null,
+            revoked_at: null,
+            compromised_at: null
           };
         } catch {
           return null;
@@ -73473,9 +73681,11 @@ var require_deploy_receipt_token = __commonJS({
       try {
         return {
           publicKey: (0, node_crypto_1.createPublicKey)(entry.public_key_pem),
-          status: entry.status === "retired" ? "retired" : "active",
+          status: typeof entry.status === "string" ? entry.status : null,
           valid_from: entry.valid_from || null,
-          retired_at: entry.retired_at || null
+          retired_at: entry.retired_at || null,
+          revoked_at: optionalString(entry, "revoked_at"),
+          compromised_at: optionalString(entry, "compromised_at")
         };
       } catch {
         return null;
@@ -73549,6 +73759,14 @@ var require_deploy_receipt_token = __commonJS({
           return fail("INVALID_SIGNATURE", "invalid_signature", { payload, authz_reason: "delimiter_in_field" });
         }
       }
+      const withdrawn = deriveKeyWithdrawalStatus(typeof payload.ts === "string" ? payload.ts : void 0, resolved);
+      if (withdrawn) {
+        return fail(withdrawn, withdrawn === "UNKNOWN_KEY_STATUS" ? "unknown_key_status" : "revoked_key", {
+          payload,
+          authz_reason: withdrawn.toLowerCase(),
+          key_status: withdrawn === "UNKNOWN_KEY_STATUS" ? "unknown" : "revoked"
+        });
+      }
       if (resolved.status === "retired") {
         if (!isIssueTimeWithinKeyWindow(typeof payload.ts === "string" ? payload.ts : void 0, resolved)) {
           return fail("INVALID_SIGNATURE", "invalid_signature", { payload, authz_reason: "retired_key_outside_window" });
@@ -74040,18 +74258,168 @@ var require_coverage_report = __commonJS({
   }
 });
 
+// node_modules/@coderifts/agent-guard/dist/cjs/posture-receipt.js
+var require_posture_receipt = __commonJS({
+  "node_modules/@coderifts/agent-guard/dist/cjs/posture-receipt.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.POSTURE_CLOCK_SKEW_TOLERANCE_MS = exports2.POSTURE_RECEIPT_V = void 0;
+    exports2.verifyPostureReceipt = verifyPostureReceipt;
+    var node_crypto_1 = require("node:crypto");
+    exports2.POSTURE_RECEIPT_V = "cr.posture.receipt.v1";
+    exports2.POSTURE_CLOCK_SKEW_TOLERANCE_MS = 5e3;
+    function resolvePostureKey(kid, registry, pinnedKeyPem) {
+      if (typeof pinnedKeyPem === "string" && pinnedKeyPem.trim().length > 0) {
+        try {
+          return { ok: true, key: (0, node_crypto_1.createPublicKey)(pinnedKeyPem) };
+        } catch {
+          return { ok: false, status: "POSTURE_UNKNOWN_KEY" };
+        }
+      }
+      if (!registry || !Array.isArray(registry.keys) || !kid) {
+        return { ok: false, status: "POSTURE_UNKNOWN_KEY" };
+      }
+      const matches = registry.keys.filter((k) => k && k.kid === kid && typeof k.public_key_pem === "string");
+      if (matches.length === 0)
+        return { ok: false, status: "POSTURE_UNKNOWN_KEY" };
+      const entry = matches.find((k) => k.status === "active");
+      if (!entry)
+        return { ok: false, status: "POSTURE_REVOKED_KEY" };
+      try {
+        return { ok: true, key: (0, node_crypto_1.createPublicKey)(entry.public_key_pem) };
+      } catch {
+        return { ok: false, status: "POSTURE_UNKNOWN_KEY" };
+      }
+    }
+    var fail = (status, reason, extra = {}) => ({ valid: false, status, reason, ...extra });
+    function verifyPostureReceipt(token, input = {}) {
+      if (typeof token !== "string" || token.length === 0) {
+        return fail("POSTURE_MALFORMED", "malformed_structure");
+      }
+      const seg = token.split("|");
+      if (seg.length !== 4 || seg[0] !== exports2.POSTURE_RECEIPT_V || seg.some((x) => !x)) {
+        return fail("POSTURE_MALFORMED", "malformed_structure");
+      }
+      let preimageBytes;
+      try {
+        preimageBytes = Buffer.from(seg[2], "base64url");
+        if (preimageBytes.length === 0)
+          throw new Error("empty");
+      } catch {
+        return fail("POSTURE_MALFORMED", "bad_preimage");
+      }
+      const resolved = resolvePostureKey(seg[1], input.registry, input.pinnedKeyPem);
+      if (!resolved.ok) {
+        return fail(resolved.status, resolved.status === "POSTURE_REVOKED_KEY" ? "kid_revoked" : "unknown_kid");
+      }
+      const key = resolved.key;
+      let sigOk = false;
+      try {
+        sigOk = (0, node_crypto_1.verify)(null, preimageBytes, key, Buffer.from(seg[3], "base64url"));
+      } catch {
+        return fail("POSTURE_INVALID_SIGNATURE", "signature_error");
+      }
+      if (!sigOk)
+        return fail("POSTURE_INVALID_SIGNATURE", "signature_mismatch");
+      let payload;
+      try {
+        payload = JSON.parse(preimageBytes.toString("utf8"));
+      } catch {
+        return fail("POSTURE_MALFORMED", "bad_json");
+      }
+      if (!payload || typeof payload !== "object") {
+        return fail("POSTURE_MALFORMED", "bad_json");
+      }
+      if (payload.verdict !== "PASS") {
+        return fail("POSTURE_FAIL", "posture_verdict_not_pass", { payload });
+      }
+      if (typeof payload.executor_kid === "string" && payload.executor_kid.length > 0 && payload.executor_kid !== seg[1]) {
+        return fail("POSTURE_UNBOUND", "kid_mismatch", { payload });
+      }
+      if (Object.prototype.hasOwnProperty.call(payload, "v") && payload.v != null && payload.v !== exports2.POSTURE_RECEIPT_V) {
+        return fail("POSTURE_MALFORMED", "body_version_mismatch", { payload });
+      }
+      if (typeof input.expectedDeploymentId === "string" && input.expectedDeploymentId.length > 0) {
+        if (payload.deployment_id !== input.expectedDeploymentId) {
+          return fail("POSTURE_UNBOUND", "deployment_id_mismatch", { payload });
+        }
+      }
+      const bound = [];
+      const notBound = [];
+      const tuple = [
+        ["executor_id", input.expectedExecutorId, "executor_id"],
+        ["adapter_id", input.expectedAdapterId, "adapter_id"],
+        ["target_uri", input.expectedTargetUri, "target_uri"],
+        ["policy_hash", input.expectedPolicyHash, "policy_hash"]
+      ];
+      for (const [field, expected, label] of tuple) {
+        if (typeof expected !== "string" || expected.length === 0) {
+          notBound.push({
+            field: label,
+            reason: "the caller did not state an expected value, so this verification did not check it"
+          });
+          continue;
+        }
+        const actual = payload[field];
+        if (typeof actual !== "string" || actual.length === 0) {
+          return fail("POSTURE_UNBOUND", `${label}_absent`, { payload, bound, not_bound: notBound });
+        }
+        if (actual !== expected) {
+          return fail("POSTURE_UNBOUND", `${label}_mismatch`, { payload, bound, not_bound: notBound });
+        }
+        bound.push(label);
+      }
+      let ageMs;
+      if (typeof input.maxAgeMs === "number" && Number.isFinite(input.maxAgeMs)) {
+        const measured = Date.parse(String(payload.measured_at));
+        if (Number.isNaN(measured)) {
+          return fail("POSTURE_STALE", "measured_at_unparseable", { payload });
+        }
+        const now = (input.now || (() => Date.now()))();
+        if (!Number.isFinite(now)) {
+          return fail("POSTURE_STALE", "now_unparseable", { payload });
+        }
+        ageMs = now - measured;
+        if (!Number.isFinite(ageMs)) {
+          return fail("POSTURE_STALE", "measured_at_unparseable", { payload });
+        }
+        if (ageMs < -exports2.POSTURE_CLOCK_SKEW_TOLERANCE_MS) {
+          return fail("POSTURE_STALE", "measured_at_in_future", { payload, age_ms: ageMs });
+        }
+        if (ageMs > input.maxAgeMs) {
+          return fail("POSTURE_STALE", "outside_freshness_window", { payload, age_ms: ageMs });
+        }
+      }
+      return {
+        valid: true,
+        status: "POSTURE_PASS",
+        reason: null,
+        payload,
+        ...ageMs === void 0 ? {} : { age_ms: ageMs },
+        // What this PASS actually proved about the credential boundary — and what
+        // it did not. A caller must not have to infer the difference.
+        bound,
+        not_bound: notBound
+      };
+    }
+  }
+});
+
 // node_modules/@coderifts/agent-guard/dist/cjs/atomic-profile.js
 var require_atomic_profile = __commonJS({
   "node_modules/@coderifts/agent-guard/dist/cjs/atomic-profile.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.ATOMIC_INVARIANTS = exports2.ATOMIC_PROFILE_UNSATISFIED = exports2.GUARD_ATOMIC_WIRE_VALUE = exports2.PROFILE_ENFORCING_ATOMIC_V1 = void 0;
+    exports2.CREDENTIAL_BOUNDARY_BARE_REJECTED = exports2.ATOMIC_V2_MAX_AGE_MS_CAP = exports2.ATOMIC_INVARIANTS = exports2.ATOMIC_PROFILE_UNSATISFIED = exports2.GUARD_ATOMIC_WIRE_VALUE = exports2.PROFILE_ENFORCING_ATOMIC_V2 = exports2.PROFILE_ENFORCING_ATOMIC_V1 = void 0;
     exports2.createMutatorRegister = createMutatorRegister;
     exports2.isEnforcingAtomic = isEnforcingAtomic;
+    exports2.isEnforcingAtomicV2 = isEnforcingAtomicV2;
     exports2.atomicConstructionProblems = atomicConstructionProblems;
     exports2.throwAtomicUnsatisfied = throwAtomicUnsatisfied;
     exports2.atomicOutcome = atomicOutcome;
+    var posture_receipt_js_1 = require_posture_receipt();
     exports2.PROFILE_ENFORCING_ATOMIC_V1 = "ENFORCING_ATOMIC_V1";
+    exports2.PROFILE_ENFORCING_ATOMIC_V2 = "ENFORCING_ATOMIC_V2";
     exports2.GUARD_ATOMIC_WIRE_VALUE = "ENFORCING_ATOMIC";
     exports2.ATOMIC_PROFILE_UNSATISFIED = "ATOMIC_PROFILE_UNSATISFIED";
     exports2.ATOMIC_INVARIANTS = Object.freeze([
@@ -74087,8 +74455,13 @@ var require_atomic_profile = __commonJS({
       return api;
     }
     function isEnforcingAtomic(profile) {
-      return profile === "ENFORCING_ATOMIC" || profile === exports2.PROFILE_ENFORCING_ATOMIC_V1;
+      return profile === "ENFORCING_ATOMIC" || profile === exports2.PROFILE_ENFORCING_ATOMIC_V1 || profile === exports2.PROFILE_ENFORCING_ATOMIC_V2;
+    }
+    function isEnforcingAtomicV2(profile) {
+      return profile === exports2.PROFILE_ENFORCING_ATOMIC_V2;
     }
+    exports2.ATOMIC_V2_MAX_AGE_MS_CAP = 864e5;
+    exports2.CREDENTIAL_BOUNDARY_BARE_REJECTED = "credential_boundary: a verified cr.posture.receipt.v1 is required; a bare assertion is no longer accepted. ENFORCING_ATOMIC_V1 still accepts the bare form and is frozen \u2014 move to _V2 to get this check.";
     function atomicConstructionProblems(input) {
       const problems = [];
       const grant = input.executionGrant;
@@ -74125,6 +74498,42 @@ var require_atomic_profile = __commonJS({
       if (input.credentialBoundary !== true && typeof input.credentialBoundary !== "object") {
         problems.push("credential_boundary: credentialBoundary assertion required");
       }
+      if (isEnforcingAtomicV2(input.profile)) {
+        const cb = input.credentialBoundary;
+        if (cb === true || !cb || typeof cb !== "object" || typeof cb.postureReceipt !== "string") {
+          problems.push(exports2.CREDENTIAL_BOUNDARY_BARE_REJECTED);
+        } else if (!cb.registry && !cb.pinnedKeyPem) {
+          problems.push("credential_boundary: credentialBoundary.registry or .pinnedKeyPem required \u2014 the posture receipt is verified against a caller-supplied key; this package never fetches one.");
+        } else {
+          const deploymentId = typeof cb.deploymentId === "string" ? cb.deploymentId : "";
+          if (deploymentId.length === 0) {
+            problems.push("credential_boundary: credentialBoundary.deploymentId required under ENFORCING_ATOMIC_V2 \u2014 the posture receipt must be bound to this deployment.");
+          }
+          const maxAgeMs = cb.maxAgeMs;
+          const maxAgeOk = typeof maxAgeMs === "number" && Number.isFinite(maxAgeMs) && maxAgeMs > 0 && maxAgeMs <= exports2.ATOMIC_V2_MAX_AGE_MS_CAP;
+          if (typeof maxAgeMs !== "number" || !Number.isFinite(maxAgeMs) || maxAgeMs <= 0) {
+            problems.push("credential_boundary: credentialBoundary.maxAgeMs required under ENFORCING_ATOMIC_V2 \u2014 a finite positive freshness window; the receipt signs measured_at and no expires_at.");
+          } else if (maxAgeMs > exports2.ATOMIC_V2_MAX_AGE_MS_CAP) {
+            problems.push(`credential_boundary: credentialBoundary.maxAgeMs exceeds the ${exports2.ATOMIC_V2_MAX_AGE_MS_CAP}ms cap (24h). A larger window is not a freshness check.`);
+          }
+          if (deploymentId.length > 0 && maxAgeOk) {
+            const r = (0, posture_receipt_js_1.verifyPostureReceipt)(cb.postureReceipt, {
+              registry: cb.registry,
+              pinnedKeyPem: cb.pinnedKeyPem,
+              expectedDeploymentId: deploymentId,
+              expectedExecutorId: input.executorId,
+              expectedAdapterId: input.adapterId,
+              expectedTargetUri: input.targetUri,
+              expectedPolicyHash: input.policyHash,
+              maxAgeMs,
+              now: cb.now
+            });
+            if (!r.valid) {
+              problems.push(`credential_boundary: posture receipt not verified \u2014 ${r.status} (${r.reason}). ` + (r.status === "POSTURE_STALE" ? "This is the caller-supplied freshness window (maxAgeMs), not a receipt-carried expiry: cr.posture.receipt.v1 signs measured_at and no expires_at." : r.status === "POSTURE_FAIL" ? "The signature verified; the posture did not. A signed FAIL is a drift artifact \u2014 the boundary regressed, the receipt is intact." : "Supply a posture receipt signed by a key in the registry, bound to this deployment_id, with verdict PASS."));
+            }
+          }
+        }
+      }
       return problems;
     }
     function throwAtomicUnsatisfied(problems) {
@@ -74153,11 +74562,12 @@ var require_with_coderifts = __commonJS({
   "node_modules/@coderifts/agent-guard/dist/cjs/with-coderifts.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.PROFILE_ENFORCING_ATOMIC_V1 = exports2.PROFILE_ENFORCING_STRICT_V1 = void 0;
+    exports2.PROFILE_ENFORCING_ATOMIC_V2 = exports2.PROFILE_ENFORCING_ATOMIC_V1 = exports2.PROFILE_ENFORCING_STRICT_V1 = void 0;
     exports2.foldTableSettledCalls = foldTableSettledCalls;
     exports2.guardedFractionAmongRoutes = guardedFractionAmongRoutes;
     exports2.withCodeRifts = withCodeRifts;
     var tool_registry_js_1 = require_tool_registry();
+    var execution_grant_js_1 = require_execution_grant2();
     var coverage_observed_js_1 = require_coverage_observed();
     var atomic_profile_js_1 = require_atomic_profile();
     function foldTableSettledCalls(events) {
@@ -74185,9 +74595,13 @@ var require_with_coderifts = __commonJS({
     Object.defineProperty(exports2, "PROFILE_ENFORCING_ATOMIC_V1", { enumerable: true, get: function() {
       return atomic_profile_js_2.PROFILE_ENFORCING_ATOMIC_V1;
     } });
+    Object.defineProperty(exports2, "PROFILE_ENFORCING_ATOMIC_V2", { enumerable: true, get: function() {
+      return atomic_profile_js_2.PROFILE_ENFORCING_ATOMIC_V2;
+    } });
     var ACCEPTED_PROFILES = Object.freeze([
       "ENFORCING_STRICT_V1",
       "ENFORCING_STRICT",
+      "ENFORCING_ATOMIC_V2",
       "ENFORCING_ATOMIC_V1",
       "ENFORCING_ATOMIC"
     ]);
@@ -74465,16 +74879,21 @@ var require_with_coderifts = __commonJS({
         problems.push(...enforcingStrictExecutionChainProblems(input));
       }
       if ((0, atomic_profile_js_1.isEnforcingAtomic)(input.profile)) {
+        const v2 = (0, execution_grant_js_1.resolveV2Fields)(input);
         const atomicProblems = (0, atomic_profile_js_1.atomicConstructionProblems)({
           executionGrant: input.executionGrant,
-          executorId: input.executorId,
-          adapterId: input.adapterId,
-          targetUri: input.targetUri,
+          executorId: v2.executorId,
+          adapterId: v2.adapterId,
+          targetUri: v2.targetUri,
+          // Previously never forwarded, so the posture verifier's policy_hash
+          // binding could not fire no matter what the caller configured.
+          policyHash: v2.policyHash,
           executorAttestation: input.executorAttestation,
           mutatorRegister: input.mutatorRegister,
           casAdapter: input.casAdapter,
           readBack: input.readBack,
-          credentialBoundary: input.credentialBoundary
+          credentialBoundary: input.credentialBoundary,
+          profile: input.profile
         });
         if (atomicProblems.length > 0)
           (0, atomic_profile_js_1.throwAtomicUnsatisfied)(atomicProblems);
@@ -74553,6 +74972,7 @@ var require_with_coderifts = __commonJS({
       }
       if (input.executionGrant !== void 0) {
         guard.executionGrant = input.executionGrant;
+        Object.assign(guard, (0, execution_grant_js_1.resolveV2Fields)(input));
       }
       const strict = isEnforcingStrict(input);
       if (strict) {
@@ -75105,6 +75525,174 @@ var require_gemini = __commonJS({
   }
 });
 
+// node_modules/@coderifts/agent-guard/dist/cjs/adapters/vercel.js
+var require_vercel = __commonJS({
+  "node_modules/@coderifts/agent-guard/dist/cjs/adapters/vercel.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.protectedToolToVercel = protectedToolToVercel;
+    exports2.toVercelTools = toVercelTools;
+    exports2.withCodeRiftsVercel = withCodeRiftsVercel;
+    exports2.vercelToolAdapter = vercelToolAdapter;
+    exports2.defaultSerializeVercelToolResult = defaultSerializeVercelToolResult;
+    exports2.bindVercelGuardOutcome = bindVercelGuardOutcome;
+    var with_coderifts_js_1 = require_with_coderifts();
+    var execution_proof_js_1 = require_execution_proof();
+    var final_answer_proof_js_1 = require_final_answer_proof();
+    var gate_refusal_js_1 = require_gate_refusal();
+    var EMPTY_PARAMETERS = Object.freeze({
+      type: "object",
+      properties: {}
+    });
+    function looksLikeGuardOutcome(x) {
+      if (!x || typeof x !== "object")
+        return false;
+      const o = x;
+      return typeof o.executed === "boolean" && typeof o.executionAttempted === "boolean" && o.proof != null && typeof o.proof === "object" && o.verdict != null && typeof o.verdict === "object";
+    }
+    function toolCallIdFromOptions(options) {
+      if (options && typeof options.toolCallId === "string")
+        return options.toolCallId;
+      return "";
+    }
+    var FRESHNESS_NOT_CONFIGURED = Object.freeze({
+      wiring: "NOT_CONFIGURED",
+      write_style: false,
+      require_freshness: false
+    });
+    var CW_NOT_REPORTED = Object.freeze({
+      conditional_write: "not_reported",
+      require_conditional_write: false,
+      write_style: false,
+      mutating: false
+    });
+    function guardedNonOutcomeRefusal(toolName) {
+      const verdict = {
+        kind: "UNAVAILABLE",
+        cause: "CONFIG_ERROR",
+        failPolicy: "closed",
+        resolution: "CLOSED",
+        action: "STOP",
+        decisionMissing: true,
+        unavailableCount: 1
+      };
+      const commit_observation = {
+        status: "not_observed",
+        observed_at: (/* @__PURE__ */ new Date()).toISOString(),
+        host_attestation: "absent"
+      };
+      const proof = (0, execution_proof_js_1.buildExecutionProof)({
+        preflighted: false,
+        executionAttempted: false,
+        executed: false,
+        enforced: false,
+        verdict,
+        commitObservation: commit_observation
+      });
+      void toolName;
+      return {
+        executionAttempted: false,
+        executed: false,
+        enforced: false,
+        verdict,
+        preflighted: false,
+        proof,
+        freshness: FRESHNESS_NOT_CONFIGURED,
+        conditional_write: CW_NOT_REPORTED,
+        commit_observation
+      };
+    }
+    function protectedToolToVercel(tool) {
+      const parameters = tool.inputSchema != null && typeof tool.inputSchema === "object" && !Array.isArray(tool.inputSchema) ? tool.inputSchema : { ...EMPTY_PARAMETERS };
+      const execute = async (args, options) => {
+        const raw = await Promise.resolve().then(() => tool.execute(args));
+        const bindArgs = {
+          toolCallId: toolCallIdFromOptions(options),
+          toolName: tool.name
+        };
+        if (looksLikeGuardOutcome(raw)) {
+          return bindVercelGuardOutcome(raw, bindArgs).result;
+        }
+        if (tool._coderifts && tool._coderifts.guarded) {
+          return bindVercelGuardOutcome(guardedNonOutcomeRefusal(tool.name), bindArgs).result;
+        }
+        return raw;
+      };
+      const out = {
+        parameters,
+        execute
+      };
+      if (tool.description != null && tool.description !== "") {
+        out.description = tool.description;
+      }
+      return out;
+    }
+    function toVercelTools(protectedTools) {
+      const out = {};
+      for (const t of protectedTools) {
+        out[t.name] = protectedToolToVercel(t);
+      }
+      return out;
+    }
+    function withCodeRiftsVercel(input) {
+      const core = (0, with_coderifts_js_1.withCodeRifts)(input);
+      return vercelToolAdapter(core);
+    }
+    function vercelToolAdapter(result) {
+      const protected_tools = result.tools;
+      const tools = toVercelTools(protected_tools);
+      const out = {
+        tools,
+        protected_tools,
+        registry_report: result.registry_report,
+        composition_assurance: result.composition_assurance,
+        receipt_thread: result.receipt_thread,
+        coverage_observed: result.coverage_observed
+      };
+      if (result.repository !== void 0) {
+        out.repository = result.repository;
+      }
+      return out;
+    }
+    function defaultSerializeVercelToolResult(result) {
+      if (typeof result === "string")
+        return result;
+      if (typeof result === "number" || typeof result === "boolean" || typeof result === "bigint" || result === null || result === void 0) {
+        return String(result);
+      }
+      try {
+        return JSON.stringify(result);
+      } catch {
+        return String(result);
+      }
+    }
+    function bindVercelGuardOutcome(outcome, args) {
+      const toolCallId = args.toolCallId;
+      const serialize = args.serialize ?? defaultSerializeVercelToolResult;
+      let body;
+      if (outcome.executed === true) {
+        body = serialize(outcome.result);
+      } else if (outcome.executionAttempted === false) {
+        body = (0, gate_refusal_js_1.formatGateRefusalBody)(outcome);
+      } else {
+        const err = "error" in outcome ? outcome.error : void 0;
+        const kind = (0, gate_refusal_js_1.verdictKind)(outcome);
+        body = `Tool execution failed after gate decision (verdict: ${kind}): ${(0, gate_refusal_js_1.formatGuardError)(err)}`;
+      }
+      const result = args.attachProof === false ? body : (0, final_answer_proof_js_1.attachProofToAgentResponse)(body, outcome.proof);
+      const part = {
+        type: "tool-result",
+        toolCallId,
+        result
+      };
+      if (args.toolName != null && args.toolName !== "") {
+        part.toolName = args.toolName;
+      }
+      return part;
+    }
+  }
+});
+
 // node_modules/@coderifts/agent-guard/dist/cjs/execute-tool-call.js
 var require_execute_tool_call = __commonJS({
   "node_modules/@coderifts/agent-guard/dist/cjs/execute-tool-call.js"(exports2) {
@@ -75117,11 +75705,13 @@ var require_execute_tool_call = __commonJS({
     exports2.executeAnthropicToolCall = executeAnthropicToolCall;
     exports2.executeGeminiToolCall = executeGeminiToolCall;
     exports2.executeLangGraphToolCall = executeLangGraphToolCall;
+    exports2.executeVercelToolCall = executeVercelToolCall;
     var execution_proof_js_1 = require_execution_proof();
     var openai_js_1 = require_openai();
     var anthropic_js_1 = require_anthropic();
     var gemini_js_1 = require_gemini();
     var langgraph_js_1 = require_langgraph();
+    var vercel_js_1 = require_vercel();
     function resolveProtectedTools(table) {
       if (Array.isArray(table))
         return table;
@@ -75382,6 +75972,26 @@ var require_execute_tool_call = __commonJS({
       }
       return bound;
     }
+    async function executeVercelToolCall(args) {
+      const callArgs = parseMaybeJsonArgs(args.arguments);
+      const outcome = await executeProtectedTool(args.tools, args.name, callArgs);
+      const bound = (0, vercel_js_1.bindVercelGuardOutcome)(outcome, {
+        toolCallId: args.toolCallId,
+        toolName: args.name,
+        serialize: args.serialize
+      });
+      if (outcome.executionAttempted === false) {
+        const result = appendEnvelopeSurface(bound.result, outcome);
+        const part = {
+          type: "tool-result",
+          toolCallId: args.toolCallId,
+          toolName: args.name,
+          result
+        };
+        return part;
+      }
+      return bound;
+    }
     function parseMaybeJsonArgs(args) {
       if (typeof args === "string") {
         const s = args.trim();
@@ -75612,8 +76222,8 @@ var require_cjs4 = __commonJS({
     exports2.monitorAttestSigningInput = exports2.kidFromMonitoringAttestation = exports2.tryIssueMonitoringAttestation = exports2.DEFAULT_MONITORING_SINK_TIMEOUT_MS = exports2.ackBytes = exports2.verifyAckHmac = exports2.monitoringDeliveryFailClosed = exports2.formatMonitoringDeliveryLine = exports2.deliverMonitoring = exports2.hashObservedContent = exports2.observeCommit = exports2.deriveKeySignal = exports2.pathClass = exports2.classifyCommand = exports2.projectState = exports2.emptySessionState = exports2.computeTainted = exports2.evaluate = exports2.updateSession = exports2.SESSION_TAINT_VERSION = exports2.SessionTaintTracker = exports2.readDecision = exports2.EXECUTION_TIME_FP_REASONS = exports2.EXECUTION_STATE_UNMEASURABLE_NOTE = exports2.isUnmeasurableExecutionStateReason = exports2.computeCanonicalBundleFingerprint = exports2.authorizedFingerprintFromEnvelope = exports2.checkExecutionTimeFingerprint = exports2.computeBundleFingerprint = exports2.computeArtifactDigest = exports2.evaluateEnvelope = exports2.RECEIPT_PREV_NULL = exports2.decodeReceiptBodyPrev = exports2.previousReceiptCommitment = exports2.verifyReceiptChainLinkage = exports2.canonicalJson = exports2.computeBodyHash = exports2.bindReceiptToEnvelope = exports2.DETECTOR_VERSION = exports2.builtinDetector = exports2.resetPolicyWarnForTests = exports2.warnPolicyAbsentOnce = exports2.observePolicyPresence = exports2.detectPolicyPresence = exports2.policyPresenceOf = exports2.withPolicy = exports2.POLICY_ABSENT_WARN = exports2.POLICY_MARKER = exports2.CODERIFTS_POLICY = exports2.guardToolCall = void 0;
     exports2.createDbVersionToken = exports2.API_ABSENT_TOKEN = exports2.API_VERSION_TOKEN_PREFIX = exports2.apiTokenRaw = exports2.writeApiIfUnchanged = exports2.createApiVersionToken = exports2.identitiesEqual = exports2.fsObjectIdentity = exports2.UnsafeCasPathError = exports2.assertSafeCasPath = exports2.FS_ABSENT_TOKEN = exports2.FS_VERSION_TOKEN_PREFIX = exports2.fsTokenContentHash = exports2.createFsPriorContentResolver = exports2.writeFileIfUnchanged = exports2.readVersionedFile = exports2.createFsVersionToken = exports2.StaleVersionTokenAbort = exports2.executeIfUnchanged = exports2.RESIDUAL_UNCONDITIONAL_WRITE = exports2.conditionalWriteResidual = exports2.tokensEqual = exports2.buildConditionalWriteBasis = exports2.buildFreshnessBasis = exports2.collectFreshnessCallContext = exports2.artifactIdsForResolve = exports2.isMutatingCall = exports2.isWriteStyleCall = exports2.freshnessAllowsEnforce = exports2.computePathSetTreeHash = exports2.contentByteIdentical = exports2.assessWriteStylePrior = exports2.assessFreshness = exports2.deriveProofBanner = exports2.attachProofToAgentResponse = exports2.renderFinalAnswerProof = exports2.EXECUTION_PROOF_SPEC = exports2.assertEnforcedReceiptInvariant = exports2.hashExecutionResult = exports2.buildExecutionProof = exports2.COVERAGE_ATTEST_ENVELOPE_TAG = exports2.COVERAGE_ATTEST_SIGNING_PREFIX = exports2.COVERAGE_ATTEST_VERSION = exports2.coverageAttestSigningInput = exports2.kidFromCoverageAttestation = exports2.tryIssueCoverageAttestation = exports2.MONITOR_ATTEST_ENVELOPE_TAG = exports2.MONITOR_ATTEST_SIGNING_PREFIX = exports2.MONITOR_ATTEST_VERSION = exports2.receiptDigestOfToken = void 0;
     exports2.guardedFractionAmongRoutes = exports2.foldTableSettledCalls = exports2.withCodeRifts = exports2.AUTO_DERIVE_READ_TIMEOUT_MS = exports2.AUTO_DERIVE_SOURCE = exports2.defaultFsReader = exports2.normalizeAutoDerive = exports2.runAutoDerive = exports2.AUTO_RECHECK_MAX_CAP = exports2.clampMaxAttempts = exports2.normalizeAutoRecheck = exports2.runAutoRecheckLoop = exports2.coverageReport = exports2.DEPLOY_REPAIRABLE_REASONS = exports2.bindDeploy = exports2.verifyDeployReceiptToken = exports2.DEPLOY_RECEIPT_VIEW_SPEC = exports2.isVerifiedDeployReceiptView = exports2.asVerifiedDeployReceiptView = exports2.deployGate = exports2.gateDecision = exports2.RegistryConstructionError = exports2.guardToolRegistry = exports2.globToRegExp = exports2.matchGlob = exports2.blobMapKey = exports2.classifyByName = exports2.resolveArtifacts = exports2.REMEDIATION_LOOP_ATTESTATION_SPEC = exports2.isCasAttestation = exports2.readPriorBlockRemediation = exports2.readRemediationTransaction = exports2.buildRemediationLoopAttestation = exports2.COMMIT_EVIDENCE_MISSING = exports2.CAS_ATTESTATION_SPEC = exports2.strictCommitObservation = exports2.extractExecutorAttestationToken = exports2.evaluateCasEvidence = exports2.isExecuteIfUnchangedOutcome = exports2.isGuardExecutionProof = exports2.buildCasAttestation = exports2.REGISTRY_ABSENT_TOKEN = exports2.REGISTRY_VERSION_TOKEN_PREFIX = exports2.registryTokenRaw = exports2.writeRegistryIfUnchanged = exports2.createRegistryVersionToken = exports2.DB_ABSENT_TOKEN = exports2.DB_VERSION_TOKEN_PREFIX = exports2.dbTokenRaw = exports2.writeDbIfUnchanged = void 0;
-    exports2.executeAnthropicToolCall = exports2.executeOpenAIToolCall = exports2.executeProtectedTool = exports2.defaultSerializeGeminiToolResult = exports2.bindGeminiGuardOutcome = exports2.protectedToolToFunctionDeclaration = exports2.toGeminiTools = exports2.geminiToolAdapter = exports2.withCodeRiftsGemini = exports2.measureFsAuthorizationToken = exports2.measureFsAuthorization = exports2.wrapWriteWithFsCas = exports2.inferFullFileWriteContent = exports2.inferFsPathFromArgs = exports2.FRESHNESS_RESOLVER_FIX = exports2.freshnessRefusalTeaching = exports2.formatGateRefusalBody = exports2.defaultSerializeLangGraphToolResult = exports2.bindLangGraphGuardOutcome = exports2.LangGraphToolsNotStructuredError = exports2.isLangGraphReactAgentTool = exports2.bindLangGraphTools = exports2.protectedToolToLangGraph = exports2.toLangGraphTools = exports2.langGraphToolAdapter = exports2.withCodeRiftsLangGraph = exports2.defaultSerializeAnthropicToolResult = exports2.bindAnthropicGuardOutcome = exports2.protectedToolToAnthropic = exports2.toAnthropicTools = exports2.anthropicToolAdapter = exports2.withCodeRiftsAnthropic = exports2.defaultSerializeOpenAIToolResult = exports2.bindOpenAIGuardOutcome = exports2.protectedToolToOpenAI = exports2.toOpenAITools = exports2.openAIToolAdapter = exports2.withCodeRiftsOpenAI = exports2.formatCoverageObservedLine = exports2.freezeCoverageObserved = exports2.createCoverageObserver = exports2.readExecutionGrantToken = exports2.isExecutionGrantEnabled = exports2.isEnforcingAtomic = exports2.atomicOutcome = exports2.ATOMIC_PROFILE_UNSATISFIED = exports2.ATOMIC_INVARIANTS = exports2.createMutatorRegister = exports2.PROFILE_ENFORCING_ATOMIC_V1 = exports2.PROFILE_ENFORCING_STRICT_V1 = void 0;
-    exports2.kidFromToolsetAttestation = exports2.tryIssueToolsetAttestation = exports2.toolsetAttestSigningInput = exports2.declarationEntriesFromTools = exports2.computeToolsetDigest = exports2.TOOLSET_ATTEST_STATEMENT = exports2.TOOLSET_ATTEST_ENVELOPE_TAG = exports2.TOOLSET_ATTEST_SIGNING_PREFIX = exports2.TOOLSET_ATTEST_VERSION = exports2.surfaceEnvelopeFields = exports2.isGuardOutcome = exports2.executeLangGraphToolCall = exports2.executeGeminiToolCall = void 0;
+    exports2.withCodeRiftsGemini = exports2.measureFsAuthorizationToken = exports2.measureFsAuthorization = exports2.wrapWriteWithFsCas = exports2.inferFullFileWriteContent = exports2.inferFsPathFromArgs = exports2.FRESHNESS_RESOLVER_FIX = exports2.freshnessRefusalTeaching = exports2.formatGateRefusalBody = exports2.defaultSerializeLangGraphToolResult = exports2.bindLangGraphGuardOutcome = exports2.LangGraphToolsNotStructuredError = exports2.isLangGraphReactAgentTool = exports2.bindLangGraphTools = exports2.protectedToolToLangGraph = exports2.toLangGraphTools = exports2.langGraphToolAdapter = exports2.withCodeRiftsLangGraph = exports2.defaultSerializeAnthropicToolResult = exports2.bindAnthropicGuardOutcome = exports2.protectedToolToAnthropic = exports2.toAnthropicTools = exports2.anthropicToolAdapter = exports2.withCodeRiftsAnthropic = exports2.defaultSerializeOpenAIToolResult = exports2.bindOpenAIGuardOutcome = exports2.protectedToolToOpenAI = exports2.toOpenAITools = exports2.openAIToolAdapter = exports2.withCodeRiftsOpenAI = exports2.formatCoverageObservedLine = exports2.freezeCoverageObserved = exports2.createCoverageObserver = exports2.readExecutionGrantToken = exports2.isExecutionGrantEnabled = exports2.POSTURE_CLOCK_SKEW_TOLERANCE_MS = exports2.POSTURE_RECEIPT_V = exports2.verifyPostureReceipt = exports2.ATOMIC_V2_MAX_AGE_MS_CAP = exports2.CREDENTIAL_BOUNDARY_BARE_REJECTED = exports2.atomicConstructionProblems = exports2.isEnforcingAtomicV2 = exports2.PROFILE_ENFORCING_ATOMIC_V2 = exports2.isEnforcingAtomic = exports2.atomicOutcome = exports2.ATOMIC_PROFILE_UNSATISFIED = exports2.ATOMIC_INVARIANTS = exports2.createMutatorRegister = exports2.PROFILE_ENFORCING_ATOMIC_V1 = exports2.PROFILE_ENFORCING_STRICT_V1 = void 0;
+    exports2.kidFromToolsetAttestation = exports2.tryIssueToolsetAttestation = exports2.toolsetAttestSigningInput = exports2.declarationEntriesFromTools = exports2.computeToolsetDigest = exports2.TOOLSET_ATTEST_STATEMENT = exports2.TOOLSET_ATTEST_ENVELOPE_TAG = exports2.TOOLSET_ATTEST_SIGNING_PREFIX = exports2.TOOLSET_ATTEST_VERSION = exports2.surfaceEnvelopeFields = exports2.isGuardOutcome = exports2.executeVercelToolCall = exports2.executeLangGraphToolCall = exports2.executeGeminiToolCall = exports2.executeAnthropicToolCall = exports2.executeOpenAIToolCall = exports2.executeProtectedTool = exports2.defaultSerializeVercelToolResult = exports2.bindVercelGuardOutcome = exports2.protectedToolToVercel = exports2.toVercelTools = exports2.vercelToolAdapter = exports2.withCodeRiftsVercel = exports2.defaultSerializeGeminiToolResult = exports2.bindGeminiGuardOutcome = exports2.protectedToolToFunctionDeclaration = exports2.toGeminiTools = exports2.geminiToolAdapter = void 0;
     var guard_js_1 = require_guard();
     Object.defineProperty(exports2, "guardToolCall", { enumerable: true, get: function() {
       return guard_js_1.guardToolCall;
@@ -76120,6 +76730,31 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "isEnforcingAtomic", { enumerable: true, get: function() {
       return atomic_profile_js_1.isEnforcingAtomic;
     } });
+    Object.defineProperty(exports2, "PROFILE_ENFORCING_ATOMIC_V2", { enumerable: true, get: function() {
+      return atomic_profile_js_1.PROFILE_ENFORCING_ATOMIC_V2;
+    } });
+    Object.defineProperty(exports2, "isEnforcingAtomicV2", { enumerable: true, get: function() {
+      return atomic_profile_js_1.isEnforcingAtomicV2;
+    } });
+    Object.defineProperty(exports2, "atomicConstructionProblems", { enumerable: true, get: function() {
+      return atomic_profile_js_1.atomicConstructionProblems;
+    } });
+    Object.defineProperty(exports2, "CREDENTIAL_BOUNDARY_BARE_REJECTED", { enumerable: true, get: function() {
+      return atomic_profile_js_1.CREDENTIAL_BOUNDARY_BARE_REJECTED;
+    } });
+    Object.defineProperty(exports2, "ATOMIC_V2_MAX_AGE_MS_CAP", { enumerable: true, get: function() {
+      return atomic_profile_js_1.ATOMIC_V2_MAX_AGE_MS_CAP;
+    } });
+    var posture_receipt_js_1 = require_posture_receipt();
+    Object.defineProperty(exports2, "verifyPostureReceipt", { enumerable: true, get: function() {
+      return posture_receipt_js_1.verifyPostureReceipt;
+    } });
+    Object.defineProperty(exports2, "POSTURE_RECEIPT_V", { enumerable: true, get: function() {
+      return posture_receipt_js_1.POSTURE_RECEIPT_V;
+    } });
+    Object.defineProperty(exports2, "POSTURE_CLOCK_SKEW_TOLERANCE_MS", { enumerable: true, get: function() {
+      return posture_receipt_js_1.POSTURE_CLOCK_SKEW_TOLERANCE_MS;
+    } });
     var execution_grant_js_1 = require_execution_grant2();
     Object.defineProperty(exports2, "isExecutionGrantEnabled", { enumerable: true, get: function() {
       return execution_grant_js_1.isExecutionGrantEnabled;
@@ -76248,6 +76883,25 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "defaultSerializeGeminiToolResult", { enumerable: true, get: function() {
       return gemini_js_1.defaultSerializeGeminiToolResult;
     } });
+    var vercel_js_1 = require_vercel();
+    Object.defineProperty(exports2, "withCodeRiftsVercel", { enumerable: true, get: function() {
+      return vercel_js_1.withCodeRiftsVercel;
+    } });
+    Object.defineProperty(exports2, "vercelToolAdapter", { enumerable: true, get: function() {
+      return vercel_js_1.vercelToolAdapter;
+    } });
+    Object.defineProperty(exports2, "toVercelTools", { enumerable: true, get: function() {
+      return vercel_js_1.toVercelTools;
+    } });
+    Object.defineProperty(exports2, "protectedToolToVercel", { enumerable: true, get: function() {
+      return vercel_js_1.protectedToolToVercel;
+    } });
+    Object.defineProperty(exports2, "bindVercelGuardOutcome", { enumerable: true, get: function() {
+      return vercel_js_1.bindVercelGuardOutcome;
+    } });
+    Object.defineProperty(exports2, "defaultSerializeVercelToolResult", { enumerable: true, get: function() {
+      return vercel_js_1.defaultSerializeVercelToolResult;
+    } });
     var execute_tool_call_js_1 = require_execute_tool_call();
     Object.defineProperty(exports2, "executeProtectedTool", { enumerable: true, get: function() {
       return execute_tool_call_js_1.executeProtectedTool;
@@ -76264,6 +76918,9 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "executeLangGraphToolCall", { enumerable: true, get: function() {
       return execute_tool_call_js_1.executeLangGraphToolCall;
     } });
+    Object.defineProperty(exports2, "executeVercelToolCall", { enumerable: true, get: function() {
+      return execute_tool_call_js_1.executeVercelToolCall;
+    } });
     Object.defineProperty(exports2, "isGuardOutcome", { enumerable: true, get: function() {
       return execute_tool_call_js_1.isGuardOutcome;
     } });
@@ -76311,6 +76968,24 @@ var require_claude_hook = __commonJS({
     var { getApiKey } = require_config();
     var { cloudAuthorizePreflight } = require_cloud();
     var DEFAULT_SPEC_PATH = "api/openapi.yaml";
+    var DEFAULT_SPEC_GLOBS = Object.freeze([
+      "**/*openapi*.yaml",
+      "**/*openapi*.yml",
+      "**/*openapi*.json",
+      "**/*swagger*.yaml",
+      "**/*swagger*.yml",
+      "**/*swagger*.json",
+      "**/*asyncapi*.yaml",
+      "**/*asyncapi*.yml",
+      "**/*asyncapi*.json",
+      "**/*.graphql",
+      "**/*.gql",
+      "**/*.proto",
+      "**/*mcp*.json",
+      "**/*mcp*.yaml",
+      "**/*mcp*.yml",
+      "**/*tool-schema*.json"
+    ]);
     var CLOSED_ACTIONS = /* @__PURE__ */ new Set([
       "CONTINUE",
       "CONTINUE_WITH_MONITORING",
@@ -76320,8 +76995,9 @@ var require_claude_hook = __commonJS({
     var USAGE = [
       "Usage: coderifts claude-hook",
       "",
-      "Claude Code PreToolUse hook: gates Write|Edit|MultiEdit when they touch the",
-      "configured contract spec path. Reads JSON context from STDIN.",
+      "Claude Code PreToolUse hook: gates Write|Edit|MultiEdit when they touch a",
+      "governed contract path (default family + git config coderifts.specPath).",
+      "Reads JSON context from STDIN.",
       "",
       "Exit map (Claude Code semantics \u2014 get this exactly right):",
       "  2  BLOCK \u2014 tool call cancelled (BLOCK/STOP, REQUEST_APPROVAL, unrecognised action,",
@@ -76336,7 +77012,7 @@ var require_claude_hook = __commonJS({
       "Parse-gap DEFAULT (exit 2): unparseable stdin / missing file_path \u2014 refusing (fail-closed);",
       "  set CODERIFTS_ADVISORY=1 to soften. JSONL hook_blocked cause stdin_unparseable|missing_file_path.",
       "",
-      "Still exit 0 (nothing to govern): non-spec path, identical content, non-governed tool.",
+      "Still exit 0 (nothing to govern): not-governed path (one stderr line), identical content, non-governed tool.",
       "",
       "CONTINUE_WITH_MONITORING: allow only if the host asserts a sink",
       "  (CODERIFTS_MONITORING_SINK_WIRED=1|true or git config coderifts.monitoringSinkWired).",
@@ -76344,8 +77020,11 @@ var require_claude_hook = __commonJS({
       "",
       "CODERIFTS_STRICT=1|true: same fail-closed as default; cannot be weakened by ADVISORY.",
       "",
-      "Spec path (same source as git pre-push hook):",
-      "  git config coderifts.specPath  (default: api/openapi.yaml)",
+      "Governed paths (additive; configuring one path never drops the defaults):",
+      "  default family: OpenAPI/Swagger, GraphQL, *.proto, AsyncAPI, MCP manifest, tool-schema.json",
+      "  git config --add coderifts.specPath <path-or-glob>     # extra includes",
+      "  git config --add coderifts.specPathExclude <path-or-glob>  # opt out one path",
+      "  Not-governed path: exit 0 and one stderr line `coderifts claude-hook: not governed: <path>`.",
       "",
       "Baseline at PreToolUse: before = current file on disk (pre-edit state \u2014 the tool has",
       "not written yet). after = proposed content from tool_input (Write: content; Edit/MultiEdit:",
@@ -76473,10 +77152,41 @@ var require_claude_hook = __commonJS({
       return readGitConfig("coderifts.apiKey", deps);
     }
     function resolveSpecPath(deps = {}) {
+      const extras = readGitConfigAll("coderifts.specPath", deps);
+      if (extras.length) return extras[0];
       const fromGit = readGitConfig("coderifts.specPath", deps);
-      if (fromGit) return fromGit;
+      if (fromGit) return splitConfigValues(fromGit)[0] || DEFAULT_SPEC_PATH;
       return DEFAULT_SPEC_PATH;
     }
+    function splitConfigValues(raw) {
+      return String(raw || "").split(/[\n,]/).map((s) => s.trim()).filter(Boolean);
+    }
+    function readGitConfigAll(key, deps = {}) {
+      if (typeof deps.readGitConfigAll === "function") {
+        const v = deps.readGitConfigAll(key);
+        if (Array.isArray(v)) return v.flatMap(splitConfigValues);
+        return splitConfigValues(v);
+      }
+      const run = deps.execSync || execSync;
+      const cwd = deps.cwd || process.cwd();
+      try {
+        const v = run(`git config --get-all ${key}`, {
+          encoding: "utf8",
+          cwd,
+          stdio: ["ignore", "pipe", "pipe"]
+        });
+        return splitConfigValues(v);
+      } catch {
+        const one = readGitConfig(key, deps);
+        return one ? splitConfigValues(one) : [];
+      }
+    }
+    function resolveSpecIncludes(deps = {}) {
+      return readGitConfigAll("coderifts.specPath", deps);
+    }
+    function resolveSpecExcludes(deps = {}) {
+      return readGitConfigAll("coderifts.specPathExclude", deps);
+    }
     var GOVERNED_TOOLS = /* @__PURE__ */ new Set(["write", "edit", "multiedit", "multi_edit"]);
     function isGovernedTool(name) {
       return GOVERNED_TOOLS.has(String(name || "").toLowerCase());
@@ -76551,6 +77261,75 @@ var require_claude_hook = __commonJS({
       }
       return false;
     }
+    function globToRegExp(pattern) {
+      const src = String(pattern).replace(/\\/g, "/");
+      let out = "^";
+      for (let i = 0; i < src.length; ) {
+        if (src[i] === "*" && src[i + 1] === "*") {
+          if (src[i + 2] === "/") {
+            out += "(?:.*/)?";
+            i += 3;
+          } else {
+            out += ".*";
+            i += 2;
+          }
+        } else if (src[i] === "*") {
+          out += "[^/]*";
+          i += 1;
+        } else if (src[i] === "?") {
+          out += "[^/]";
+          i += 1;
+        } else {
+          out += src[i].replace(/[.+^${}()|[\]\\]/g, "\\$&");
+          i += 1;
+        }
+      }
+      out += "$";
+      return new RegExp(out, "i");
+    }
+    function matchGlob(pattern, value) {
+      if (!pattern || value == null) return false;
+      return globToRegExp(pattern).test(String(value).replace(/\\/g, "/"));
+    }
+    function normalizeToolPath(filePath, cwd) {
+      let p = String(filePath || "").replace(/\\/g, "/");
+      while (p.startsWith("./")) p = p.slice(2);
+      const root = String(cwd || "").replace(/\\/g, "/").replace(/\/$/, "");
+      if (root && (p === root || p.startsWith(`${root}/`))) {
+        p = p.slice(root.length).replace(/^\//, "");
+      }
+      return p;
+    }
+    function isDetectorsExcludedDir(rel) {
+      const s = `/${String(rel).replace(/\\/g, "/").toLowerCase()}/`;
+      return s.includes("/node_modules/") || s.includes("/vendor/");
+    }
+    function patternLooksLikeGlob(pattern) {
+      return /[*?]/.test(String(pattern || ""));
+    }
+    function matchesPattern(filePath, rel, pattern) {
+      if (!pattern) return false;
+      if (patternLooksLikeGlob(pattern)) {
+        return matchGlob(pattern, rel) || matchGlob(pattern, filePath);
+      }
+      return isSpecPath(filePath, pattern) || isSpecPath(rel, pattern);
+    }
+    function matchesAnyPattern(filePath, rel, patterns) {
+      for (const p of patterns || []) {
+        if (matchesPattern(filePath, rel, p)) return true;
+      }
+      return false;
+    }
+    function isGovernedPath(filePath, deps = {}) {
+      if (!filePath) return false;
+      const rel = normalizeToolPath(filePath, deps.cwd);
+      const extras = resolveSpecIncludes(deps);
+      const excludes = resolveSpecExcludes(deps);
+      if (matchesAnyPattern(filePath, rel, excludes)) return false;
+      if (matchesAnyPattern(filePath, rel, extras)) return true;
+      if (isDetectorsExcludedDir(rel)) return false;
+      return DEFAULT_SPEC_GLOBS.some((g) => matchGlob(g, rel) || matchGlob(g, String(filePath).replace(/\\/g, "/")));
+    }
     function deriveAfterContent(toolName, toolInput, diskBefore) {
       const name = String(toolName || "").toLowerCase();
       if (name === "write") {
@@ -76779,8 +77558,9 @@ var require_claude_hook = __commonJS({
         return emitTerminal({ exitCode: 2, reason: "missing_file_path" });
       }
       filePathKnown = filePath;
-      const specPath = resolveSpecPath({ ...deps, cwd });
-      if (!isSpecPath(filePath, specPath)) {
+      if (!isGovernedPath(filePath, { ...deps, cwd })) {
+        const rel = normalizeToolPath(filePath, cwd);
+        errLog(`coderifts claude-hook: not governed: ${rel || filePath}`);
         logEv({ type: "detection_skip", signals: ["not_spec_path"], tool, path: filePath });
         return emitTerminal({ exitCode: 0, reason: "not_spec_path" });
       }
@@ -76961,12 +77741,18 @@ var require_claude_hook = __commonJS({
       isGovernedTool,
       coerceToolInput,
       isSpecPath,
+      isGovernedPath,
+      matchGlob,
+      normalizeToolPath,
       deriveAfterContent,
       mapDecisionSeverity,
       renderDecisionWhy,
       resolveApiKey,
       resolveSpecPath,
+      resolveSpecIncludes,
+      resolveSpecExcludes,
       readGitConfig,
+      readGitConfigAll,
       isEnvFlag,
       isStrictMode,
       isAdvisoryMode,
@@ -76974,6 +77760,7 @@ var require_claude_hook = __commonJS({
       failClosedOrAdvisory,
       softOrStrictBlock,
       DEFAULT_SPEC_PATH,
+      DEFAULT_SPEC_GLOBS,
       CLOSED_ACTIONS,
       USAGE,
       appendGuardEventLog,
@@ -158775,7 +159562,7 @@ var require_rateLimit = __commonJS({
     var ipDailyStore = /* @__PURE__ */ new Map();
     var apiKeyMinuteStore = /* @__PURE__ */ new Map();
     var ipAgentMinuteStore = /* @__PURE__ */ new Map();
-    var AGENT_PUBLIC_ENDPOINTS = ["/api/v1/demo", "/api/v1/public/preflight", "/api/v1/public/actionguard-check", "/api/v1/public/migraguard-check", "/api/v1/badge/agent-readiness"];
+    var AGENT_PUBLIC_ENDPOINTS = ["/api/v1/demo", "/api/v1/public/preflight", "/api/v1/public/actionguard-check", "/api/v1/public/migraguard-check", "/api/v1/badge/agent-readiness", "/snippets"];
     var AGENT_IP_MINUTE_LIMIT = 60;
     var ANONYMOUS_DAILY_LIMIT = 50;
     var API_KEY_MINUTE_LIMIT = 100;
@@ -201561,7 +202348,120 @@ var require_asyncapi_diff = __commonJS({
           channels[channelName] = { operations };
         }
       }
-      return { channels };
+      return { channels, root: parsed };
+    }
+    function stillHasRef(node) {
+      return !!(node && typeof node === "object" && typeof node.$ref === "string" && !node.properties);
+    }
+    function comparePayload(basePayload, headPayload, pathPrefix, messageId, baseRoot, headRoot, addBreakingChange, addNonBreakingChange) {
+      const baseResolved = resolveLocalRef(baseRoot, basePayload, []);
+      const headResolved = resolveLocalRef(headRoot, headPayload, []);
+      if (stillHasRef(baseResolved) || stillHasRef(headResolved)) {
+        const ref = stillHasRef(baseResolved) && baseResolved.$ref || stillHasRef(headResolved) && headResolved.$ref || "";
+        addNonBreakingChange(
+          "PAYLOAD_REF_UNCOMPARED",
+          pathPrefix,
+          `Payload at '${pathPrefix}' uses unresolved $ref '${ref}' and was not compared.`
+        );
+        return;
+      }
+      if (!baseResolved || !headResolved || typeof baseResolved !== "object" || typeof headResolved !== "object") {
+        return;
+      }
+      const baseProps = baseResolved.properties || {};
+      const headProps = headResolved.properties || {};
+      const baseReq = new Set(Array.isArray(baseResolved.required) ? baseResolved.required : []);
+      const headReq = new Set(Array.isArray(headResolved.required) ? headResolved.required : []);
+      for (const fieldName of headReq) {
+        if (baseReq.has(fieldName)) continue;
+        if (baseProps[fieldName]) {
+          addBreakingChange(
+            "PAYLOAD_FIELD_NOW_REQUIRED",
+            `${pathPrefix}.${fieldName}`,
+            `Payload field '${fieldName}' in message '${messageId}' changed from optional to required.`
+          );
+        } else {
+          addBreakingChange(
+            "REQUIRED_PAYLOAD_FIELD_ADDED",
+            `${pathPrefix}.${fieldName}`,
+            `Required payload field '${fieldName}' was added to message '${messageId}'.`
+          );
+        }
+      }
+      for (const fieldName of baseReq) {
+        if (!headReq.has(fieldName) && headProps[fieldName]) {
+          addNonBreakingChange(
+            "PAYLOAD_FIELD_NOW_OPTIONAL",
+            `${pathPrefix}.${fieldName}`,
+            `Payload field '${fieldName}' in message '${messageId}' changed from required to optional.`
+          );
+        }
+      }
+      for (const fieldName in baseProps) {
+        const baseField = resolveLocalRef(baseRoot, baseProps[fieldName], []);
+        const headFieldRaw = headProps[fieldName];
+        if (!headFieldRaw) {
+          addBreakingChange(
+            "PAYLOAD_FIELD_REMOVED",
+            `${pathPrefix}.${fieldName}`,
+            `Payload field '${fieldName}' was removed from message '${messageId}'.`
+          );
+          continue;
+        }
+        const headField = resolveLocalRef(headRoot, headFieldRaw, []);
+        if (stillHasRef(baseField) || stillHasRef(headField)) {
+          const ref = stillHasRef(baseField) && baseField.$ref || stillHasRef(headField) && headField.$ref || "";
+          addNonBreakingChange(
+            "PAYLOAD_REF_UNCOMPARED",
+            `${pathPrefix}.${fieldName}`,
+            `Payload field '${fieldName}' in message '${messageId}' uses unresolved $ref '${ref}' and was not compared.`
+          );
+          continue;
+        }
+        if (baseField && headField && baseField.type !== headField.type) {
+          addBreakingChange(
+            "PAYLOAD_FIELD_TYPE_CHANGED",
+            `${pathPrefix}.${fieldName}`,
+            `Payload field '${fieldName}' in message '${messageId}' changed type from '${baseField.type}' to '${headField.type}'.`
+          );
+          continue;
+        }
+        if (baseField && headField && Array.isArray(baseField.enum) && Array.isArray(headField.enum)) {
+          for (const val of baseField.enum) {
+            if (!headField.enum.includes(val)) {
+              addBreakingChange(
+                "ENUM_VALUE_REMOVED",
+                `${pathPrefix}.${fieldName}.${val}`,
+                `Enum value '${val}' was removed from field '${fieldName}' in message '${messageId}'.`
+              );
+            }
+          }
+          for (const val of headField.enum) {
+            if (!baseField.enum.includes(val)) {
+              addNonBreakingChange(
+                "ENUM_VALUE_ADDED",
+                `${pathPrefix}.${fieldName}.${val}`,
+                `New enum value '${val}' was added to field '${fieldName}' in message '${messageId}'.`
+              );
+            }
+          }
+        }
+        if (baseField && headField && (baseField.properties || headField.properties || baseField.type === "object" || headField.type === "object")) {
+          comparePayload(baseField, headField, `${pathPrefix}.${fieldName}`, messageId, baseRoot, headRoot, addBreakingChange, addNonBreakingChange);
+        }
+      }
+      for (const fieldName in headProps) {
+        if (!baseProps[fieldName]) {
+          const addedIsRequired = headReq.has(fieldName);
+          if (!addedIsRequired) {
+            addNonBreakingChange(
+              "PAYLOAD_FIELD_ADDED",
+              `${pathPrefix}.${fieldName}`,
+              `New optional payload field '${fieldName}' was added to message '${messageId}'.`
+            );
+          }
+        }
+      }
     }
     function diffAsyncAPISchemas(base_schema_content, head_schema_content) {
       const base = parseAsyncAPI(base_schema_content);
@@ -201601,42 +202501,17 @@ var require_asyncapi_diff = __commonJS({
             }
             const basePayload = baseMessage.payload;
             const headPayload = headMessage.payload;
-            if (basePayload && headPayload && basePayload.properties && headPayload.properties) {
-              for (const fieldName in basePayload.properties) {
-                const baseField = basePayload.properties[fieldName];
-                const headField = headPayload.properties[fieldName];
-                if (!headField) {
-                  addBreakingChange("PAYLOAD_FIELD_REMOVED", `${channelName}.${opType}.${messageId}.${fieldName}`, `Payload field '${fieldName}' was removed from message '${messageId}'.`);
-                } else if (baseField.type !== headField.type) {
-                  addBreakingChange("PAYLOAD_FIELD_TYPE_CHANGED", `${channelName}.${opType}.${messageId}.${fieldName}`, `Payload field '${fieldName}' in message '${messageId}' changed type from '${baseField.type}' to '${headField.type}'.`);
-                } else if (Array.isArray(baseField.enum) && Array.isArray(headField.enum)) {
-                  for (const val of baseField.enum) {
-                    if (!headField.enum.includes(val)) {
-                      addBreakingChange("ENUM_VALUE_REMOVED", `${channelName}.${opType}.${messageId}.${fieldName}.${val}`, `Enum value '${val}' was removed from field '${fieldName}' in message '${messageId}'.`);
-                    }
-                  }
-                  for (const val of headField.enum) {
-                    if (!baseField.enum.includes(val)) {
-                      addNonBreakingChange("ENUM_VALUE_ADDED", `${channelName}.${opType}.${messageId}.${fieldName}.${val}`, `New enum value '${val}' was added to field '${fieldName}' in message '${messageId}'.`);
-                    }
-                  }
-                }
-              }
-              for (const fieldName in headPayload.properties) {
-                if (!basePayload.properties[fieldName]) {
-                  const addedIsRequired = Array.isArray(headPayload.required) && headPayload.required.includes(fieldName);
-                  if (!addedIsRequired) {
-                    addNonBreakingChange("PAYLOAD_FIELD_ADDED", `${channelName}.${opType}.${messageId}.${fieldName}`, `New optional payload field '${fieldName}' was added to message '${messageId}'.`);
-                  }
-                }
-              }
-              if (headPayload.required && Array.isArray(headPayload.required)) {
-                for (const requiredField of headPayload.required) {
-                  if (!basePayload.required || !basePayload.required.includes(requiredField)) {
-                    addBreakingChange("REQUIRED_PAYLOAD_FIELD_ADDED", `${channelName}.${opType}.${messageId}.${requiredField}`, `Required payload field '${requiredField}' was added to message '${messageId}'.`);
-                  }
-                }
-              }
+            if (basePayload && headPayload) {
+              comparePayload(
+                basePayload,
+                headPayload,
+                `${channelName}.${opType}.${messageId}`,
+                messageId,
+                base.root,
+                head.root,
+                addBreakingChange,
+                addNonBreakingChange
+              );
             }
           }
           for (const messageId in headOperation.messages) {
@@ -202829,6 +203704,7 @@ var require_response_envelope = __commonJS({
         return response;
       }
       response.control_envelope = buildControlEnvelope(response, authzContext);
+      if (isCoverageFailClosed(response)) response.safe_for_agent = false;
       response.analysis = buildAnalysisTier(response);
       try {
         response.analysis.remediations = buildRemediations(response);
@@ -220480,6 +221356,15 @@ var require_persist_decision = __commonJS({
         return null;
       }
     }
+    function persistMeta(decisionId) {
+      if (typeof decisionId === "string" && decisionId.length > 0) {
+        return { stored: true };
+      }
+      return {
+        stored: false,
+        reason: persistenceEnabled() ? "storage_unavailable" : "persistence_disabled"
+      };
+    }
     var AFTER_HEX_RE = /^[0-9a-f]{64}$/;
     function normalizeAfterHex(raw) {
       if (raw == null) return "";
@@ -220862,6 +221747,8 @@ var require_persist_decision = __commonJS({
     }
     module2.exports = {
       persistDecision,
+      persistMeta,
+      persistenceEnabled,
       persistAuthorizedPaths,
       findDecisionsByAfterHash,
       getAuthorizedPathsCollectingSince,
@@ -223317,82 +224204,7 @@ var require_mcp_streamable = __commonJS({
       });
       next();
     });
-    var DESC_PREFLIGHT_CHANGE_SET = `Preflight a COMPLETE base\u2192head change set of contract artifacts and return
-risk score and breaking-change analysis \u2014 plus, on the AUTHORIZE path only, a governance decision
-(ALLOW / WARN / REQUIRE_APPROVAL / BLOCK) and a signed chain-receipt when applicable. ANALYZE
-returns informational risk only: analysis_outcome, may_execute:false, no decision, no receipt.
-
-Requires a pending base\u2192head (before/after) contract change you are about to
-act on (merge, deploy, publish, or register tools). No pending change set \u2192
-do not call this tool.
-
-Use this when:
-- You are about to merge, push, deploy, publish, or register/expose agent tools,
-  AND the change includes \u22651 contract artifact (OpenAPI/Swagger, GraphQL SDL,
-  gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas: type=agent_tools,
-  including before re-registering tools with a runtime).
-- You have (or can assemble) FULL base and head for every changed contract
-  artifact in this set \u2014 not a single-file subset when other contract files also
-  change.
-- You need a NEW decision for the CURRENT change; you do not already hold a
-  currently-valid receipt for this exact target/operation.
-- You hold a receipt for a different operation or target than the act you will
-  perform (e.g. ALLOW for merge, now deploying). A receipt authorizes ONE
-  operation: a merge receipt does not authorize a deploy. Run a NEW preflight
-  with context.operation set to that operation (deploy, publish); a
-  differently-scoped receipt is not reusable authorization and will fail at
-  the gate.
-
-Do not use when:
-- The change is documentation-only (README, guides, comments) with no contract
-  artifact content change \u2014 do not call any CodeRifts tool.
-- You already hold a signed receipt and only need to check it is authentic and
-  currently valid \u2014 use coderifts.verify_receipt instead.
-- You need details of a PREVIOUS decision by decision_id \u2014 use
-  coderifts.get_decision_details instead.
-- You want a static 0\u2013100 "agent readiness" score for one OpenAPI/MCP file and
-  there is no pending base\u2192head mutate \u2014 use coderifts.agent_readiness_score
-  (advanced / opt-in; not one of the three default tools). If that tool is not
-  in your available list, call none of the CodeRifts tools; do not substitute
-  preflight_change_set.
-- You cannot supply both before and after (or base and head) for the artifacts
-  that change \u2014 fix the change set first; do not invent empty before specs.
-
-Inputs: list of artifacts, each with type, before, after (or equivalent), plus
-optional operation (merge|deploy|tool_call|publish), environment/stakes, and
-context. Opt-in derivation:"server" (proven tenant\u2194repo binding + context.repository
-+ base + head): omit artifacts[] \u2014 the server lists the contract-class set via the
-SCM provider for the proven binding (GitHub App Compare, or GitLab/Bitbucket Compare
-with a per-request X-Coderifts-Scm-Token, never stored; completeness_mode
-SERVER_DERIVED). Default (flag absent) is unchanged. Returns decision,
-execution_action, risk fields, and chain_receipt when issued.
-
-CHANGE SOURCE \u2014 EXACTLY ONE, ENFORCED AT THE ROUTE (400), NOT BY THIS SCHEMA.
-Supply either artifacts[] OR derivation:"server". All three of these are rejected
-with HTTP 400 INVALID_INPUT, on analyze and on authorize alike:
-  \u2022 neither artifacts[] nor derivation      \u2192 "artifacts must be a non-empty array"
-  \u2022 authorize with context.operation but no change source \u2192 same 400
-  \u2022 artifacts[] together with derivation:"server" \u2192 "derivation:"server" forbids
-    caller-supplied artifacts[] \u2014 one source of truth per request"
-This constraint is NOT expressible in the schema you are reading: a top-level
-oneOf/allOf union is rejected by at least one major MCP client (measured), so the
-schema stays permissive and the route is the enforcement point. Do not read schema
-acceptance as request validity \u2014 verified live against these exact three shapes on
-2026-08-26, over REST and over MCP tools/call (isError:true on all three).
-
-Mode (required): pass preflight_mode. Use "analyze" for informational risk only
-(returns analysis_outcome with may_execute:false, no decision/execution_action/
-safe_for_agent, no receipt). Use "authorize" for the operation-bound path that can
-mint a receipt (requires context.operation: merge|deploy|publish|tool_call). Under
-Decision Spec 2.0 the mode is mandatory; omission is an error unless a legacy
-decision_spec_version "1.0" pin is set.
-
-Branch on execution_action only (CONTINUE | CONTINUE_WITH_MONITORING | REQUEST_APPROVAL | STOP).
-On non-CONTINUE authorize responses, control_envelope.next_agent_step is a structured
-remediation SUGGESTION the agent MAY follow (action, reason, resume_condition, then_call).
-It is NOT permission and NOT a control-flow override \u2014 still branch on execution_action.
-On CONTINUE / CONTINUE_WITH_MONITORING, next_agent_step is null (no remediation step).
-Human tier remains human_report.next_steps_prose (same source; prose, not machine).`;
+    var DESC_PREFLIGHT_CHANGE_SET = "Use this when: a change set of contract artifacts modifies OpenAPI, GraphQL, protobuf, AsyncAPI, MCP manifests, or agent tool schemas before merge, deploy, publish, or tool registration. Do not call for documentation-only changes, static readiness scoring, or receipt verification. Use analyze for risk only; authorize requires context.operation for permission. For receipt verification use coderifts.verify_receipt instead; for details of a past decision use coderifts.get_decision_details instead.";
     var DESC_VERIFY_RECEIPT = `Verify a CodeRifts signed chain-receipt you ALREADY HOLD: cryptographic
 authenticity (signature + key id), body binding, and \u2014 when lifecycle indices
 are available \u2014 whether it is currently valid authorization (not expired,
@@ -223725,7 +224537,11 @@ next_agent_step is a suggestion, not permission.`;
               }
             }
           },
-          annotations: { readOnlyHint: true, openWorldHint: false }
+          // Authorize CREATES an authorization (receipt / grant). readOnlyHint:true over-stated
+          // the mixed tool (roadmap 1212). Analyze is still informational (no receipt) — that
+          // is the mode, not this annotation. Split into two tools is deferred: then_call in
+          // response-envelope.js still names preflight_change_set, and the canonical set is 3.
+          annotations: { readOnlyHint: false, openWorldHint: false }
         },
         {
           name: "get_decision_details",
@@ -224255,9 +225071,9 @@ var require_generate_surface_anchor = __commonJS({
     var OUT = path.join(__dirname, "..", "src", "generated", "surface-anchor.json");
     var ENDPOINT = "https://app.coderifts.com/mcp";
     var VOLATILE_KEYS = Object.freeze([]);
-    var SOURCE_REF = "https://raw.githubusercontent.com/coderifts/api-governance/surface-db5cea2f/tools.wire.v1.json";
-    var SOURCE_REF_COMMIT = "95999b6553c1f91ed9fd140f60440ee3e1f0dcd6";
-    var SOURCE_REF_STATUS = `PINNED TO ONE REVISION. source_ref is the wire-format tools[] as served, published in the public coderifts/api-governance repo at tag surface-db5cea2f (commit ${SOURCE_REF_COMMIT}). Verified at fill time: the file's own tools_sha256, its tools[] recomputed under the canonical rule in digest_input, and this anchor's tools_sha256 are the same value. HOW TO USE IT: fetch it, recompute the digest yourself, and compare it to tools_sha256 here. IF THEY DIFFER, TRUST NEITHER -- it means the surface moved and this ref was not re-tagged. A tag can be force-moved; the commit SHA above cannot, so pin the SHA URL if you want the stronger form. OUR OBLIGATION: every surface change requires a NEW tag and a NEW source_ref in this file. Skipping that leaves this field pointing at an old surface while still looking authoritative, which is worse than the null it replaced. HOW THE OBLIGATION IS ENFORCED, on both sides: this repo CI-runs generate-surface-anchor.js --check --verify-source-ref, which fetches the ref above, recomputes its digest under the rule in digest_input, and FAILS if it is stale, self-inconsistent, or its tag is gone. The target repo runs scripts/validate-tools-wire.mjs from its own npm test and a CI workflow -- on push, on PR, and daily, because the wire target can go stale without anything in that repo changing. Both SKIP LOUDLY rather than fail on a transport error, and both treat a 404 as a real verdict rather than a network problem. Neither this ref nor those gates is a root of trust: pin the digest at YOUR approval time -- see honesty.pin_at_approval_time.`;
+    var SOURCE_REF = "https://raw.githubusercontent.com/coderifts/api-governance/surface-c3ec5f69/tools.wire.v1.json";
+    var SOURCE_REF_COMMIT = "2496038c4bca672e0e9730a8de92db34d0556bb5";
+    var SOURCE_REF_STATUS = `PINNED TO ONE REVISION. source_ref is the wire-format tools[] as served, published in the public coderifts/api-governance repo at tag surface-c3ec5f69 (commit ${SOURCE_REF_COMMIT}). Verified at fill time: the file's own tools_sha256, its tools[] recomputed under the canonical rule in digest_input, and this anchor's tools_sha256 are the same value. HOW TO USE IT: fetch it, recompute the digest yourself, and compare it to tools_sha256 here. IF THEY DIFFER, TRUST NEITHER -- it means the surface moved and this ref was not re-tagged. A tag can be force-moved; the commit SHA above cannot, so pin the SHA URL if you want the stronger form. OUR OBLIGATION: every surface change requires a NEW tag and a NEW source_ref in this file. Skipping that leaves this field pointing at an old surface while still looking authoritative, which is worse than the null it replaced. HOW THE OBLIGATION IS ENFORCED, on both sides: this repo CI-runs generate-surface-anchor.js --check --verify-source-ref, which fetches the ref above, recomputes its digest under the rule in digest_input, and FAILS if it is stale, self-inconsistent, or its tag is gone. The target repo runs scripts/validate-tools-wire.mjs from its own npm test and a CI workflow -- on push, on PR, and daily, because the wire target can go stale without anything in that repo changing. Both SKIP LOUDLY rather than fail on a transport error, and both treat a 404 as a real verdict rather than a network problem. Neither this ref nor those gates is a root of trust: pin the digest at YOUR approval time -- see honesty.pin_at_approval_time.`;
     var HONESTY = Object.freeze({
       pins_bytes_not_behaviour: "This anchor pins BYTES, not behaviour. It says the tool text you received is the text that was published. It says nothing about whether the model read it, understood it, or obeyed it.",
       scoped_to_its_profile: "This digest is scoped to the profile named above and to nothing else. The default-profile digest says NOTHING about the surface served with include_advanced_tools, which is a different tool set with a different digest. A hash without its profile does not identify a surface.",
@@ -224885,6 +225701,41 @@ var require_decision_result = __commonJS({
     function envelopeSafeForAgent(decision) {
       return decision === "ALLOW" || decision === "WARN";
     }
+    var SAFE_FOR_AGENT_SEMANTICS = Object.freeze({
+      "decision_result.safe_for_agent": Object.freeze({
+        question: "is the verdict ALLOW/WARN?",
+        kind: "verdict",
+        forced_false_by: Object.freeze([])
+      }),
+      safe_for_agent: Object.freeze({
+        question: "is it actually safe to proceed?",
+        kind: "defense_in_depth",
+        note: "1227: the most-read (flat) field is now defense-in-depth, same as control_envelope. A naive agent reading it must not proceed on a coverage-gapped ALLOW. The raw verdict stays on decision_result \u2014 no information lost.",
+        forced_false_by: Object.freeze([
+          "decision BLOCK",
+          "decision REQUIRE_APPROVAL",
+          "degraded",
+          "coverage_gap",
+          "fallback_reason",
+          "coverage_gap rule_id",
+          "webhook_surface_unanalyzed"
+        ])
+      }),
+      "control_envelope.safe_for_agent": Object.freeze({
+        question: "is it actually safe to proceed?",
+        kind: "defense_in_depth",
+        note: "the verdict AND the coverage check; this is the field to gate on",
+        forced_false_by: Object.freeze([
+          "degraded",
+          "coverage_gap",
+          "fallback_reason",
+          "coverage_gap rule_id",
+          "webhook_surface_unanalyzed"
+        ])
+      }),
+      invariant: "safe_for_agent == control_envelope.safe_for_agent <= decision_result.safe_for_agent",
+      invariant_means: "defense-in-depth only tightens: true may become false, false never becomes true. The flat field equals control_envelope (1227)."
+    });
     function mapSeverity(sev) {
       const up = String(sev || "").toUpperCase();
       return EVIDENCE_SEVERITIES.includes(up) ? up : "MEDIUM";
@@ -225251,6 +226102,7 @@ var require_decision_result = __commonJS({
     module2.exports = {
       buildDecisionResultV1,
       envelopeSafeForAgent,
+      SAFE_FOR_AGENT_SEMANTICS,
       proseToType,
       toUtcSeconds,
       computeBodyHash,
@@ -227107,10 +227959,10 @@ var require_gate_pin = __commonJS({
   "src/generated/gate-pin.json"(exports2, module2) {
     module2.exports = {
       repo: "coderifts/contract-gate",
-      sha: "e5b6315e38c66a2274583ddf4d7be11515180326",
-      tag: "v0.5.0",
+      sha: "90de4be6641bbbc76b647d55bdec1e9019fd1d20",
+      tag: "v0.7.0",
       resolved_from: "https://github.com/coderifts/contract-gate refs/tags/v0",
-      resolved_at: "2026-08-26T08:37:01Z",
+      resolved_at: "2026-09-01T13:10:37Z",
       note: "STRICT template pins this full commit SHA (GitHub: only a full SHA is immutable). v0 is a tag we move on every release, so it is NOT a pin. Re-run scripts/generate-gate-pin.js on each gate release; Dependabot bumps adopters."
     };
   }
@@ -228786,13 +229638,13 @@ var require_agent_host_files_embedded = __commonJS({
       ".cursor/hooks.json"
     ]);
     var AGENT_HOST_FILES = Object.freeze({
-      "AGENTS.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent rules\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
-      "CLAUDE.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
-      ".cursor/rules/coderifts.mdc": '---\ndescription: CodeRifts API governance \u2014 when to preflight and how to branch\nglobs:\nalwaysApply: true\n---\n\n<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
-      ".github/copilot-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts instructions for GitHub Copilot\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
-      "coderifts-langgraph-policy.js": '// GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js\n// System policy string for a LangGraph (or similar) agent. Content is generated;\n// identical rule sentences to AGENTS.md / other formats.\n\'use strict\';\n\nmodule.exports = "Call `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\\n\\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\\n\\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\\n\\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\\n\\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\\n\\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not \\"proceed with caution\\" without monitoring.\\n\\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\\n\\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\\n\\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\\n\\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\\n\\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\\n\\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\\n\\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\\n\\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\\n\\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\\n\\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\\n\\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\\n\\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\\n\\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\\n\\nWith a proven tenant\u2194repo binding you may request `derivation:\\"server\\"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\\n\\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say \\"authorized, commit not proven\\".";\n',
-      "openai-agent-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent instructions\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
-      "skills/api-governance/SKILL.md": '---\nname: api-governance\ndescription: Before merging or shipping any API or tool-contract change: preflight the change set, then branch on execution_action.\n---\n\n# CodeRifts API Governance\n\n<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      "AGENTS.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent rules\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      "CLAUDE.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      ".cursor/rules/coderifts.mdc": '---\ndescription: CodeRifts API governance \u2014 when to preflight and how to branch\nglobs:\nalwaysApply: true\n---\n\n<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      ".github/copilot-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts instructions for GitHub Copilot\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      "coderifts-langgraph-policy.js": '// GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js\n// System policy string for a LangGraph (or similar) agent. Content is generated;\n// identical rule sentences to AGENTS.md / other formats.\n\'use strict\';\n\nmodule.exports = "Call `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\\n\\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\\n\\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\\n\\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\\n\\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\\n\\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not \\"proceed with caution\\" without monitoring.\\n\\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\\n\\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\\n\\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\\n\\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\\n\\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\\n\\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\\n\\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\\n\\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\\n\\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\\n\\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\\n\\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\\n\\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\\n\\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\\n\\nWith a proven tenant\u2194repo binding you may request `derivation:\\"server\\"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\\n\\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say \\"authorized, commit not proven\\".";\n',
+      "openai-agent-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent instructions\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      "skills/api-governance/SKILL.md": '---\nname: api-governance\ndescription: Before merging or shipping any API or tool-contract change: preflight the change set, then branch on execution_action.\n---\n\n# CodeRifts API Governance\n\n<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
       ".claude/settings.json": '{\n  "hooks": {\n    "PreToolUse": [\n      {\n        "matcher": "Write|Edit|MultiEdit",\n        "hooks": [\n          {\n            "type": "command",\n            "command": "coderifts claude-hook",\n            "timeout": 60\n          }\n        ]\n      }\n    ]\n  }\n}\n',
       ".cursor/hooks.json": '{\n  "version": 1,\n  "hooks": {\n    "preToolUse": [\n      {\n        "command": "coderifts cursor-hook",\n        "matcher": "Write|Delete",\n        "timeout": 60,\n        "failClosed": true\n      }\n    ]\n  }\n}\n'
     });
@@ -228958,6 +229810,7 @@ ${USAGE}` };
     var AGENT_SETUP_HOOK_WIRE_LINES = Object.freeze([
       chalk.bold("  Claude Code hook (.claude/settings.json): fail-closed PreToolUse"),
       chalk.dim("  matcher Write|Edit|MultiEdit \u2192 coderifts claude-hook (exit 2 = BLOCK)."),
+      chalk.dim("  Path family: OpenAPI/Swagger, GraphQL, *.proto, AsyncAPI, MCP, tool-schema.json (plus git config coderifts.specPath; exclude via coderifts.specPathExclude)."),
       chalk.dim("  Missing key / API down / unreadable spec \u2192 exit 2 (enforce_indeterminate), not ALLOW."),
       chalk.dim("  Opt-out: CODERIFTS_ADVISORY=1|true restores soft-allow when governance could not run."),
       chalk.dim("  CODERIFTS_STRICT=1 cannot be weakened by ADVISORY.")
@@ -229358,6 +230211,7 @@ exit 0
       say(`Claude Code PreToolUse hook written to ${dest}`);
       if (backedUp) say(`Backup: ${backedUp}`);
       say("matcher Write|Edit|MultiEdit \u2192 coderifts claude-hook (exit 2 = BLOCK).");
+      say("governs the contract path family (OpenAPI/Swagger, GraphQL, *.proto, AsyncAPI, MCP, tool-schema) plus git config coderifts.specPath; opt out one path with coderifts.specPathExclude.");
       return { exitCode: 0, code: "OK", path: dest, backedUp, wrote: true };
     }
     var CURSOR_HOOK_BIN = "coderifts cursor-hook";
@@ -256034,10 +256888,12 @@ var require_github_workflow_pin = __commonJS({
     "use strict";
     var { STATUS } = require_github_enforcement();
     var PIN_REASON = Object.freeze({
-      /** The pinned sha is the blob sha of the workflow file at the head being merged. */
+      /** The pinned sha is the head commit sha being merged — GitHub's field, grants PASS. */
       WORKFLOW_SHA_MATCHES_HEAD: "workflow_sha_matches_head",
       /** A pin exists, but it names bytes that are not what is at the head. */
       WORKFLOW_SHA_STALE: "workflow_sha_stale",
+      /** Pin equals the file blob SHA, not a commit. Named; does NOT grant PASS. */
+      WORKFLOW_SHA_IS_BLOB: "workflow_sha_is_blob",
       /** No sha in the rule — the ruleset names a path, so rewriting the file changes what runs. */
       WORKFLOW_NOT_PINNED: "workflow_not_pinned",
       /** We could not read the workflow file at the head, so no comparison is possible. */
@@ -256053,7 +256909,8 @@ var require_github_workflow_pin = __commonJS({
         workflow_ref: null,
         workflow_sha: null,
         workflow_sha_matches_head: false,
-        matched_against: null
+        matched_against: null,
+        grants_pass: false
       };
       if (!pin || !Array.isArray(pin.workflows) || pin.workflows.length === 0) {
         return {
@@ -256091,14 +256948,26 @@ var require_github_workflow_pin = __commonJS({
       }
       const matchedBlob = sameSha(pinned.sha, blobSha);
       const matchedCommit = sameSha(pinned.sha, headCommitSha);
-      if (matchedBlob || matchedCommit) {
+      if (matchedCommit) {
         return {
           ...fields,
           status: STATUS.VERIFIED,
           reason_code: PIN_REASON.WORKFLOW_SHA_MATCHES_HEAD,
           workflow_sha_matches_head: true,
-          matched_against: matchedBlob ? "blob" : "commit",
-          reason: `the ruleset pins ${fields.workflow_path} to ${fields.workflow_sha}, which is the ${matchedBlob ? "blob sha of that file" : "head commit"} being merged. Moving this pin requires editing the ruleset (repository administration), a different permission from workflow write \u2014 so the check is attributable to THIS workflow, not merely to Actions. It still does not establish that the pinned workflow ran, nor that bypass actors cannot skip the ruleset entirely.`
+          matched_against: "commit",
+          grants_pass: true,
+          reason: `the ruleset pins ${fields.workflow_path} to ${fields.workflow_sha}, which is the head commit being merged (GitHub workflows[].sha is a commit SHA, not a file blob). That match grants PASS. Moving this pin requires editing the ruleset (repository administration), a different permission from workflow write \u2014 so the check is attributable to THIS workflow, not merely to Actions. It still does not establish that the pinned workflow ran, nor that bypass actors cannot skip the ruleset entirely, nor that the pin equals the file blob SHA.`
+        };
+      }
+      if (matchedBlob) {
+        return {
+          ...fields,
+          status: STATUS.UNVERIFIABLE,
+          reason_code: PIN_REASON.WORKFLOW_SHA_IS_BLOB,
+          workflow_sha_matches_head: false,
+          matched_against: "blob",
+          grants_pass: false,
+          reason: "pinned sha matches the file blob, not a commit \u2014 GitHub treats workflows[].sha as a commit SHA. Blob equality is named and does not grant PASS."
         };
       }
       return {
@@ -256107,9 +256976,26 @@ var require_github_workflow_pin = __commonJS({
         reason_code: PIN_REASON.WORKFLOW_SHA_STALE,
         workflow_sha_matches_head: false,
         matched_against: null,
+        grants_pass: false,
         reason: `the ruleset pins ${fields.workflow_path} to ${fields.workflow_sha}, but the head carries ${blobSha || headCommitSha || "(nothing readable)"}. A pin to bytes nobody is merging gates nothing.`
       };
     }
+    function evidenceStatement(headComparison) {
+      if (headComparison && headComparison.grants_pass === true) {
+        return "With the required workflow pinned by sha and that sha matching the head commit SHA (GitHub workflows[].sha is a commit SHA, not a file blob), the check is attributable to this workflow rather than to GitHub Actions in general: moving the pin requires repository administration, which is a different permission from workflow write. The common-issuer objection is closed WITHOUT a second GitHub App. This is not a blob-sha content pin.";
+      }
+      if (headComparison && headComparison.matched_against === "blob") {
+        return "The pinned sha equals the workflow file blob, not the head commit. GitHub treats workflows[].sha as a commit SHA, so blob equality does not grant PASS. The common-issuer objection is not closed by a blob match.";
+      }
+      const code = headComparison && headComparison.reason_code;
+      if (code === PIN_REASON.WORKFLOW_SHA_STALE) {
+        return "A sha-pinned required workflow exists, but the pin names bytes that are not on the head. A stale pin gates nothing and does not grant PASS.";
+      }
+      if (code === PIN_REASON.WORKFLOW_FILE_UNREADABLE) {
+        return "A sha-pinned required workflow exists, but the pin could not be compared with the head. That is UNVERIFIABLE, not a match, and does not grant PASS.";
+      }
+      return "Without a sha-pinned required workflow, the issuer proves the check came from GitHub Actions, not that it came from this workflow. Anyone who can write .github/workflows can post a passing check under the same shared issuer id.";
+    }
     function workflowBindingEvidence(pin, headComparison) {
       return {
         pin_status: pin ? pin.status : STATUS.UNVERIFIABLE,
@@ -256119,10 +257005,11 @@ var require_github_workflow_pin = __commonJS({
         workflow_sha: headComparison.workflow_sha,
         workflow_sha_matches_head: headComparison.workflow_sha_matches_head,
         matched_against: headComparison.matched_against,
+        grants_pass: headComparison.grants_pass === true,
         status: headComparison.status,
         reason_code: headComparison.reason_code,
         reason: headComparison.reason,
-        statement: headComparison.workflow_sha_matches_head ? "With the required workflow pinned by sha and that sha present on the head, the check is attributable to this workflow file rather than to GitHub Actions in general: moving the pin requires repository administration, which is a different permission from workflow write. The common-issuer objection is closed WITHOUT a second GitHub App." : "Without a sha-pinned required workflow, the issuer proves the check came from GitHub Actions, not that it came from this workflow. Anyone who can write .github/workflows can post a passing check under the same shared issuer id."
+        statement: evidenceStatement(headComparison)
       };
     }
     module2.exports = { PIN_REASON, evaluateWorkflowShaMatchesHead, workflowBindingEvidence };
@@ -256645,12 +257532,27 @@ var require_setup_required_check = __commonJS({
       }
       const commitRead = runApi([`repos/${owner}/${repo}/commits/${encodeURIComponent(branch)}`], { cwd });
       const commitSha = commitRead && commitRead.ok && commitRead.body && (typeof commitRead.body.sha === "string" ? commitRead.body.sha : commitRead.body.commit && commitRead.body.commit.sha) || null;
+      if (!commitSha || !/^[0-9a-f]{40}$/i.test(commitSha)) {
+        if (!options.json) {
+          logErr(chalk.red(`Could not resolve a commit SHA for ${branch}.`));
+          logErr("  GitHub ruleset workflows[].sha is a commit SHA, not a file blob SHA \u2014 refusing to pin.");
+        }
+        return finish(EXIT.ERROR, {
+          ok: false,
+          code: "WORKFLOW_COMMIT_SHA_UNRESOLVED",
+          owner,
+          repo,
+          branch,
+          workflow_path: WORKFLOW_REL,
+          http_status: commitRead ? commitRead.status : null
+        });
+      }
       const rulesetDocs = fetchRulesetDocs(runApi, owner, repo, cwd) || [];
       const existing = findExistingWorkflowRuleset(rulesetDocs, WORKFLOW_REL);
       const created = buildWorkflowRulesetPayload({
         repositoryId,
         branch,
-        sha: blobSha,
+        sha: commitSha,
         path: WORKFLOW_REL
       });
       const payload = existing ? mergeWorkflowRule(existing, created) : created;
@@ -256661,7 +257563,8 @@ var require_setup_required_check = __commonJS({
         if (!options.json) {
           log(chalk.yellow(`Dry-run: pin ${WORKFLOW_REL} as a required workflow on ${branch}.`));
           log(`  repo:   ${owner}/${repo} (id ${repositoryId})`);
-          log(`  blob:   ${blobSha}`);
+          log(`  commit: ${commitSha}`);
+          log(`  blob (file object): ${blobSha}`);
           log(`  ${existing ? `update ruleset ${existing.id}` : "create ruleset"} ${payload.name}`);
           log("");
           log(cmdText);