coderifts 7.0.0 → 8.0.1

package/dist/cli.js

@@ -3028,7 +3028,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "7.0.0",
+      version: "8.0.1",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -3068,13 +3068,13 @@ var require_package = __commonJS({
       },
       scripts: {
         build: "node scripts/copy-corpus.js && node scripts/build.js",
-        prepublishOnly: "node scripts/assert-guard-major.js && node scripts/assert-changelog-version.js && bash ../../scripts/freeze-gate.sh && npm run build",
+        prepublishOnly: "node scripts/assert-guard-major.js && node scripts/assert-changelog-version.js && bash ../../scripts/freeze-gate.sh && npm run build && bash ../../scripts/release-check.sh .",
         "assert-guard-major": "node scripts/assert-guard-major.js",
         postinstall: "node scripts/postinstall.js",
         test: "node --test test/*.test.js"
       },
       dependencies: {
-        "@coderifts/agent-guard": "^14.0.0",
+        "@coderifts/agent-guard": "^15.1.0",
         chalk: "^4.1.2",
         "cli-table3": "^0.6.4",
         commander: "^12.0.0",
@@ -68128,7 +68128,7 @@ var require_client = __commonJS({
         this.timeout = options.timeout || DEFAULT_TIMEOUT;
       }
       // ─── Internal HTTP helper ──────────────────────────────────────────────
-      async request(method, path, body) {
+      async request(method, path, body, extraHeaders) {
         const url = `${this.baseUrl}${path}`;
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), this.timeout);
@@ -68137,7 +68137,8 @@ var require_client = __commonJS({
             method,
             headers: {
               "Content-Type": "application/json",
-              Authorization: `Bearer ${this.apiKey}`
+              Authorization: `Bearer ${this.apiKey}`,
+              ...extraHeaders || {}
             },
             body: body ? JSON.stringify(body) : void 0,
             signal: controller.signal
@@ -68340,8 +68341,12 @@ var require_client = __commonJS({
        * `decision` / `safe_for_agent` (authorize) or `analysis_outcome` (analyze). Call
        * `analyzeChangeSet` / `authorizeChangeSet` instead to get an already-narrowed type.
        */
-      async preflightChangeSet(req) {
-        return this.request("POST", "/api/v1/preflight", req);
+      async preflightChangeSet(req, opts) {
+        const extra = {};
+        const token = opts && typeof opts.scmToken === "string" ? opts.scmToken.trim() : "";
+        if (token)
+          extra["X-Coderifts-Scm-Token"] = token;
+        return this.request("POST", "/api/v1/preflight", req, extra);
       }
       /**
        * Risk-only preflight (`preflight_mode: 'analyze'`). Informational — not permission;
@@ -68350,11 +68355,11 @@ var require_client = __commonJS({
        * The mode is fixed by this method, so the analyze branch is returned directly — there is no
        * `decision` / `execution_action` / `safe_for_agent` on it, by protocol.
        */
-      async analyzeChangeSet(req) {
+      async analyzeChangeSet(req, opts) {
         return this.preflightChangeSet({
           ...req,
           preflight_mode: "analyze"
-        });
+        }, opts);
       }
       /**
        * Operation-bound authorize preflight (`preflight_mode: 'authorize'`).
@@ -68364,11 +68369,11 @@ var require_client = __commonJS({
        * The mode is fixed by this method, so the authorize branch is returned directly:
        * `decision`, `execution_action` and `safe_for_agent` are present without narrowing.
        */
-      async authorizeChangeSet(req) {
+      async authorizeChangeSet(req, opts) {
         return this.preflightChangeSet({
           ...req,
           preflight_mode: "authorize"
-        });
+        }, opts);
       }
       // ─── 9. verifyReceipt ──────────────────────────────────────────────────
       /**
@@ -68581,7 +68586,7 @@ var require_execution_grant = __commonJS({
   "node_modules/@coderifts/sdk/dist/cjs/execution-grant.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.CLOCK_SKEW_LEEWAY_MS = exports2.GRANT_SIGNING_PREFIX = exports2.GRANT_VERSION = void 0;
+    exports2.CLOCK_SKEW_LEEWAY_MS = exports2.GRANT_SIGNING_PREFIX = exports2.GRANT_VERSION_V2 = exports2.GRANT_VERSION = void 0;
     exports2.afterPayloadCanonical = afterPayloadCanonical;
     exports2.computeScopeHash = computeScopeHash;
     exports2.receiptDigest = receiptDigest;
@@ -68592,6 +68597,7 @@ var require_execution_grant = __commonJS({
       return leeway_js_1.CLOCK_SKEW_LEEWAY_MS;
     } });
     exports2.GRANT_VERSION = "cr.exec.v1";
+    exports2.GRANT_VERSION_V2 = "cr.exec.v2";
     exports2.GRANT_SIGNING_PREFIX = "crexec.v1";
     var NUL = "";
     var SIGNED_FIELDS = [
@@ -69226,7 +69232,7 @@ var require_cjs3 = __commonJS({
   "node_modules/@coderifts/sdk/dist/cjs/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.MONITOR_ATTEST_ENVELOPE_TAG = exports2.MONITOR_ATTEST_SIGNING_PREFIX = exports2.MONITOR_ATTEST_VERSION = exports2.monitorAttestSigningInput = exports2.verifyMonitoringAttestation = exports2.ATTEST_ENVELOPE_TAG = exports2.ATTEST_SIGNING_PREFIX = exports2.ATTEST_VERSION = exports2.attestSigningInput = exports2.verifyExecutionAttestation = exports2.GRANT_SIGNING_PREFIX = exports2.GRANT_VERSION = exports2.receiptDigest = exports2.afterPayloadCanonical = exports2.computeScopeHash = exports2.verifyExecutionGrant = exports2.isIssuedInFuture = exports2.isReceiptExpired = exports2.declaresDestructiveProduction = exports2.expiryLeewayMs = exports2.CLOCK_SKEW_LEEWAY_MS = exports2.readDecision = exports2.AuthError = exports2.RateLimitError = exports2.TimeoutError = exports2.ApiError = exports2.CodeRiftsError = exports2.resetPolicyWarnForTests = exports2.warnPolicyAbsentOnce = exports2.observePolicyPresence = exports2.detectPolicyPresence = exports2.policyPresenceOf = exports2.withPolicy = exports2.POLICY_ABSENT_WARN = exports2.POLICY_MARKER = exports2.CODERIFTS_POLICY = exports2.CodeRifts = void 0;
+    exports2.MONITOR_ATTEST_ENVELOPE_TAG = exports2.MONITOR_ATTEST_SIGNING_PREFIX = exports2.MONITOR_ATTEST_VERSION = exports2.monitorAttestSigningInput = exports2.verifyMonitoringAttestation = exports2.ATTEST_ENVELOPE_TAG = exports2.ATTEST_SIGNING_PREFIX = exports2.ATTEST_VERSION = exports2.attestSigningInput = exports2.verifyExecutionAttestation = exports2.GRANT_SIGNING_PREFIX = exports2.GRANT_VERSION_V2 = exports2.GRANT_VERSION = exports2.receiptDigest = exports2.afterPayloadCanonical = exports2.computeScopeHash = exports2.verifyExecutionGrant = exports2.isIssuedInFuture = exports2.isReceiptExpired = exports2.declaresDestructiveProduction = exports2.expiryLeewayMs = exports2.CLOCK_SKEW_LEEWAY_MS = exports2.readDecision = exports2.AuthError = exports2.RateLimitError = exports2.TimeoutError = exports2.ApiError = exports2.CodeRiftsError = exports2.resetPolicyWarnForTests = exports2.warnPolicyAbsentOnce = exports2.observePolicyPresence = exports2.detectPolicyPresence = exports2.policyPresenceOf = exports2.withPolicy = exports2.POLICY_ABSENT_WARN = exports2.POLICY_MARKER = exports2.CODERIFTS_POLICY = exports2.CodeRifts = void 0;
     var client_js_1 = require_client();
     Object.defineProperty(exports2, "CodeRifts", { enumerable: true, get: function() {
       return client_js_1.CodeRifts;
@@ -69311,6 +69317,9 @@ var require_cjs3 = __commonJS({
     Object.defineProperty(exports2, "GRANT_VERSION", { enumerable: true, get: function() {
       return execution_grant_js_1.GRANT_VERSION;
     } });
+    Object.defineProperty(exports2, "GRANT_VERSION_V2", { enumerable: true, get: function() {
+      return execution_grant_js_1.GRANT_VERSION_V2;
+    } });
     Object.defineProperty(exports2, "GRANT_SIGNING_PREFIX", { enumerable: true, get: function() {
       return execution_grant_js_1.GRANT_SIGNING_PREFIX;
     } });
@@ -70000,7 +70009,7 @@ var require_policy2 = __commonJS({
     exports2.observePolicyPresence = observePolicyPresence;
     exports2.resetPolicyWarnForTests = resetPolicyWarnForTests;
     exports2.POLICY_MARKER = "A receipt authorizes ONE operation: a merge receipt does not authorize a deploy.";
-    exports2.CODERIFTS_POLICY = 'Call `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".';
+    exports2.CODERIFTS_POLICY = 'Call `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".';
     exports2.POLICY_ABSENT_WARN = "CodeRifts policy text not detected in the system prompt. The agent will still see the tools, but measured evidence shows operation-scope misuse is markedly more likely without it. See https://github.com/coderifts/agent-guard#policy-delivery.";
     function textHasMarker(text) {
       return text.includes(exports2.POLICY_MARKER);
@@ -70079,16 +70088,196 @@ var require_policy2 = __commonJS({
   }
 });
 
+// node_modules/@coderifts/agent-guard/dist/cjs/deny-remedy.js
+var require_deny_remedy = __commonJS({
+  "node_modules/@coderifts/agent-guard/dist/cjs/deny-remedy.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.ARGS_SHAPE = exports2.DOES_NOT_PROMISE = exports2.DENY_ERROR = void 0;
+    exports2.buildDenyRemedy = buildDenyRemedy;
+    exports2.denyErrorForReason = denyErrorForReason;
+    exports2.DENY_ERROR = Object.freeze({
+      GRANT_REQUIRED: "CODERIFTS_GRANT_REQUIRED",
+      GRANT_INVALID: "CODERIFTS_GRANT_INVALID",
+      GRANT_MISMATCH: "CODERIFTS_GRANT_MISMATCH"
+    });
+    exports2.DOES_NOT_PROMISE = "a grant does not guarantee execution (CAS may still fail)";
+    exports2.ARGS_SHAPE = Object.freeze({
+      artifacts: "Array<{ id, type, before, after }> \u2014 the change set being authorized",
+      context: "{ operation, environment?, repository?, branch?, pull_request? } \u2014 operation is required for authorize"
+    });
+    var FINGERPRINT_RE = /^sha256:[0-9a-f]{64}$/;
+    function buildDenyRemedy({ error, target = null, fingerprint = null, observed = null }) {
+      if (!error || !Object.values(exports2.DENY_ERROR).includes(error))
+        return null;
+      const remedy = {
+        error,
+        // Null, never a wildcard: a surface that cannot name what it refused must
+        // not emit a value a reader could take for "everything".
+        target: typeof target === "string" && target.length > 0 ? target : null,
+        // Only a well-formed fingerprint. A malformed one is dropped rather than
+        // passed through, because a caller comparing it would get a false mismatch.
+        fingerprint: typeof fingerprint === "string" && FINGERPRINT_RE.test(fingerprint) ? fingerprint : null,
+        action_required: {
+          tool: "preflight_change_set",
+          mode: "authorize",
+          args_shape: { ...exports2.ARGS_SHAPE }
+        },
+        does_not_promise: exports2.DOES_NOT_PROMISE
+      };
+      if (observed && typeof observed === "object")
+        remedy.observed = observed;
+      return remedy;
+    }
+    function denyErrorForReason(reason) {
+      switch (String(reason || "").toLowerCase()) {
+        // Nothing was presented.
+        case "receipt_missing":
+        case "missing_receipt":
+        case "missing_grant_header":
+        case "decision_missing":
+        case "missing_decision_result":
+        case "no_preflight_response":
+        case "grant_not_supplied":
+          return exports2.DENY_ERROR.GRANT_REQUIRED;
+        // Something was presented and did not hold up.
+        case "receipt_invalid":
+        case "receipt_unverified":
+        case "invalid_signature":
+        case "unknown_key":
+        case "unknown_kid":
+        case "dsse_malformed":
+        case "dsse_unsupported":
+        case "dsse_predicate_mismatch":
+        case "malformed":
+        case "grant_malformed":
+        case "grant_unverified":
+        case "grant_expired":
+          return exports2.DENY_ERROR.GRANT_INVALID;
+        // It held up, but it is not about this request.
+        case "scope_mismatch":
+        case "target_mismatch":
+        case "operation_mismatch":
+        case "grant_scope_mismatch":
+        case "mode_mismatch":
+        case "repo_mismatch":
+        case "base_mismatch":
+        case "head_mismatch":
+        case "grant_does_not_cover_path":
+        case "grant_bound_elsewhere":
+        case "receipt_envelope_mismatch":
+        case "artifact_mismatch":
+        case "grant_unbound":
+        case "grant_wrong_audience":
+          return exports2.DENY_ERROR.GRANT_MISMATCH;
+        default:
+          return null;
+      }
+    }
+  }
+});
+
+// node_modules/@coderifts/agent-guard/dist/cjs/next-agent-step.js
+var require_next_agent_step = __commonJS({
+  "node_modules/@coderifts/agent-guard/dist/cjs/next-agent-step.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.NEXT_STEP_NOTE = exports2.NEXT_AGENT_ACTIONS = void 0;
+    exports2.readNextAgentStep = readNextAgentStep;
+    exports2.NEXT_AGENT_ACTIONS = [
+      "re_preflight",
+      "revert",
+      "migrate",
+      "escalate",
+      "await_approval"
+    ];
+    function readNextAgentStep(envelope) {
+      if (!envelope || typeof envelope !== "object")
+        return null;
+      const raw = envelope.next_agent_step;
+      if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+      const step = raw;
+      if (typeof step.action !== "string" || step.action.length === 0)
+        return null;
+      return step;
+    }
+    exports2.NEXT_STEP_NOTE = "This is the decision's remediation suggestion, not permission; branch on execution_action.";
+  }
+});
+
 // node_modules/@coderifts/agent-guard/dist/cjs/execution-grant.js
 var require_execution_grant2 = __commonJS({
   "node_modules/@coderifts/agent-guard/dist/cjs/execution-grant.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.V2_WIRE_FIELDS = exports2.V2_FIELD_KEYS = void 0;
+    exports2.resolveV2Fields = resolveV2Fields;
+    exports2.v2WireFields = v2WireFields;
     exports2.isExecutionGrantEnabled = isExecutionGrantEnabled;
     exports2.readExecutionGrantToken = readExecutionGrantToken;
     exports2.firstArtifactId = firstArtifactId;
     exports2.isSignerUnavailableError = isSignerUnavailableError;
     exports2.resolveStateNonceForCall = resolveStateNonceForCall;
+    exports2.V2_FIELD_KEYS = Object.freeze([
+      "executorId",
+      "adapterId",
+      "targetUri",
+      "tenantId",
+      "policyHash",
+      "audienceHash"
+    ]);
+    function resolveV2Fields(input) {
+      const top = input || {};
+      const nested = input && input.executionGrant || {};
+      const out = {};
+      const conflicts = [];
+      for (const key of exports2.V2_FIELD_KEYS) {
+        const t = typeof top[key] === "string" && top[key].length > 0 ? top[key] : void 0;
+        const n = typeof nested[key] === "string" && nested[key].length > 0 ? nested[key] : void 0;
+        if (t !== void 0 && n !== void 0 && t !== n) {
+          conflicts.push(`  ${key}: top-level ${JSON.stringify(t)} vs executionGrant.${key} ${JSON.stringify(n)}`);
+          continue;
+        }
+        const v = t !== void 0 ? t : n;
+        if (v !== void 0)
+          out[key] = v;
+      }
+      if (conflicts.length > 0) {
+        const err = new Error(`withCodeRifts: the V2 identity fields are configured in two places and they disagree.
+${conflicts.join("\n")}
+
+These feed DIFFERENT halves of the system \u2014 the top level binds the ATOMIC construction check and the posture receipt, the executionGrant copy goes on the authorize request \u2014 so a disagreement builds a grant against one identity and verifies against another. Set each field ONCE, at the top level; the executionGrant spelling is a deprecated alias.`);
+        err.code = "V2_FIELDS_CONFLICT";
+        throw err;
+      }
+      return out;
+    }
+    exports2.V2_WIRE_FIELDS = Object.freeze([
+      ["executor_id", "executorId"],
+      ["adapter_id", "adapterId"],
+      ["target_uri", "targetUri"],
+      ["tenant_id", "tenantId"],
+      ["policy_hash", "policyHash"],
+      ["audience_hash", "audienceHash"]
+    ]);
+    function v2WireFields(config) {
+      const g = config && config.executionGrant;
+      const fields = {};
+      const absent = [];
+      if (!g || g.grantVersion !== "v2") {
+        return { fields, absent: exports2.V2_WIRE_FIELDS.map(([wire]) => wire) };
+      }
+      const resolved = resolveV2Fields(config);
+      for (const [wire, key] of exports2.V2_WIRE_FIELDS) {
+        const v = resolved[key];
+        if (typeof v === "string" && v.length > 0)
+          fields[wire] = v;
+        else
+          absent.push(wire);
+      }
+      return { fields, absent };
+    }
     function isExecutionGrantEnabled(config) {
       return !!(config && config.executionGrant && config.executionGrant.enabled === true);
     }
@@ -70163,6 +70352,8 @@ var require_guard = __commonJS({
     var monitoring_delivery_js_1 = require_monitoring_delivery();
     var monitoring_attestation_js_1 = require_monitoring_attestation2();
     var policy_js_1 = require_policy2();
+    var deny_remedy_js_1 = require_deny_remedy();
+    var next_agent_step_js_1 = require_next_agent_step();
     var execution_grant_js_1 = require_execution_grant2();
     var breakers = /* @__PURE__ */ new WeakMap();
     var nowMs = () => Date.now();
@@ -70333,7 +70524,7 @@ var require_guard = __commonJS({
     function coverageOutcomeFieldsFrom(s) {
       return s.coverageObserved ? { coverage_observed: s.coverageObserved } : {};
     }
-    function blocked(config, verdict, preflighted, freshness, conditional_write, monitoring_delivery, monitoring_attestation, grantObs) {
+    function blocked(config, verdict, preflighted, freshness, conditional_write, monitoring_delivery, monitoring_attestation, grantObs, call) {
       const commit_observation = {
         status: "not_observed",
         observed_at: iso(),
@@ -70341,6 +70532,15 @@ var require_guard = __commonJS({
       };
       const base = { executionAttempted: false, executed: false, enforced: false, verdict, preflighted };
       const cov = coverageSnap(config);
+      const cause = "cause" in verdict ? verdict.cause : null;
+      const nextStep = "envelope" in verdict && "receiptVerified" in verdict && verdict.receiptVerified === true ? (0, next_agent_step_js_1.readNextAgentStep)(verdict.envelope) : null;
+      const remedy = call ? (0, deny_remedy_js_1.buildDenyRemedy)({
+        error: (0, deny_remedy_js_1.denyErrorForReason)(cause),
+        target: call.toolName || null,
+        // The guard's own input fingerprint, already sha256:<hex>.
+        fingerprint: fingerprint(call),
+        observed: { cause, resolution: "resolution" in verdict ? verdict.resolution : null }
+      }) : null;
       const out = {
         ...base,
         proof: (0, execution_proof_js_1.buildExecutionProof)({
@@ -70357,7 +70557,9 @@ var require_guard = __commonJS({
         ...monitoring_delivery ? { monitoring_delivery } : {},
         ...monitoring_attestation ? { monitoring_attestation } : {},
         ...coverageOutcomeFieldsFrom(cov),
-        ...grantObs ? { execution_grant: grantObs } : {}
+        ...grantObs ? { execution_grant: grantObs } : {},
+        ...remedy ? { remedy } : {},
+        ...nextStep ? { next_step: nextStep } : {}
       };
       return attachPolicyPresence(out, config);
     }
@@ -70565,7 +70767,7 @@ var require_guard = __commonJS({
         const v = unavailableVerdict({ cause: "MISSING_ARTIFACT_CONTENT", failPolicy, resolution: "CLOSED", action: "STOP" }, count);
         const { basis } = freshnessFor(config, redacted, fctx, detection.artifacts);
         const { basis: cw } = conditionalWriteFor(config, redacted, cwctx, detection.artifacts);
-        return blocked(config, v, false, basis, cw);
+        return blocked(config, v, false, basis, cw, void 0, void 0, void 0, redacted);
       }
       if (failPolicy === "lkg" && !config.lkg) {
         breakerRecord(config);
@@ -70589,6 +70791,20 @@ var require_guard = __commonJS({
         request.include_execution_grant = true;
         if (nonceRes.nonce)
           request.state_nonce = nonceRes.nonce;
+        const wire = (0, execution_grant_js_1.v2WireFields)(config);
+        if (config.executionGrant?.grantVersion === "v2") {
+          request.grant_version = "v2";
+          for (const [k, v] of Object.entries(wire.fields))
+            request[k] = v;
+        }
+        if (config.executionGrant?.grantVersion === "v2") {
+          grantObs = {
+            ...grantObs,
+            grant_version: "v2",
+            v2_fields_sent: Object.keys(wire.fields),
+            v2_fields_absent: wire.absent
+          };
+        }
       }
       const cap = config.maxPayloadBytes ?? 1e6;
       if (Buffer.byteLength(JSON.stringify(request), "utf8") > cap) {
@@ -70605,14 +70821,14 @@ var require_guard = __commonJS({
         if (pf.integrity) {
           emit(config, { type: "breaker_tripped", at: iso(), cause: pf.cause });
           const v2 = unavailableVerdict({ cause: pf.cause, failPolicy, resolution: "CLOSED", action: "STOP" }, count);
-          return blocked(config, v2, false, basis, cw, void 0, void 0, grantObs);
+          return blocked(config, v2, false, basis, cw, void 0, void 0, grantObs, redacted);
         }
         const availCause = pf.cause;
         if (grantObs && grantObs.requested) {
           if (breakerTripped(config))
             emit(config, { type: "breaker_tripped", at: iso(), cause: availCause });
           const v2 = unavailableVerdict({ cause: availCause, failPolicy, resolution: "CLOSED", action: "STOP" }, count);
-          return blocked(config, v2, false, basis, cw, void 0, void 0, grantObs);
+          return blocked(config, v2, false, basis, cw, void 0, void 0, grantObs, redacted);
         }
         if (failPolicy === "open" && !breakerTripped(config)) {
           emit(config, { type: "preflight_unavailable", at: iso(), cause: availCause, action: "CONTINUE" });
@@ -70630,7 +70846,7 @@ var require_guard = __commonJS({
         if (breakerTripped(config))
           emit(config, { type: "breaker_tripped", at: iso(), cause: availCause });
         const v = unavailableVerdict({ cause: availCause, failPolicy, resolution: "CLOSED", action: "STOP" }, count);
-        return blocked(config, v, false, basis, cw, void 0, void 0, grantObs);
+        return blocked(config, v, false, basis, cw, void 0, void 0, grantObs, redacted);
       }
       const rd = (0, read_decision_js_1.readDecision)(pf.response);
       if (rd.reason === "EXECUTION_ACTION_UNRECOGNISED") {
@@ -70670,7 +70886,7 @@ var require_guard = __commonJS({
       if (gate.verdict === "block-strict") {
         const { basis } = freshnessFor(config, redacted, fctx, detection.artifacts);
         const { basis: cw } = conditionalWriteFor(config, redacted, cwctx, detection.artifacts);
-        return gate.decision === "BLOCK" ? blocked(config, { kind: "BLOCK", action: "STOP", envelope, receiptVerified }, true, basis, cw, void 0, void 0, grantObs) : blocked(config, { kind: "APPROVAL", action: "REQUEST_APPROVAL", envelope, receiptVerified }, true, basis, cw, void 0, void 0, grantObs);
+        return gate.decision === "BLOCK" ? blocked(config, { kind: "BLOCK", action: "STOP", envelope, receiptVerified }, true, basis, cw, void 0, void 0, grantObs, redacted) : blocked(config, { kind: "APPROVAL", action: "REQUEST_APPROVAL", envelope, receiptVerified }, true, basis, cw, void 0, void 0, grantObs, redacted);
       }
       const kind = gate.kind;
       if (grantObs && grantObs.requested) {
@@ -70816,7 +71032,7 @@ var require_guard = __commonJS({
       const v = unavailableVerdict({ cause, failPolicy, resolution: "CLOSED", action: "STOP" }, count);
       const { basis } = freshnessFor(config, redacted, fctx, arts);
       const { basis: cw } = conditionalWriteFor(config, redacted, cwctx, arts);
-      return blocked(config, v, false, basis, cw, monitoring_delivery, monitoring_attestation, grantObs);
+      return blocked(config, v, false, basis, cw, monitoring_delivery, monitoring_attestation, grantObs, redacted);
     }
     function isExpired(envelope) {
       const exp = envelope.expires_at;
@@ -73407,6 +73623,7 @@ var require_deploy_receipt_token = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.CHAIN_SIGNING_PREFIX = void 0;
     exports2.verifyDeployReceiptToken = verifyDeployReceiptToken;
+    var next_agent_step_js_1 = require_next_agent_step();
     var node_crypto_1 = require("node:crypto");
     var sdk_1 = require_cjs3();
     var receipt_binding_js_1 = require_receipt_binding();
@@ -73427,6 +73644,31 @@ var require_deploy_receipt_token = __commonJS({
       }
       return v1;
     }
+    function deriveKeyWithdrawalStatus(ts, keyMeta) {
+      const KNOWN_STATUSES = ["active", "retired", "revoked", null];
+      if (!KNOWN_STATUSES.includes(keyMeta.status))
+        return "UNKNOWN_KEY_STATUS";
+      if (typeof keyMeta.revoked_at === "string" && keyMeta.revoked_at.length > 0)
+        return "KEY_REVOKED";
+      if (typeof keyMeta.retired_at === "string" && keyMeta.retired_at.length > 0 && ts) {
+        const issued = Date.parse(ts);
+        const retired = Date.parse(keyMeta.retired_at);
+        if (Number.isFinite(issued) && Number.isFinite(retired) && issued >= retired) {
+          return "KEY_RETIRED_AFTER_SIGNING";
+        }
+      }
+      if (keyMeta.status === "revoked") {
+        const at = keyMeta.compromised_at;
+        if (typeof at !== "string" || at.length === 0)
+          return "REVOKED_KEY_UNDECIDABLE";
+        const boundary = Date.parse(at);
+        const issued = typeof ts === "string" ? Date.parse(ts) : NaN;
+        if (!Number.isFinite(boundary) || !Number.isFinite(issued))
+          return "REVOKED_KEY_UNDECIDABLE";
+        return issued >= boundary ? "REVOKED_KEY" : "REVOKED_KEY_UNDECIDABLE";
+      }
+      return null;
+    }
     function isIssueTimeWithinKeyWindow(ts, keyMeta) {
       if (!keyMeta || keyMeta.status === "active")
         return true;
@@ -73451,6 +73693,12 @@ var require_deploy_receipt_token = __commonJS({
         return false;
       return true;
     }
+    function optionalString(source, field) {
+      if (!source || typeof source !== "object")
+        return null;
+      const v = source[field];
+      return typeof v === "string" && v.length > 0 ? v : null;
+    }
     function resolveKey(kid, registry, pinnedKeyPem) {
       if (typeof pinnedKeyPem === "string" && pinnedKeyPem.trim().length > 0) {
         try {
@@ -73458,7 +73706,9 @@ var require_deploy_receipt_token = __commonJS({
             publicKey: (0, node_crypto_1.createPublicKey)(pinnedKeyPem),
             status: "active",
             valid_from: null,
-            retired_at: null
+            retired_at: null,
+            revoked_at: null,
+            compromised_at: null
           };
         } catch {
           return null;
@@ -73473,9 +73723,11 @@ var require_deploy_receipt_token = __commonJS({
       try {
         return {
           publicKey: (0, node_crypto_1.createPublicKey)(entry.public_key_pem),
-          status: entry.status === "retired" ? "retired" : "active",
+          status: typeof entry.status === "string" ? entry.status : null,
           valid_from: entry.valid_from || null,
-          retired_at: entry.retired_at || null
+          retired_at: entry.retired_at || null,
+          revoked_at: optionalString(entry, "revoked_at"),
+          compromised_at: optionalString(entry, "compromised_at")
         };
       } catch {
         return null;
@@ -73504,7 +73756,12 @@ var require_deploy_receipt_token = __commonJS({
         bound_artifact_id: artifact == null ? null : String(artifact),
         verdict_fingerprint: typeof envelope.fingerprint === "string" ? envelope.fingerprint : typeof payload.fp === "string" ? payload.fp : void 0,
         body_hash: typeof payload.bh === "string" ? payload.bh : void 0,
-        target_id: envelope.target_id == null ? void 0 : String(envelope.target_id)
+        target_id: envelope.target_id == null ? void 0 : String(envelope.target_id),
+        // Read from the envelope the caller supplied. On the currently_authorized path the
+        // body hash has already bound it; on the expired / retired-key paths the signature
+        // was authentic too. Every path that did NOT authenticate returns through fail(),
+        // which sets view: null — so this field cannot carry an unsigned step.
+        next_agent_step: (0, next_agent_step_js_1.readNextAgentStep)(envelope)
       };
     }
     function verifyDeployReceiptToken(input, _intended = {}, nowMs) {
@@ -73549,6 +73806,14 @@ var require_deploy_receipt_token = __commonJS({
           return fail("INVALID_SIGNATURE", "invalid_signature", { payload, authz_reason: "delimiter_in_field" });
         }
       }
+      const withdrawn = deriveKeyWithdrawalStatus(typeof payload.ts === "string" ? payload.ts : void 0, resolved);
+      if (withdrawn) {
+        return fail(withdrawn, withdrawn === "UNKNOWN_KEY_STATUS" ? "unknown_key_status" : "revoked_key", {
+          payload,
+          authz_reason: withdrawn.toLowerCase(),
+          key_status: withdrawn === "UNKNOWN_KEY_STATUS" ? "unknown" : "revoked"
+        });
+      }
       if (resolved.status === "retired") {
         if (!isIssueTimeWithinKeyWindow(typeof payload.ts === "string" ? payload.ts : void 0, resolved)) {
           return fail("INVALID_SIGNATURE", "invalid_signature", { payload, authz_reason: "retired_key_outside_window" });
@@ -73629,6 +73894,7 @@ var require_deploy_gate = __commonJS({
     exports2.isVerifiedDeployReceiptView = isVerifiedDeployReceiptView;
     exports2.deployGate = deployGate;
     var deploy_receipt_token_js_1 = require_deploy_receipt_token();
+    var next_agent_step_js_1 = require_next_agent_step();
     exports2.DEPLOY_RECEIPT_VIEW_SPEC = "deploy-receipt-view.v1";
     function asVerifiedDeployReceiptView(view, verify_status = "VERIFIED_CURRENT") {
       return {
@@ -73690,16 +73956,21 @@ var require_deploy_gate = __commonJS({
         bound_artifact_id: r && r.bound_artifact_id != null ? norm(r.bound_artifact_id) : null,
         operation: r && r.operation != null ? String(r.operation) : null
       });
-      const deny = (state, reason) => ({
-        deploy_allowed: false,
-        state,
-        reason,
-        enforcement_state,
-        inescapable_deploy: false,
-        residuals: [],
-        detail: detailOf(receipt),
-        verification
-      });
+      const nextStepOf = (r) => verification.mode === "token" ? (0, next_agent_step_js_1.readNextAgentStep)(r) : null;
+      const deny = (state, reason) => {
+        const step = nextStepOf(receipt);
+        return {
+          deploy_allowed: false,
+          state,
+          reason,
+          enforcement_state,
+          inescapable_deploy: false,
+          residuals: [],
+          detail: detailOf(receipt),
+          verification,
+          ...step ? { next_step: step } : {}
+        };
+      };
       if (!target.environment || String(target.environment).trim() === "" || !target.artifact_id || String(target.artifact_id).trim() === "") {
         return deny(allowPending ? "pending" : "failure", "inputs_incomplete");
       }
@@ -74040,18 +74311,168 @@ var require_coverage_report = __commonJS({
   }
 });
 
+// node_modules/@coderifts/agent-guard/dist/cjs/posture-receipt.js
+var require_posture_receipt = __commonJS({
+  "node_modules/@coderifts/agent-guard/dist/cjs/posture-receipt.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.POSTURE_CLOCK_SKEW_TOLERANCE_MS = exports2.POSTURE_RECEIPT_V = void 0;
+    exports2.verifyPostureReceipt = verifyPostureReceipt;
+    var node_crypto_1 = require("node:crypto");
+    exports2.POSTURE_RECEIPT_V = "cr.posture.receipt.v1";
+    exports2.POSTURE_CLOCK_SKEW_TOLERANCE_MS = 5e3;
+    function resolvePostureKey(kid, registry, pinnedKeyPem) {
+      if (typeof pinnedKeyPem === "string" && pinnedKeyPem.trim().length > 0) {
+        try {
+          return { ok: true, key: (0, node_crypto_1.createPublicKey)(pinnedKeyPem) };
+        } catch {
+          return { ok: false, status: "POSTURE_UNKNOWN_KEY" };
+        }
+      }
+      if (!registry || !Array.isArray(registry.keys) || !kid) {
+        return { ok: false, status: "POSTURE_UNKNOWN_KEY" };
+      }
+      const matches = registry.keys.filter((k) => k && k.kid === kid && typeof k.public_key_pem === "string");
+      if (matches.length === 0)
+        return { ok: false, status: "POSTURE_UNKNOWN_KEY" };
+      const entry = matches.find((k) => k.status === "active");
+      if (!entry)
+        return { ok: false, status: "POSTURE_REVOKED_KEY" };
+      try {
+        return { ok: true, key: (0, node_crypto_1.createPublicKey)(entry.public_key_pem) };
+      } catch {
+        return { ok: false, status: "POSTURE_UNKNOWN_KEY" };
+      }
+    }
+    var fail = (status, reason, extra = {}) => ({ valid: false, status, reason, ...extra });
+    function verifyPostureReceipt(token, input = {}) {
+      if (typeof token !== "string" || token.length === 0) {
+        return fail("POSTURE_MALFORMED", "malformed_structure");
+      }
+      const seg = token.split("|");
+      if (seg.length !== 4 || seg[0] !== exports2.POSTURE_RECEIPT_V || seg.some((x) => !x)) {
+        return fail("POSTURE_MALFORMED", "malformed_structure");
+      }
+      let preimageBytes;
+      try {
+        preimageBytes = Buffer.from(seg[2], "base64url");
+        if (preimageBytes.length === 0)
+          throw new Error("empty");
+      } catch {
+        return fail("POSTURE_MALFORMED", "bad_preimage");
+      }
+      const resolved = resolvePostureKey(seg[1], input.registry, input.pinnedKeyPem);
+      if (!resolved.ok) {
+        return fail(resolved.status, resolved.status === "POSTURE_REVOKED_KEY" ? "kid_revoked" : "unknown_kid");
+      }
+      const key = resolved.key;
+      let sigOk = false;
+      try {
+        sigOk = (0, node_crypto_1.verify)(null, preimageBytes, key, Buffer.from(seg[3], "base64url"));
+      } catch {
+        return fail("POSTURE_INVALID_SIGNATURE", "signature_error");
+      }
+      if (!sigOk)
+        return fail("POSTURE_INVALID_SIGNATURE", "signature_mismatch");
+      let payload;
+      try {
+        payload = JSON.parse(preimageBytes.toString("utf8"));
+      } catch {
+        return fail("POSTURE_MALFORMED", "bad_json");
+      }
+      if (!payload || typeof payload !== "object") {
+        return fail("POSTURE_MALFORMED", "bad_json");
+      }
+      if (payload.verdict !== "PASS") {
+        return fail("POSTURE_FAIL", "posture_verdict_not_pass", { payload });
+      }
+      if (typeof payload.executor_kid === "string" && payload.executor_kid.length > 0 && payload.executor_kid !== seg[1]) {
+        return fail("POSTURE_UNBOUND", "kid_mismatch", { payload });
+      }
+      if (Object.prototype.hasOwnProperty.call(payload, "v") && payload.v != null && payload.v !== exports2.POSTURE_RECEIPT_V) {
+        return fail("POSTURE_MALFORMED", "body_version_mismatch", { payload });
+      }
+      if (typeof input.expectedDeploymentId === "string" && input.expectedDeploymentId.length > 0) {
+        if (payload.deployment_id !== input.expectedDeploymentId) {
+          return fail("POSTURE_UNBOUND", "deployment_id_mismatch", { payload });
+        }
+      }
+      const bound = [];
+      const notBound = [];
+      const tuple = [
+        ["executor_id", input.expectedExecutorId, "executor_id"],
+        ["adapter_id", input.expectedAdapterId, "adapter_id"],
+        ["target_uri", input.expectedTargetUri, "target_uri"],
+        ["policy_hash", input.expectedPolicyHash, "policy_hash"]
+      ];
+      for (const [field, expected, label] of tuple) {
+        if (typeof expected !== "string" || expected.length === 0) {
+          notBound.push({
+            field: label,
+            reason: "the caller did not state an expected value, so this verification did not check it"
+          });
+          continue;
+        }
+        const actual = payload[field];
+        if (typeof actual !== "string" || actual.length === 0) {
+          return fail("POSTURE_UNBOUND", `${label}_absent`, { payload, bound, not_bound: notBound });
+        }
+        if (actual !== expected) {
+          return fail("POSTURE_UNBOUND", `${label}_mismatch`, { payload, bound, not_bound: notBound });
+        }
+        bound.push(label);
+      }
+      let ageMs;
+      if (typeof input.maxAgeMs === "number" && Number.isFinite(input.maxAgeMs)) {
+        const measured = Date.parse(String(payload.measured_at));
+        if (Number.isNaN(measured)) {
+          return fail("POSTURE_STALE", "measured_at_unparseable", { payload });
+        }
+        const now = (input.now || (() => Date.now()))();
+        if (!Number.isFinite(now)) {
+          return fail("POSTURE_STALE", "now_unparseable", { payload });
+        }
+        ageMs = now - measured;
+        if (!Number.isFinite(ageMs)) {
+          return fail("POSTURE_STALE", "measured_at_unparseable", { payload });
+        }
+        if (ageMs < -exports2.POSTURE_CLOCK_SKEW_TOLERANCE_MS) {
+          return fail("POSTURE_STALE", "measured_at_in_future", { payload, age_ms: ageMs });
+        }
+        if (ageMs > input.maxAgeMs) {
+          return fail("POSTURE_STALE", "outside_freshness_window", { payload, age_ms: ageMs });
+        }
+      }
+      return {
+        valid: true,
+        status: "POSTURE_PASS",
+        reason: null,
+        payload,
+        ...ageMs === void 0 ? {} : { age_ms: ageMs },
+        // What this PASS actually proved about the credential boundary — and what
+        // it did not. A caller must not have to infer the difference.
+        bound,
+        not_bound: notBound
+      };
+    }
+  }
+});
+
 // node_modules/@coderifts/agent-guard/dist/cjs/atomic-profile.js
 var require_atomic_profile = __commonJS({
   "node_modules/@coderifts/agent-guard/dist/cjs/atomic-profile.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.ATOMIC_INVARIANTS = exports2.ATOMIC_PROFILE_UNSATISFIED = exports2.GUARD_ATOMIC_WIRE_VALUE = exports2.PROFILE_ENFORCING_ATOMIC_V1 = void 0;
+    exports2.CREDENTIAL_BOUNDARY_BARE_REJECTED = exports2.ATOMIC_V2_MAX_AGE_MS_CAP = exports2.ATOMIC_INVARIANTS = exports2.ATOMIC_PROFILE_UNSATISFIED = exports2.GUARD_ATOMIC_WIRE_VALUE = exports2.PROFILE_ENFORCING_ATOMIC_V2 = exports2.PROFILE_ENFORCING_ATOMIC_V1 = void 0;
     exports2.createMutatorRegister = createMutatorRegister;
     exports2.isEnforcingAtomic = isEnforcingAtomic;
+    exports2.isEnforcingAtomicV2 = isEnforcingAtomicV2;
     exports2.atomicConstructionProblems = atomicConstructionProblems;
     exports2.throwAtomicUnsatisfied = throwAtomicUnsatisfied;
     exports2.atomicOutcome = atomicOutcome;
+    var posture_receipt_js_1 = require_posture_receipt();
     exports2.PROFILE_ENFORCING_ATOMIC_V1 = "ENFORCING_ATOMIC_V1";
+    exports2.PROFILE_ENFORCING_ATOMIC_V2 = "ENFORCING_ATOMIC_V2";
     exports2.GUARD_ATOMIC_WIRE_VALUE = "ENFORCING_ATOMIC";
     exports2.ATOMIC_PROFILE_UNSATISFIED = "ATOMIC_PROFILE_UNSATISFIED";
     exports2.ATOMIC_INVARIANTS = Object.freeze([
@@ -74087,8 +74508,13 @@ var require_atomic_profile = __commonJS({
       return api;
     }
     function isEnforcingAtomic(profile) {
-      return profile === "ENFORCING_ATOMIC" || profile === exports2.PROFILE_ENFORCING_ATOMIC_V1;
+      return profile === "ENFORCING_ATOMIC" || profile === exports2.PROFILE_ENFORCING_ATOMIC_V1 || profile === exports2.PROFILE_ENFORCING_ATOMIC_V2;
     }
+    function isEnforcingAtomicV2(profile) {
+      return profile === exports2.PROFILE_ENFORCING_ATOMIC_V2;
+    }
+    exports2.ATOMIC_V2_MAX_AGE_MS_CAP = 864e5;
+    exports2.CREDENTIAL_BOUNDARY_BARE_REJECTED = "credential_boundary: a verified cr.posture.receipt.v1 is required; a bare assertion is no longer accepted. ENFORCING_ATOMIC_V1 still accepts the bare form and is frozen \u2014 move to _V2 to get this check.";
     function atomicConstructionProblems(input) {
       const problems = [];
       const grant = input.executionGrant;
@@ -74125,6 +74551,42 @@ var require_atomic_profile = __commonJS({
       if (input.credentialBoundary !== true && typeof input.credentialBoundary !== "object") {
         problems.push("credential_boundary: credentialBoundary assertion required");
       }
+      if (isEnforcingAtomicV2(input.profile)) {
+        const cb = input.credentialBoundary;
+        if (cb === true || !cb || typeof cb !== "object" || typeof cb.postureReceipt !== "string") {
+          problems.push(exports2.CREDENTIAL_BOUNDARY_BARE_REJECTED);
+        } else if (!cb.registry && !cb.pinnedKeyPem) {
+          problems.push("credential_boundary: credentialBoundary.registry or .pinnedKeyPem required \u2014 the posture receipt is verified against a caller-supplied key; this package never fetches one.");
+        } else {
+          const deploymentId = typeof cb.deploymentId === "string" ? cb.deploymentId : "";
+          if (deploymentId.length === 0) {
+            problems.push("credential_boundary: credentialBoundary.deploymentId required under ENFORCING_ATOMIC_V2 \u2014 the posture receipt must be bound to this deployment.");
+          }
+          const maxAgeMs = cb.maxAgeMs;
+          const maxAgeOk = typeof maxAgeMs === "number" && Number.isFinite(maxAgeMs) && maxAgeMs > 0 && maxAgeMs <= exports2.ATOMIC_V2_MAX_AGE_MS_CAP;
+          if (typeof maxAgeMs !== "number" || !Number.isFinite(maxAgeMs) || maxAgeMs <= 0) {
+            problems.push("credential_boundary: credentialBoundary.maxAgeMs required under ENFORCING_ATOMIC_V2 \u2014 a finite positive freshness window; the receipt signs measured_at and no expires_at.");
+          } else if (maxAgeMs > exports2.ATOMIC_V2_MAX_AGE_MS_CAP) {
+            problems.push(`credential_boundary: credentialBoundary.maxAgeMs exceeds the ${exports2.ATOMIC_V2_MAX_AGE_MS_CAP}ms cap (24h). A larger window is not a freshness check.`);
+          }
+          if (deploymentId.length > 0 && maxAgeOk) {
+            const r = (0, posture_receipt_js_1.verifyPostureReceipt)(cb.postureReceipt, {
+              registry: cb.registry,
+              pinnedKeyPem: cb.pinnedKeyPem,
+              expectedDeploymentId: deploymentId,
+              expectedExecutorId: input.executorId,
+              expectedAdapterId: input.adapterId,
+              expectedTargetUri: input.targetUri,
+              expectedPolicyHash: input.policyHash,
+              maxAgeMs,
+              now: cb.now
+            });
+            if (!r.valid) {
+              problems.push(`credential_boundary: posture receipt not verified \u2014 ${r.status} (${r.reason}). ` + (r.status === "POSTURE_STALE" ? "This is the caller-supplied freshness window (maxAgeMs), not a receipt-carried expiry: cr.posture.receipt.v1 signs measured_at and no expires_at." : r.status === "POSTURE_FAIL" ? "The signature verified; the posture did not. A signed FAIL is a drift artifact \u2014 the boundary regressed, the receipt is intact." : "Supply a posture receipt signed by a key in the registry, bound to this deployment_id, with verdict PASS."));
+            }
+          }
+        }
+      }
       return problems;
     }
     function throwAtomicUnsatisfied(problems) {
@@ -74153,11 +74615,13 @@ var require_with_coderifts = __commonJS({
   "node_modules/@coderifts/agent-guard/dist/cjs/with-coderifts.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.PROFILE_ENFORCING_ATOMIC_V1 = exports2.PROFILE_ENFORCING_STRICT_V1 = void 0;
+    exports2.UNVERSIONED_PROFILE_NOTICE = exports2.PROFILE_ENFORCING_ATOMIC_V2 = exports2.PROFILE_ENFORCING_ATOMIC_V1 = exports2.PROFILE_ENFORCING_STRICT_V1 = void 0;
     exports2.foldTableSettledCalls = foldTableSettledCalls;
     exports2.guardedFractionAmongRoutes = guardedFractionAmongRoutes;
+    exports2._resetUnversionedProfileNoticeForTest = _resetUnversionedProfileNoticeForTest;
     exports2.withCodeRifts = withCodeRifts;
     var tool_registry_js_1 = require_tool_registry();
+    var execution_grant_js_1 = require_execution_grant2();
     var coverage_observed_js_1 = require_coverage_observed();
     var atomic_profile_js_1 = require_atomic_profile();
     function foldTableSettledCalls(events) {
@@ -74185,9 +74649,13 @@ var require_with_coderifts = __commonJS({
     Object.defineProperty(exports2, "PROFILE_ENFORCING_ATOMIC_V1", { enumerable: true, get: function() {
       return atomic_profile_js_2.PROFILE_ENFORCING_ATOMIC_V1;
     } });
+    Object.defineProperty(exports2, "PROFILE_ENFORCING_ATOMIC_V2", { enumerable: true, get: function() {
+      return atomic_profile_js_2.PROFILE_ENFORCING_ATOMIC_V2;
+    } });
     var ACCEPTED_PROFILES = Object.freeze([
       "ENFORCING_STRICT_V1",
       "ENFORCING_STRICT",
+      "ENFORCING_ATOMIC_V2",
       "ENFORCING_ATOMIC_V1",
       "ENFORCING_ATOMIC"
     ]);
@@ -74211,6 +74679,19 @@ var require_with_coderifts = __commonJS({
     function isEnforcingStrict(input) {
       return input.profile === "ENFORCING_STRICT" || input.profile === exports2.PROFILE_ENFORCING_STRICT_V1;
     }
+    exports2.UNVERSIONED_PROFILE_NOTICE = "ENFORCING_STRICT is the unversioned spelling of ENFORCING_STRICT_V1; prefer the versioned name.";
+    var noticedUnversionedProfile = false;
+    function _resetUnversionedProfileNoticeForTest() {
+      noticedUnversionedProfile = false;
+    }
+    function noticeUnversionedProfileOnce(profile) {
+      if (profile !== "ENFORCING_STRICT")
+        return;
+      if (noticedUnversionedProfile)
+        return;
+      noticedUnversionedProfile = true;
+      console.warn(exports2.UNVERSIONED_PROFILE_NOTICE);
+    }
     function enforcingStrictExecutionChainProblems(input) {
       const grant = input.executionGrant;
       const enabled = !!(grant && grant.enabled === true);
@@ -74441,6 +74922,7 @@ var require_with_coderifts = __commonJS({
       if (!input || typeof input !== "object") {
         throw new Error("withCodeRifts: input object is required");
       }
+      noticeUnversionedProfileOnce(input.profile);
       const problems = [];
       if (typeof input.operation !== "string" || input.operation.trim() === "") {
         problems.push("`operation` is required and must be a non-empty string (receipts bind to an operation; merge != deploy, so there is no safe default)");
@@ -74465,16 +74947,21 @@ var require_with_coderifts = __commonJS({
         problems.push(...enforcingStrictExecutionChainProblems(input));
       }
       if ((0, atomic_profile_js_1.isEnforcingAtomic)(input.profile)) {
+        const v2 = (0, execution_grant_js_1.resolveV2Fields)(input);
         const atomicProblems = (0, atomic_profile_js_1.atomicConstructionProblems)({
           executionGrant: input.executionGrant,
-          executorId: input.executorId,
-          adapterId: input.adapterId,
-          targetUri: input.targetUri,
+          executorId: v2.executorId,
+          adapterId: v2.adapterId,
+          targetUri: v2.targetUri,
+          // Previously never forwarded, so the posture verifier's policy_hash
+          // binding could not fire no matter what the caller configured.
+          policyHash: v2.policyHash,
           executorAttestation: input.executorAttestation,
           mutatorRegister: input.mutatorRegister,
           casAdapter: input.casAdapter,
           readBack: input.readBack,
-          credentialBoundary: input.credentialBoundary
+          credentialBoundary: input.credentialBoundary,
+          profile: input.profile
         });
         if (atomicProblems.length > 0)
           (0, atomic_profile_js_1.throwAtomicUnsatisfied)(atomicProblems);
@@ -74553,6 +75040,7 @@ var require_with_coderifts = __commonJS({
       }
       if (input.executionGrant !== void 0) {
         guard.executionGrant = input.executionGrant;
+        Object.assign(guard, (0, execution_grant_js_1.resolveV2Fields)(input));
       }
       const strict = isEnforcingStrict(input);
       if (strict) {
@@ -75105,49 +75593,140 @@ var require_gemini = __commonJS({
   }
 });
 
-// node_modules/@coderifts/agent-guard/dist/cjs/execute-tool-call.js
-var require_execute_tool_call = __commonJS({
-  "node_modules/@coderifts/agent-guard/dist/cjs/execute-tool-call.js"(exports2) {
+// node_modules/@coderifts/agent-guard/dist/cjs/adapters/langchain.js
+var require_langchain = __commonJS({
+  "node_modules/@coderifts/agent-guard/dist/cjs/adapters/langchain.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.isGuardOutcome = isGuardOutcome;
-    exports2.executeProtectedTool = executeProtectedTool;
-    exports2.surfaceEnvelopeFields = surfaceEnvelopeFields;
-    exports2.executeOpenAIToolCall = executeOpenAIToolCall;
-    exports2.executeAnthropicToolCall = executeAnthropicToolCall;
-    exports2.executeGeminiToolCall = executeGeminiToolCall;
-    exports2.executeLangGraphToolCall = executeLangGraphToolCall;
-    var execution_proof_js_1 = require_execution_proof();
-    var openai_js_1 = require_openai();
-    var anthropic_js_1 = require_anthropic();
-    var gemini_js_1 = require_gemini();
-    var langgraph_js_1 = require_langgraph();
-    function resolveProtectedTools(table) {
-      if (Array.isArray(table))
-        return table;
-      if (table && typeof table === "object") {
-        const bag = table;
-        if (Array.isArray(bag.protected_tools) && bag.protected_tools.length > 0) {
-          return bag.protected_tools;
-        }
-        if (Array.isArray(bag.tools)) {
-          const withExecute = bag.tools.filter((t) => t && typeof t === "object" && typeof t.execute === "function");
-          if (withExecute.length > 0)
-            return withExecute;
-        }
+    exports2.LANGCHAIN_ARTIFACT_SPEC = void 0;
+    exports2.defaultSerializeLangChainToolResult = defaultSerializeLangChainToolResult;
+    exports2.bindLangChainToolOutcome = bindLangChainToolOutcome;
+    var final_answer_proof_js_1 = require_final_answer_proof();
+    var gate_refusal_js_1 = require_gate_refusal();
+    function defaultSerializeLangChainToolResult(result) {
+      if (typeof result === "string")
+        return result;
+      if (typeof result === "number" || typeof result === "boolean" || typeof result === "bigint" || result === null || result === void 0) {
+        return String(result);
+      }
+      try {
+        return JSON.stringify(result);
+      } catch {
+        return String(result);
       }
-      return [];
     }
-    function findTool(table, name) {
-      const tools = resolveProtectedTools(table);
-      return tools.find((t) => t && t.name === name);
+    exports2.LANGCHAIN_ARTIFACT_SPEC = "coderifts-guard-artifact.v1";
+    function bindLangChainToolOutcome(outcome, args) {
+      const serialize = args.serialize ?? defaultSerializeLangChainToolResult;
+      let body;
+      if (outcome.executed === true) {
+        body = serialize(outcome.result);
+      } else if (outcome.executionAttempted === false) {
+        body = (0, gate_refusal_js_1.formatGateRefusalBody)(outcome);
+      } else {
+        const err = "error" in outcome ? outcome.error : void 0;
+        const kind = (0, gate_refusal_js_1.verdictKind)(outcome);
+        body = `Tool execution failed after gate decision (verdict: ${kind}): ${(0, gate_refusal_js_1.formatGuardError)(err)}`;
+      }
+      const content = args.attachProof === false ? body : (0, final_answer_proof_js_1.attachProofToAgentResponse)(body, outcome.proof);
+      const out = {
+        content,
+        artifact: {
+          artifact_spec: exports2.LANGCHAIN_ARTIFACT_SPEC,
+          final_answer_proof: outcome.proof,
+          executed: outcome.executed === true,
+          enforced: outcome.enforced === true,
+          verdict: (0, gate_refusal_js_1.verdictKind)(outcome)
+        },
+        tool_call_id: args.tool_call_id
+      };
+      if (args.name != null && args.name !== "") {
+        out.name = args.name;
+      }
+      return out;
     }
-    function isGuardOutcome(x) {
+  }
+});
+
+// node_modules/@coderifts/agent-guard/dist/cjs/adapters/crewai.js
+var require_crewai = __commonJS({
+  "node_modules/@coderifts/agent-guard/dist/cjs/adapters/crewai.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.defaultSerializeCrewAIToolResult = defaultSerializeCrewAIToolResult;
+    exports2.bindCrewAIToolOutcome = bindCrewAIToolOutcome;
+    var final_answer_proof_js_1 = require_final_answer_proof();
+    var gate_refusal_js_1 = require_gate_refusal();
+    function defaultSerializeCrewAIToolResult(result) {
+      if (typeof result === "string")
+        return result;
+      if (typeof result === "number" || typeof result === "boolean" || typeof result === "bigint" || result === null || result === void 0) {
+        return String(result);
+      }
+      try {
+        return JSON.stringify(result);
+      } catch {
+        return String(result);
+      }
+    }
+    function bindCrewAIToolOutcome(outcome, args) {
+      const serialize = args.serialize ?? defaultSerializeCrewAIToolResult;
+      let body;
+      let resultAsAnswer;
+      if (outcome.executed === true) {
+        body = serialize(outcome.result);
+        resultAsAnswer = false;
+      } else if (outcome.executionAttempted === false) {
+        body = (0, gate_refusal_js_1.formatGateRefusalBody)(outcome);
+        resultAsAnswer = true;
+      } else {
+        const err = "error" in outcome ? outcome.error : void 0;
+        const kind = (0, gate_refusal_js_1.verdictKind)(outcome);
+        body = `Tool execution failed after gate decision (verdict: ${kind}): ${(0, gate_refusal_js_1.formatGuardError)(err)}`;
+        resultAsAnswer = true;
+      }
+      const result = args.attachProof === false ? body : (0, final_answer_proof_js_1.attachProofToAgentResponse)(body, outcome.proof);
+      const out = {
+        result,
+        result_as_answer: resultAsAnswer,
+        tool_name: args.tool_name,
+        final_answer_proof: outcome.proof
+      };
+      return out;
+    }
+  }
+});
+
+// node_modules/@coderifts/agent-guard/dist/cjs/adapters/vercel.js
+var require_vercel = __commonJS({
+  "node_modules/@coderifts/agent-guard/dist/cjs/adapters/vercel.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.protectedToolToVercel = protectedToolToVercel;
+    exports2.toVercelTools = toVercelTools;
+    exports2.withCodeRiftsVercel = withCodeRiftsVercel;
+    exports2.vercelToolAdapter = vercelToolAdapter;
+    exports2.defaultSerializeVercelToolResult = defaultSerializeVercelToolResult;
+    exports2.bindVercelGuardOutcome = bindVercelGuardOutcome;
+    var with_coderifts_js_1 = require_with_coderifts();
+    var execution_proof_js_1 = require_execution_proof();
+    var final_answer_proof_js_1 = require_final_answer_proof();
+    var gate_refusal_js_1 = require_gate_refusal();
+    var EMPTY_PARAMETERS = Object.freeze({
+      type: "object",
+      properties: {}
+    });
+    function looksLikeGuardOutcome(x) {
       if (!x || typeof x !== "object")
         return false;
       const o = x;
       return typeof o.executed === "boolean" && typeof o.executionAttempted === "boolean" && o.proof != null && typeof o.proof === "object" && o.verdict != null && typeof o.verdict === "object";
     }
+    function toolCallIdFromOptions(options) {
+      if (options && typeof options.toolCallId === "string")
+        return options.toolCallId;
+      return "";
+    }
     var FRESHNESS_NOT_CONFIGURED = Object.freeze({
       wiring: "NOT_CONFIGURED",
       write_style: false,
@@ -75159,14 +75738,7 @@ var require_execute_tool_call = __commonJS({
       write_style: false,
       mutating: false
     });
-    function notObserved() {
-      return {
-        status: "not_observed",
-        observed_at: (/* @__PURE__ */ new Date()).toISOString(),
-        host_attestation: "absent"
-      };
-    }
-    function unknownToolOutcome(toolName) {
+    function guardedNonOutcomeRefusal(toolName) {
       const verdict = {
         kind: "UNAVAILABLE",
         cause: "CONFIG_ERROR",
@@ -75176,7 +75748,197 @@ var require_execute_tool_call = __commonJS({
         decisionMissing: true,
         unavailableCount: 1
       };
-      const commit_observation = notObserved();
+      const commit_observation = {
+        status: "not_observed",
+        observed_at: (/* @__PURE__ */ new Date()).toISOString(),
+        host_attestation: "absent"
+      };
+      const proof = (0, execution_proof_js_1.buildExecutionProof)({
+        preflighted: false,
+        executionAttempted: false,
+        executed: false,
+        enforced: false,
+        verdict,
+        commitObservation: commit_observation
+      });
+      void toolName;
+      return {
+        executionAttempted: false,
+        executed: false,
+        enforced: false,
+        verdict,
+        preflighted: false,
+        proof,
+        freshness: FRESHNESS_NOT_CONFIGURED,
+        conditional_write: CW_NOT_REPORTED,
+        commit_observation
+      };
+    }
+    function protectedToolToVercel(tool) {
+      const parameters = tool.inputSchema != null && typeof tool.inputSchema === "object" && !Array.isArray(tool.inputSchema) ? tool.inputSchema : { ...EMPTY_PARAMETERS };
+      const execute = async (args, options) => {
+        const raw = await Promise.resolve().then(() => tool.execute(args));
+        const bindArgs = {
+          toolCallId: toolCallIdFromOptions(options),
+          toolName: tool.name
+        };
+        if (looksLikeGuardOutcome(raw)) {
+          return bindVercelGuardOutcome(raw, bindArgs).result;
+        }
+        if (tool._coderifts && tool._coderifts.guarded) {
+          return bindVercelGuardOutcome(guardedNonOutcomeRefusal(tool.name), bindArgs).result;
+        }
+        return raw;
+      };
+      const out = {
+        parameters,
+        execute
+      };
+      if (tool.description != null && tool.description !== "") {
+        out.description = tool.description;
+      }
+      return out;
+    }
+    function toVercelTools(protectedTools) {
+      const out = {};
+      for (const t of protectedTools) {
+        out[t.name] = protectedToolToVercel(t);
+      }
+      return out;
+    }
+    function withCodeRiftsVercel(input) {
+      const core = (0, with_coderifts_js_1.withCodeRifts)(input);
+      return vercelToolAdapter(core);
+    }
+    function vercelToolAdapter(result) {
+      const protected_tools = result.tools;
+      const tools = toVercelTools(protected_tools);
+      const out = {
+        tools,
+        protected_tools,
+        registry_report: result.registry_report,
+        composition_assurance: result.composition_assurance,
+        receipt_thread: result.receipt_thread,
+        coverage_observed: result.coverage_observed
+      };
+      if (result.repository !== void 0) {
+        out.repository = result.repository;
+      }
+      return out;
+    }
+    function defaultSerializeVercelToolResult(result) {
+      if (typeof result === "string")
+        return result;
+      if (typeof result === "number" || typeof result === "boolean" || typeof result === "bigint" || result === null || result === void 0) {
+        return String(result);
+      }
+      try {
+        return JSON.stringify(result);
+      } catch {
+        return String(result);
+      }
+    }
+    function bindVercelGuardOutcome(outcome, args) {
+      const toolCallId = args.toolCallId;
+      const serialize = args.serialize ?? defaultSerializeVercelToolResult;
+      let body;
+      if (outcome.executed === true) {
+        body = serialize(outcome.result);
+      } else if (outcome.executionAttempted === false) {
+        body = (0, gate_refusal_js_1.formatGateRefusalBody)(outcome);
+      } else {
+        const err = "error" in outcome ? outcome.error : void 0;
+        const kind = (0, gate_refusal_js_1.verdictKind)(outcome);
+        body = `Tool execution failed after gate decision (verdict: ${kind}): ${(0, gate_refusal_js_1.formatGuardError)(err)}`;
+      }
+      const result = args.attachProof === false ? body : (0, final_answer_proof_js_1.attachProofToAgentResponse)(body, outcome.proof);
+      const part = {
+        type: "tool-result",
+        toolCallId,
+        result
+      };
+      if (args.toolName != null && args.toolName !== "") {
+        part.toolName = args.toolName;
+      }
+      return part;
+    }
+  }
+});
+
+// node_modules/@coderifts/agent-guard/dist/cjs/execute-tool-call.js
+var require_execute_tool_call = __commonJS({
+  "node_modules/@coderifts/agent-guard/dist/cjs/execute-tool-call.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.isGuardOutcome = isGuardOutcome;
+    exports2.executeProtectedTool = executeProtectedTool;
+    exports2.surfaceEnvelopeFields = surfaceEnvelopeFields;
+    exports2.executeOpenAIToolCall = executeOpenAIToolCall;
+    exports2.executeAnthropicToolCall = executeAnthropicToolCall;
+    exports2.executeGeminiToolCall = executeGeminiToolCall;
+    exports2.executeLangGraphToolCall = executeLangGraphToolCall;
+    exports2.executeVercelToolCall = executeVercelToolCall;
+    var execution_proof_js_1 = require_execution_proof();
+    var openai_js_1 = require_openai();
+    var anthropic_js_1 = require_anthropic();
+    var gemini_js_1 = require_gemini();
+    var langgraph_js_1 = require_langgraph();
+    var vercel_js_1 = require_vercel();
+    function resolveProtectedTools(table) {
+      if (Array.isArray(table))
+        return table;
+      if (table && typeof table === "object") {
+        const bag = table;
+        if (Array.isArray(bag.protected_tools) && bag.protected_tools.length > 0) {
+          return bag.protected_tools;
+        }
+        if (Array.isArray(bag.tools)) {
+          const withExecute = bag.tools.filter((t) => t && typeof t === "object" && typeof t.execute === "function");
+          if (withExecute.length > 0)
+            return withExecute;
+        }
+      }
+      return [];
+    }
+    function findTool(table, name) {
+      const tools = resolveProtectedTools(table);
+      return tools.find((t) => t && t.name === name);
+    }
+    function isGuardOutcome(x) {
+      if (!x || typeof x !== "object")
+        return false;
+      const o = x;
+      return typeof o.executed === "boolean" && typeof o.executionAttempted === "boolean" && o.proof != null && typeof o.proof === "object" && o.verdict != null && typeof o.verdict === "object";
+    }
+    var FRESHNESS_NOT_CONFIGURED = Object.freeze({
+      wiring: "NOT_CONFIGURED",
+      write_style: false,
+      require_freshness: false
+    });
+    var CW_NOT_REPORTED = Object.freeze({
+      conditional_write: "not_reported",
+      require_conditional_write: false,
+      write_style: false,
+      mutating: false
+    });
+    function notObserved() {
+      return {
+        status: "not_observed",
+        observed_at: (/* @__PURE__ */ new Date()).toISOString(),
+        host_attestation: "absent"
+      };
+    }
+    function unknownToolOutcome(toolName) {
+      const verdict = {
+        kind: "UNAVAILABLE",
+        cause: "CONFIG_ERROR",
+        failPolicy: "closed",
+        resolution: "CLOSED",
+        action: "STOP",
+        decisionMissing: true,
+        unavailableCount: 1
+      };
+      const commit_observation = notObserved();
       const proof = (0, execution_proof_js_1.buildExecutionProof)({
         preflighted: false,
         executionAttempted: false,
@@ -75382,6 +76144,26 @@ var require_execute_tool_call = __commonJS({
       }
       return bound;
     }
+    async function executeVercelToolCall(args) {
+      const callArgs = parseMaybeJsonArgs(args.arguments);
+      const outcome = await executeProtectedTool(args.tools, args.name, callArgs);
+      const bound = (0, vercel_js_1.bindVercelGuardOutcome)(outcome, {
+        toolCallId: args.toolCallId,
+        toolName: args.name,
+        serialize: args.serialize
+      });
+      if (outcome.executionAttempted === false) {
+        const result = appendEnvelopeSurface(bound.result, outcome);
+        const part = {
+          type: "tool-result",
+          toolCallId: args.toolCallId,
+          toolName: args.name,
+          result
+        };
+        return part;
+      }
+      return bound;
+    }
     function parseMaybeJsonArgs(args) {
       if (typeof args === "string") {
         const s = args.trim();
@@ -75611,9 +76393,9 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.monitorAttestSigningInput = exports2.kidFromMonitoringAttestation = exports2.tryIssueMonitoringAttestation = exports2.DEFAULT_MONITORING_SINK_TIMEOUT_MS = exports2.ackBytes = exports2.verifyAckHmac = exports2.monitoringDeliveryFailClosed = exports2.formatMonitoringDeliveryLine = exports2.deliverMonitoring = exports2.hashObservedContent = exports2.observeCommit = exports2.deriveKeySignal = exports2.pathClass = exports2.classifyCommand = exports2.projectState = exports2.emptySessionState = exports2.computeTainted = exports2.evaluate = exports2.updateSession = exports2.SESSION_TAINT_VERSION = exports2.SessionTaintTracker = exports2.readDecision = exports2.EXECUTION_TIME_FP_REASONS = exports2.EXECUTION_STATE_UNMEASURABLE_NOTE = exports2.isUnmeasurableExecutionStateReason = exports2.computeCanonicalBundleFingerprint = exports2.authorizedFingerprintFromEnvelope = exports2.checkExecutionTimeFingerprint = exports2.computeBundleFingerprint = exports2.computeArtifactDigest = exports2.evaluateEnvelope = exports2.RECEIPT_PREV_NULL = exports2.decodeReceiptBodyPrev = exports2.previousReceiptCommitment = exports2.verifyReceiptChainLinkage = exports2.canonicalJson = exports2.computeBodyHash = exports2.bindReceiptToEnvelope = exports2.DETECTOR_VERSION = exports2.builtinDetector = exports2.resetPolicyWarnForTests = exports2.warnPolicyAbsentOnce = exports2.observePolicyPresence = exports2.detectPolicyPresence = exports2.policyPresenceOf = exports2.withPolicy = exports2.POLICY_ABSENT_WARN = exports2.POLICY_MARKER = exports2.CODERIFTS_POLICY = exports2.guardToolCall = void 0;
     exports2.createDbVersionToken = exports2.API_ABSENT_TOKEN = exports2.API_VERSION_TOKEN_PREFIX = exports2.apiTokenRaw = exports2.writeApiIfUnchanged = exports2.createApiVersionToken = exports2.identitiesEqual = exports2.fsObjectIdentity = exports2.UnsafeCasPathError = exports2.assertSafeCasPath = exports2.FS_ABSENT_TOKEN = exports2.FS_VERSION_TOKEN_PREFIX = exports2.fsTokenContentHash = exports2.createFsPriorContentResolver = exports2.writeFileIfUnchanged = exports2.readVersionedFile = exports2.createFsVersionToken = exports2.StaleVersionTokenAbort = exports2.executeIfUnchanged = exports2.RESIDUAL_UNCONDITIONAL_WRITE = exports2.conditionalWriteResidual = exports2.tokensEqual = exports2.buildConditionalWriteBasis = exports2.buildFreshnessBasis = exports2.collectFreshnessCallContext = exports2.artifactIdsForResolve = exports2.isMutatingCall = exports2.isWriteStyleCall = exports2.freshnessAllowsEnforce = exports2.computePathSetTreeHash = exports2.contentByteIdentical = exports2.assessWriteStylePrior = exports2.assessFreshness = exports2.deriveProofBanner = exports2.attachProofToAgentResponse = exports2.renderFinalAnswerProof = exports2.EXECUTION_PROOF_SPEC = exports2.assertEnforcedReceiptInvariant = exports2.hashExecutionResult = exports2.buildExecutionProof = exports2.COVERAGE_ATTEST_ENVELOPE_TAG = exports2.COVERAGE_ATTEST_SIGNING_PREFIX = exports2.COVERAGE_ATTEST_VERSION = exports2.coverageAttestSigningInput = exports2.kidFromCoverageAttestation = exports2.tryIssueCoverageAttestation = exports2.MONITOR_ATTEST_ENVELOPE_TAG = exports2.MONITOR_ATTEST_SIGNING_PREFIX = exports2.MONITOR_ATTEST_VERSION = exports2.receiptDigestOfToken = void 0;
-    exports2.guardedFractionAmongRoutes = exports2.foldTableSettledCalls = exports2.withCodeRifts = exports2.AUTO_DERIVE_READ_TIMEOUT_MS = exports2.AUTO_DERIVE_SOURCE = exports2.defaultFsReader = exports2.normalizeAutoDerive = exports2.runAutoDerive = exports2.AUTO_RECHECK_MAX_CAP = exports2.clampMaxAttempts = exports2.normalizeAutoRecheck = exports2.runAutoRecheckLoop = exports2.coverageReport = exports2.DEPLOY_REPAIRABLE_REASONS = exports2.bindDeploy = exports2.verifyDeployReceiptToken = exports2.DEPLOY_RECEIPT_VIEW_SPEC = exports2.isVerifiedDeployReceiptView = exports2.asVerifiedDeployReceiptView = exports2.deployGate = exports2.gateDecision = exports2.RegistryConstructionError = exports2.guardToolRegistry = exports2.globToRegExp = exports2.matchGlob = exports2.blobMapKey = exports2.classifyByName = exports2.resolveArtifacts = exports2.REMEDIATION_LOOP_ATTESTATION_SPEC = exports2.isCasAttestation = exports2.readPriorBlockRemediation = exports2.readRemediationTransaction = exports2.buildRemediationLoopAttestation = exports2.COMMIT_EVIDENCE_MISSING = exports2.CAS_ATTESTATION_SPEC = exports2.strictCommitObservation = exports2.extractExecutorAttestationToken = exports2.evaluateCasEvidence = exports2.isExecuteIfUnchangedOutcome = exports2.isGuardExecutionProof = exports2.buildCasAttestation = exports2.REGISTRY_ABSENT_TOKEN = exports2.REGISTRY_VERSION_TOKEN_PREFIX = exports2.registryTokenRaw = exports2.writeRegistryIfUnchanged = exports2.createRegistryVersionToken = exports2.DB_ABSENT_TOKEN = exports2.DB_VERSION_TOKEN_PREFIX = exports2.dbTokenRaw = exports2.writeDbIfUnchanged = void 0;
-    exports2.executeAnthropicToolCall = exports2.executeOpenAIToolCall = exports2.executeProtectedTool = exports2.defaultSerializeGeminiToolResult = exports2.bindGeminiGuardOutcome = exports2.protectedToolToFunctionDeclaration = exports2.toGeminiTools = exports2.geminiToolAdapter = exports2.withCodeRiftsGemini = exports2.measureFsAuthorizationToken = exports2.measureFsAuthorization = exports2.wrapWriteWithFsCas = exports2.inferFullFileWriteContent = exports2.inferFsPathFromArgs = exports2.FRESHNESS_RESOLVER_FIX = exports2.freshnessRefusalTeaching = exports2.formatGateRefusalBody = exports2.defaultSerializeLangGraphToolResult = exports2.bindLangGraphGuardOutcome = exports2.LangGraphToolsNotStructuredError = exports2.isLangGraphReactAgentTool = exports2.bindLangGraphTools = exports2.protectedToolToLangGraph = exports2.toLangGraphTools = exports2.langGraphToolAdapter = exports2.withCodeRiftsLangGraph = exports2.defaultSerializeAnthropicToolResult = exports2.bindAnthropicGuardOutcome = exports2.protectedToolToAnthropic = exports2.toAnthropicTools = exports2.anthropicToolAdapter = exports2.withCodeRiftsAnthropic = exports2.defaultSerializeOpenAIToolResult = exports2.bindOpenAIGuardOutcome = exports2.protectedToolToOpenAI = exports2.toOpenAITools = exports2.openAIToolAdapter = exports2.withCodeRiftsOpenAI = exports2.formatCoverageObservedLine = exports2.freezeCoverageObserved = exports2.createCoverageObserver = exports2.readExecutionGrantToken = exports2.isExecutionGrantEnabled = exports2.isEnforcingAtomic = exports2.atomicOutcome = exports2.ATOMIC_PROFILE_UNSATISFIED = exports2.ATOMIC_INVARIANTS = exports2.createMutatorRegister = exports2.PROFILE_ENFORCING_ATOMIC_V1 = exports2.PROFILE_ENFORCING_STRICT_V1 = void 0;
-    exports2.kidFromToolsetAttestation = exports2.tryIssueToolsetAttestation = exports2.toolsetAttestSigningInput = exports2.declarationEntriesFromTools = exports2.computeToolsetDigest = exports2.TOOLSET_ATTEST_STATEMENT = exports2.TOOLSET_ATTEST_ENVELOPE_TAG = exports2.TOOLSET_ATTEST_SIGNING_PREFIX = exports2.TOOLSET_ATTEST_VERSION = exports2.surfaceEnvelopeFields = exports2.isGuardOutcome = exports2.executeLangGraphToolCall = exports2.executeGeminiToolCall = void 0;
+    exports2.AUTO_DERIVE_READ_TIMEOUT_MS = exports2.AUTO_DERIVE_SOURCE = exports2.defaultFsReader = exports2.normalizeAutoDerive = exports2.runAutoDerive = exports2.AUTO_RECHECK_MAX_CAP = exports2.clampMaxAttempts = exports2.normalizeAutoRecheck = exports2.runAutoRecheckLoop = exports2.coverageReport = exports2.DEPLOY_REPAIRABLE_REASONS = exports2.bindDeploy = exports2.NEXT_STEP_NOTE = exports2.NEXT_AGENT_ACTIONS = exports2.readNextAgentStep = exports2.verifyDeployReceiptToken = exports2.DEPLOY_RECEIPT_VIEW_SPEC = exports2.isVerifiedDeployReceiptView = exports2.asVerifiedDeployReceiptView = exports2.deployGate = exports2.gateDecision = exports2.RegistryConstructionError = exports2.guardToolRegistry = exports2.globToRegExp = exports2.matchGlob = exports2.blobMapKey = exports2.classifyByName = exports2.resolveArtifacts = exports2.REMEDIATION_LOOP_ATTESTATION_SPEC = exports2.isCasAttestation = exports2.readPriorBlockRemediation = exports2.readRemediationTransaction = exports2.buildRemediationLoopAttestation = exports2.COMMIT_EVIDENCE_MISSING = exports2.CAS_ATTESTATION_SPEC = exports2.strictCommitObservation = exports2.extractExecutorAttestationToken = exports2.evaluateCasEvidence = exports2.isExecuteIfUnchangedOutcome = exports2.isGuardExecutionProof = exports2.buildCasAttestation = exports2.REGISTRY_ABSENT_TOKEN = exports2.REGISTRY_VERSION_TOKEN_PREFIX = exports2.registryTokenRaw = exports2.writeRegistryIfUnchanged = exports2.createRegistryVersionToken = exports2.DB_ABSENT_TOKEN = exports2.DB_VERSION_TOKEN_PREFIX = exports2.dbTokenRaw = exports2.writeDbIfUnchanged = void 0;
+    exports2.inferFsPathFromArgs = exports2.FRESHNESS_RESOLVER_FIX = exports2.freshnessRefusalTeaching = exports2.formatGateRefusalBody = exports2.defaultSerializeLangGraphToolResult = exports2.bindLangGraphGuardOutcome = exports2.LangGraphToolsNotStructuredError = exports2.isLangGraphReactAgentTool = exports2.bindLangGraphTools = exports2.protectedToolToLangGraph = exports2.toLangGraphTools = exports2.langGraphToolAdapter = exports2.withCodeRiftsLangGraph = exports2.defaultSerializeAnthropicToolResult = exports2.bindAnthropicGuardOutcome = exports2.protectedToolToAnthropic = exports2.toAnthropicTools = exports2.anthropicToolAdapter = exports2.withCodeRiftsAnthropic = exports2.defaultSerializeOpenAIToolResult = exports2.bindOpenAIGuardOutcome = exports2.protectedToolToOpenAI = exports2.toOpenAITools = exports2.openAIToolAdapter = exports2.withCodeRiftsOpenAI = exports2.formatCoverageObservedLine = exports2.freezeCoverageObserved = exports2.createCoverageObserver = exports2.readExecutionGrantToken = exports2.isExecutionGrantEnabled = exports2.POSTURE_CLOCK_SKEW_TOLERANCE_MS = exports2.POSTURE_RECEIPT_V = exports2.verifyPostureReceipt = exports2.ATOMIC_V2_MAX_AGE_MS_CAP = exports2.CREDENTIAL_BOUNDARY_BARE_REJECTED = exports2.atomicConstructionProblems = exports2.isEnforcingAtomicV2 = exports2.PROFILE_ENFORCING_ATOMIC_V2 = exports2.isEnforcingAtomic = exports2.atomicOutcome = exports2.ATOMIC_PROFILE_UNSATISFIED = exports2.ATOMIC_INVARIANTS = exports2.createMutatorRegister = exports2._resetUnversionedProfileNoticeForTest = exports2.UNVERSIONED_PROFILE_NOTICE = exports2.PROFILE_ENFORCING_ATOMIC_V1 = exports2.PROFILE_ENFORCING_STRICT_V1 = exports2.guardedFractionAmongRoutes = exports2.foldTableSettledCalls = exports2.withCodeRifts = void 0;
+    exports2.kidFromToolsetAttestation = exports2.tryIssueToolsetAttestation = exports2.toolsetAttestSigningInput = exports2.declarationEntriesFromTools = exports2.computeToolsetDigest = exports2.TOOLSET_ATTEST_STATEMENT = exports2.TOOLSET_ATTEST_ENVELOPE_TAG = exports2.TOOLSET_ATTEST_SIGNING_PREFIX = exports2.TOOLSET_ATTEST_VERSION = exports2.surfaceEnvelopeFields = exports2.isGuardOutcome = exports2.executeVercelToolCall = exports2.executeLangGraphToolCall = exports2.executeGeminiToolCall = exports2.executeAnthropicToolCall = exports2.executeOpenAIToolCall = exports2.executeProtectedTool = exports2.defaultSerializeVercelToolResult = exports2.bindVercelGuardOutcome = exports2.protectedToolToVercel = exports2.toVercelTools = exports2.vercelToolAdapter = exports2.withCodeRiftsVercel = exports2.defaultSerializeCrewAIToolResult = exports2.bindCrewAIToolOutcome = exports2.LANGCHAIN_ARTIFACT_SPEC = exports2.defaultSerializeLangChainToolResult = exports2.bindLangChainToolOutcome = exports2.defaultSerializeGeminiToolResult = exports2.bindGeminiGuardOutcome = exports2.protectedToolToFunctionDeclaration = exports2.toGeminiTools = exports2.geminiToolAdapter = exports2.withCodeRiftsGemini = exports2.measureFsAuthorizationToken = exports2.measureFsAuthorization = exports2.wrapWriteWithFsCas = exports2.inferFullFileWriteContent = void 0;
     var guard_js_1 = require_guard();
     Object.defineProperty(exports2, "guardToolCall", { enumerable: true, get: function() {
       return guard_js_1.guardToolCall;
@@ -76048,6 +76830,16 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "verifyDeployReceiptToken", { enumerable: true, get: function() {
       return deploy_receipt_token_js_1.verifyDeployReceiptToken;
     } });
+    var next_agent_step_js_1 = require_next_agent_step();
+    Object.defineProperty(exports2, "readNextAgentStep", { enumerable: true, get: function() {
+      return next_agent_step_js_1.readNextAgentStep;
+    } });
+    Object.defineProperty(exports2, "NEXT_AGENT_ACTIONS", { enumerable: true, get: function() {
+      return next_agent_step_js_1.NEXT_AGENT_ACTIONS;
+    } });
+    Object.defineProperty(exports2, "NEXT_STEP_NOTE", { enumerable: true, get: function() {
+      return next_agent_step_js_1.NEXT_STEP_NOTE;
+    } });
     var deploy_bind_js_1 = require_deploy_bind();
     Object.defineProperty(exports2, "bindDeploy", { enumerable: true, get: function() {
       return deploy_bind_js_1.bindDeploy;
@@ -76104,6 +76896,12 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "PROFILE_ENFORCING_ATOMIC_V1", { enumerable: true, get: function() {
       return with_coderifts_js_1.PROFILE_ENFORCING_ATOMIC_V1;
     } });
+    Object.defineProperty(exports2, "UNVERSIONED_PROFILE_NOTICE", { enumerable: true, get: function() {
+      return with_coderifts_js_1.UNVERSIONED_PROFILE_NOTICE;
+    } });
+    Object.defineProperty(exports2, "_resetUnversionedProfileNoticeForTest", { enumerable: true, get: function() {
+      return with_coderifts_js_1._resetUnversionedProfileNoticeForTest;
+    } });
     var atomic_profile_js_1 = require_atomic_profile();
     Object.defineProperty(exports2, "createMutatorRegister", { enumerable: true, get: function() {
       return atomic_profile_js_1.createMutatorRegister;
@@ -76120,6 +76918,31 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "isEnforcingAtomic", { enumerable: true, get: function() {
       return atomic_profile_js_1.isEnforcingAtomic;
     } });
+    Object.defineProperty(exports2, "PROFILE_ENFORCING_ATOMIC_V2", { enumerable: true, get: function() {
+      return atomic_profile_js_1.PROFILE_ENFORCING_ATOMIC_V2;
+    } });
+    Object.defineProperty(exports2, "isEnforcingAtomicV2", { enumerable: true, get: function() {
+      return atomic_profile_js_1.isEnforcingAtomicV2;
+    } });
+    Object.defineProperty(exports2, "atomicConstructionProblems", { enumerable: true, get: function() {
+      return atomic_profile_js_1.atomicConstructionProblems;
+    } });
+    Object.defineProperty(exports2, "CREDENTIAL_BOUNDARY_BARE_REJECTED", { enumerable: true, get: function() {
+      return atomic_profile_js_1.CREDENTIAL_BOUNDARY_BARE_REJECTED;
+    } });
+    Object.defineProperty(exports2, "ATOMIC_V2_MAX_AGE_MS_CAP", { enumerable: true, get: function() {
+      return atomic_profile_js_1.ATOMIC_V2_MAX_AGE_MS_CAP;
+    } });
+    var posture_receipt_js_1 = require_posture_receipt();
+    Object.defineProperty(exports2, "verifyPostureReceipt", { enumerable: true, get: function() {
+      return posture_receipt_js_1.verifyPostureReceipt;
+    } });
+    Object.defineProperty(exports2, "POSTURE_RECEIPT_V", { enumerable: true, get: function() {
+      return posture_receipt_js_1.POSTURE_RECEIPT_V;
+    } });
+    Object.defineProperty(exports2, "POSTURE_CLOCK_SKEW_TOLERANCE_MS", { enumerable: true, get: function() {
+      return posture_receipt_js_1.POSTURE_CLOCK_SKEW_TOLERANCE_MS;
+    } });
     var execution_grant_js_1 = require_execution_grant2();
     Object.defineProperty(exports2, "isExecutionGrantEnabled", { enumerable: true, get: function() {
       return execution_grant_js_1.isExecutionGrantEnabled;
@@ -76248,6 +77071,42 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "defaultSerializeGeminiToolResult", { enumerable: true, get: function() {
       return gemini_js_1.defaultSerializeGeminiToolResult;
     } });
+    var langchain_js_1 = require_langchain();
+    Object.defineProperty(exports2, "bindLangChainToolOutcome", { enumerable: true, get: function() {
+      return langchain_js_1.bindLangChainToolOutcome;
+    } });
+    Object.defineProperty(exports2, "defaultSerializeLangChainToolResult", { enumerable: true, get: function() {
+      return langchain_js_1.defaultSerializeLangChainToolResult;
+    } });
+    Object.defineProperty(exports2, "LANGCHAIN_ARTIFACT_SPEC", { enumerable: true, get: function() {
+      return langchain_js_1.LANGCHAIN_ARTIFACT_SPEC;
+    } });
+    var crewai_js_1 = require_crewai();
+    Object.defineProperty(exports2, "bindCrewAIToolOutcome", { enumerable: true, get: function() {
+      return crewai_js_1.bindCrewAIToolOutcome;
+    } });
+    Object.defineProperty(exports2, "defaultSerializeCrewAIToolResult", { enumerable: true, get: function() {
+      return crewai_js_1.defaultSerializeCrewAIToolResult;
+    } });
+    var vercel_js_1 = require_vercel();
+    Object.defineProperty(exports2, "withCodeRiftsVercel", { enumerable: true, get: function() {
+      return vercel_js_1.withCodeRiftsVercel;
+    } });
+    Object.defineProperty(exports2, "vercelToolAdapter", { enumerable: true, get: function() {
+      return vercel_js_1.vercelToolAdapter;
+    } });
+    Object.defineProperty(exports2, "toVercelTools", { enumerable: true, get: function() {
+      return vercel_js_1.toVercelTools;
+    } });
+    Object.defineProperty(exports2, "protectedToolToVercel", { enumerable: true, get: function() {
+      return vercel_js_1.protectedToolToVercel;
+    } });
+    Object.defineProperty(exports2, "bindVercelGuardOutcome", { enumerable: true, get: function() {
+      return vercel_js_1.bindVercelGuardOutcome;
+    } });
+    Object.defineProperty(exports2, "defaultSerializeVercelToolResult", { enumerable: true, get: function() {
+      return vercel_js_1.defaultSerializeVercelToolResult;
+    } });
     var execute_tool_call_js_1 = require_execute_tool_call();
     Object.defineProperty(exports2, "executeProtectedTool", { enumerable: true, get: function() {
       return execute_tool_call_js_1.executeProtectedTool;
@@ -76264,6 +77123,9 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "executeLangGraphToolCall", { enumerable: true, get: function() {
       return execute_tool_call_js_1.executeLangGraphToolCall;
     } });
+    Object.defineProperty(exports2, "executeVercelToolCall", { enumerable: true, get: function() {
+      return execute_tool_call_js_1.executeVercelToolCall;
+    } });
     Object.defineProperty(exports2, "isGuardOutcome", { enumerable: true, get: function() {
       return execute_tool_call_js_1.isGuardOutcome;
     } });
@@ -76311,6 +77173,24 @@ var require_claude_hook = __commonJS({
     var { getApiKey } = require_config();
     var { cloudAuthorizePreflight } = require_cloud();
     var DEFAULT_SPEC_PATH = "api/openapi.yaml";
+    var DEFAULT_SPEC_GLOBS = Object.freeze([
+      "**/*openapi*.yaml",
+      "**/*openapi*.yml",
+      "**/*openapi*.json",
+      "**/*swagger*.yaml",
+      "**/*swagger*.yml",
+      "**/*swagger*.json",
+      "**/*asyncapi*.yaml",
+      "**/*asyncapi*.yml",
+      "**/*asyncapi*.json",
+      "**/*.graphql",
+      "**/*.gql",
+      "**/*.proto",
+      "**/*mcp*.json",
+      "**/*mcp*.yaml",
+      "**/*mcp*.yml",
+      "**/*tool-schema*.json"
+    ]);
     var CLOSED_ACTIONS = /* @__PURE__ */ new Set([
       "CONTINUE",
       "CONTINUE_WITH_MONITORING",
@@ -76320,8 +77200,9 @@ var require_claude_hook = __commonJS({
     var USAGE = [
       "Usage: coderifts claude-hook",
       "",
-      "Claude Code PreToolUse hook: gates Write|Edit|MultiEdit when they touch the",
-      "configured contract spec path. Reads JSON context from STDIN.",
+      "Claude Code PreToolUse hook: gates Write|Edit|MultiEdit when they touch a",
+      "governed contract path (default family + git config coderifts.specPath).",
+      "Reads JSON context from STDIN.",
       "",
       "Exit map (Claude Code semantics \u2014 get this exactly right):",
       "  2  BLOCK \u2014 tool call cancelled (BLOCK/STOP, REQUEST_APPROVAL, unrecognised action,",
@@ -76336,7 +77217,7 @@ var require_claude_hook = __commonJS({
       "Parse-gap DEFAULT (exit 2): unparseable stdin / missing file_path \u2014 refusing (fail-closed);",
       "  set CODERIFTS_ADVISORY=1 to soften. JSONL hook_blocked cause stdin_unparseable|missing_file_path.",
       "",
-      "Still exit 0 (nothing to govern): non-spec path, identical content, non-governed tool.",
+      "Still exit 0 (nothing to govern): not-governed path (one stderr line), identical content, non-governed tool.",
       "",
       "CONTINUE_WITH_MONITORING: allow only if the host asserts a sink",
       "  (CODERIFTS_MONITORING_SINK_WIRED=1|true or git config coderifts.monitoringSinkWired).",
@@ -76344,8 +77225,11 @@ var require_claude_hook = __commonJS({
       "",
       "CODERIFTS_STRICT=1|true: same fail-closed as default; cannot be weakened by ADVISORY.",
       "",
-      "Spec path (same source as git pre-push hook):",
-      "  git config coderifts.specPath  (default: api/openapi.yaml)",
+      "Governed paths (additive; configuring one path never drops the defaults):",
+      "  default family: OpenAPI/Swagger, GraphQL, *.proto, AsyncAPI, MCP manifest, tool-schema.json",
+      "  git config --add coderifts.specPath <path-or-glob>     # extra includes",
+      "  git config --add coderifts.specPathExclude <path-or-glob>  # opt out one path",
+      "  Not-governed path: exit 0 and one stderr line `coderifts claude-hook: not governed: <path>`.",
       "",
       "Baseline at PreToolUse: before = current file on disk (pre-edit state \u2014 the tool has",
       "not written yet). after = proposed content from tool_input (Write: content; Edit/MultiEdit:",
@@ -76473,10 +77357,41 @@ var require_claude_hook = __commonJS({
       return readGitConfig("coderifts.apiKey", deps);
     }
     function resolveSpecPath(deps = {}) {
+      const extras = readGitConfigAll("coderifts.specPath", deps);
+      if (extras.length) return extras[0];
       const fromGit = readGitConfig("coderifts.specPath", deps);
-      if (fromGit) return fromGit;
+      if (fromGit) return splitConfigValues(fromGit)[0] || DEFAULT_SPEC_PATH;
       return DEFAULT_SPEC_PATH;
     }
+    function splitConfigValues(raw) {
+      return String(raw || "").split(/[\n,]/).map((s) => s.trim()).filter(Boolean);
+    }
+    function readGitConfigAll(key, deps = {}) {
+      if (typeof deps.readGitConfigAll === "function") {
+        const v = deps.readGitConfigAll(key);
+        if (Array.isArray(v)) return v.flatMap(splitConfigValues);
+        return splitConfigValues(v);
+      }
+      const run = deps.execSync || execSync;
+      const cwd = deps.cwd || process.cwd();
+      try {
+        const v = run(`git config --get-all ${key}`, {
+          encoding: "utf8",
+          cwd,
+          stdio: ["ignore", "pipe", "pipe"]
+        });
+        return splitConfigValues(v);
+      } catch {
+        const one = readGitConfig(key, deps);
+        return one ? splitConfigValues(one) : [];
+      }
+    }
+    function resolveSpecIncludes(deps = {}) {
+      return readGitConfigAll("coderifts.specPath", deps);
+    }
+    function resolveSpecExcludes(deps = {}) {
+      return readGitConfigAll("coderifts.specPathExclude", deps);
+    }
     var GOVERNED_TOOLS = /* @__PURE__ */ new Set(["write", "edit", "multiedit", "multi_edit"]);
     function isGovernedTool(name) {
       return GOVERNED_TOOLS.has(String(name || "").toLowerCase());
@@ -76551,6 +77466,75 @@ var require_claude_hook = __commonJS({
       }
       return false;
     }
+    function globToRegExp(pattern) {
+      const src = String(pattern).replace(/\\/g, "/");
+      let out = "^";
+      for (let i = 0; i < src.length; ) {
+        if (src[i] === "*" && src[i + 1] === "*") {
+          if (src[i + 2] === "/") {
+            out += "(?:.*/)?";
+            i += 3;
+          } else {
+            out += ".*";
+            i += 2;
+          }
+        } else if (src[i] === "*") {
+          out += "[^/]*";
+          i += 1;
+        } else if (src[i] === "?") {
+          out += "[^/]";
+          i += 1;
+        } else {
+          out += src[i].replace(/[.+^${}()|[\]\\]/g, "\\$&");
+          i += 1;
+        }
+      }
+      out += "$";
+      return new RegExp(out, "i");
+    }
+    function matchGlob(pattern, value) {
+      if (!pattern || value == null) return false;
+      return globToRegExp(pattern).test(String(value).replace(/\\/g, "/"));
+    }
+    function normalizeToolPath(filePath, cwd) {
+      let p = String(filePath || "").replace(/\\/g, "/");
+      while (p.startsWith("./")) p = p.slice(2);
+      const root = String(cwd || "").replace(/\\/g, "/").replace(/\/$/, "");
+      if (root && (p === root || p.startsWith(`${root}/`))) {
+        p = p.slice(root.length).replace(/^\//, "");
+      }
+      return p;
+    }
+    function isDetectorsExcludedDir(rel) {
+      const s = `/${String(rel).replace(/\\/g, "/").toLowerCase()}/`;
+      return s.includes("/node_modules/") || s.includes("/vendor/");
+    }
+    function patternLooksLikeGlob(pattern) {
+      return /[*?]/.test(String(pattern || ""));
+    }
+    function matchesPattern(filePath, rel, pattern) {
+      if (!pattern) return false;
+      if (patternLooksLikeGlob(pattern)) {
+        return matchGlob(pattern, rel) || matchGlob(pattern, filePath);
+      }
+      return isSpecPath(filePath, pattern) || isSpecPath(rel, pattern);
+    }
+    function matchesAnyPattern(filePath, rel, patterns) {
+      for (const p of patterns || []) {
+        if (matchesPattern(filePath, rel, p)) return true;
+      }
+      return false;
+    }
+    function isGovernedPath(filePath, deps = {}) {
+      if (!filePath) return false;
+      const rel = normalizeToolPath(filePath, deps.cwd);
+      const extras = resolveSpecIncludes(deps);
+      const excludes = resolveSpecExcludes(deps);
+      if (matchesAnyPattern(filePath, rel, excludes)) return false;
+      if (matchesAnyPattern(filePath, rel, extras)) return true;
+      if (isDetectorsExcludedDir(rel)) return false;
+      return DEFAULT_SPEC_GLOBS.some((g) => matchGlob(g, rel) || matchGlob(g, String(filePath).replace(/\\/g, "/")));
+    }
     function deriveAfterContent(toolName, toolInput, diskBefore) {
       const name = String(toolName || "").toLowerCase();
       if (name === "write") {
@@ -76779,8 +77763,9 @@ var require_claude_hook = __commonJS({
         return emitTerminal({ exitCode: 2, reason: "missing_file_path" });
       }
       filePathKnown = filePath;
-      const specPath = resolveSpecPath({ ...deps, cwd });
-      if (!isSpecPath(filePath, specPath)) {
+      if (!isGovernedPath(filePath, { ...deps, cwd })) {
+        const rel = normalizeToolPath(filePath, cwd);
+        errLog(`coderifts claude-hook: not governed: ${rel || filePath}`);
         logEv({ type: "detection_skip", signals: ["not_spec_path"], tool, path: filePath });
         return emitTerminal({ exitCode: 0, reason: "not_spec_path" });
       }
@@ -76961,12 +77946,18 @@ var require_claude_hook = __commonJS({
       isGovernedTool,
       coerceToolInput,
       isSpecPath,
+      isGovernedPath,
+      matchGlob,
+      normalizeToolPath,
       deriveAfterContent,
       mapDecisionSeverity,
       renderDecisionWhy,
       resolveApiKey,
       resolveSpecPath,
+      resolveSpecIncludes,
+      resolveSpecExcludes,
       readGitConfig,
+      readGitConfigAll,
       isEnvFlag,
       isStrictMode,
       isAdvisoryMode,
@@ -76974,6 +77965,7 @@ var require_claude_hook = __commonJS({
       failClosedOrAdvisory,
       softOrStrictBlock,
       DEFAULT_SPEC_PATH,
+      DEFAULT_SPEC_GLOBS,
       CLOSED_ACTIONS,
       USAGE,
       appendGuardEventLog,
@@ -158775,7 +159767,7 @@ var require_rateLimit = __commonJS({
     var ipDailyStore = /* @__PURE__ */ new Map();
     var apiKeyMinuteStore = /* @__PURE__ */ new Map();
     var ipAgentMinuteStore = /* @__PURE__ */ new Map();
-    var AGENT_PUBLIC_ENDPOINTS = ["/api/v1/demo", "/api/v1/public/preflight", "/api/v1/public/actionguard-check", "/api/v1/public/migraguard-check", "/api/v1/badge/agent-readiness"];
+    var AGENT_PUBLIC_ENDPOINTS = ["/api/v1/demo", "/api/v1/public/preflight", "/api/v1/public/actionguard-check", "/api/v1/public/migraguard-check", "/api/v1/badge/agent-readiness", "/snippets"];
     var AGENT_IP_MINUTE_LIMIT = 60;
     var ANONYMOUS_DAILY_LIMIT = 50;
     var API_KEY_MINUTE_LIMIT = 100;
@@ -179997,6 +180989,32 @@ var require_comment_renderer = __commonJS({
       lines.push("");
       return lines.join("\n");
     }
+    var BREAKING_HIGHLIGHTS_TOP_N = 5;
+    function renderBreakingHighlights(results, topN = BREAKING_HIGHLIGHTS_TOP_N) {
+      if (!Array.isArray(results) || results.length === 0) return "";
+      const rows = [];
+      for (const r of results) {
+        const file = r && typeof r.schemaPath === "string" ? r.schemaPath : "";
+        for (const d of r && Array.isArray(r.breaking) ? r.breaking : []) {
+          const raw = extractRawLocation(d);
+          const pointer = raw && raw !== "N/A" ? raw : "";
+          if (!file && !pointer) continue;
+          rows.push({ file, pointer, code: d && d.code ? String(d.code) : "" });
+        }
+      }
+      if (rows.length === 0) return "";
+      const shown = rows.slice(0, topN);
+      const lines = ["## \u{1F3AF} Breaking elements\n"];
+      for (const row of shown) {
+        const where = row.file && row.pointer ? `\`${escapeMd(row.file)}\` \xB7 \`${escapeMd(row.pointer)}\`` : `\`${escapeMd(row.file || row.pointer)}\``;
+        lines.push(`- ${where}${row.code ? ` \u2014 \`${escapeMd(row.code)}\`` : ""}`);
+      }
+      if (rows.length > shown.length) {
+        lines.push(`- \u2026and ${rows.length - shown.length} more \u2014 see **Raw diff details** below.`);
+      }
+      lines.push("");
+      return lines.join("\n");
+    }
     function renderAgentImpactHeadline(options) {
       const n = (options.omegaAgentPatterns || []).length;
       if (n === 0) return "";
@@ -180246,6 +181264,10 @@ var require_comment_renderer = __commonJS({
         const changeList = renderCanonicalChangeList(options.detectedPatterns || []);
         if (changeList) lines.push(changeList);
       }
+      {
+        const highlights = renderBreakingHighlights(results);
+        if (highlights) lines.push(highlights);
+      }
       {
         const agentLine = renderAgentImpactHeadline(options);
         if (agentLine) lines.push(agentLine);
@@ -180728,6 +181750,8 @@ ${body}` : poison;
       renderBlockReason,
       renderUnblockActions,
       renderCanonicalChangeList,
+      renderBreakingHighlights,
+      BREAKING_HIGHLIGHTS_TOP_N,
       renderAgentImpactHeadline,
       renderEconomicHeadline,
       renderPoisonGateSection,
@@ -201561,7 +202585,120 @@ var require_asyncapi_diff = __commonJS({
           channels[channelName] = { operations };
         }
       }
-      return { channels };
+      return { channels, root: parsed };
+    }
+    function stillHasRef(node) {
+      return !!(node && typeof node === "object" && typeof node.$ref === "string" && !node.properties);
+    }
+    function comparePayload(basePayload, headPayload, pathPrefix, messageId, baseRoot, headRoot, addBreakingChange, addNonBreakingChange) {
+      const baseResolved = resolveLocalRef(baseRoot, basePayload, []);
+      const headResolved = resolveLocalRef(headRoot, headPayload, []);
+      if (stillHasRef(baseResolved) || stillHasRef(headResolved)) {
+        const ref = stillHasRef(baseResolved) && baseResolved.$ref || stillHasRef(headResolved) && headResolved.$ref || "";
+        addNonBreakingChange(
+          "PAYLOAD_REF_UNCOMPARED",
+          pathPrefix,
+          `Payload at '${pathPrefix}' uses unresolved $ref '${ref}' and was not compared.`
+        );
+        return;
+      }
+      if (!baseResolved || !headResolved || typeof baseResolved !== "object" || typeof headResolved !== "object") {
+        return;
+      }
+      const baseProps = baseResolved.properties || {};
+      const headProps = headResolved.properties || {};
+      const baseReq = new Set(Array.isArray(baseResolved.required) ? baseResolved.required : []);
+      const headReq = new Set(Array.isArray(headResolved.required) ? headResolved.required : []);
+      for (const fieldName of headReq) {
+        if (baseReq.has(fieldName)) continue;
+        if (baseProps[fieldName]) {
+          addBreakingChange(
+            "PAYLOAD_FIELD_NOW_REQUIRED",
+            `${pathPrefix}.${fieldName}`,
+            `Payload field '${fieldName}' in message '${messageId}' changed from optional to required.`
+          );
+        } else {
+          addBreakingChange(
+            "REQUIRED_PAYLOAD_FIELD_ADDED",
+            `${pathPrefix}.${fieldName}`,
+            `Required payload field '${fieldName}' was added to message '${messageId}'.`
+          );
+        }
+      }
+      for (const fieldName of baseReq) {
+        if (!headReq.has(fieldName) && headProps[fieldName]) {
+          addNonBreakingChange(
+            "PAYLOAD_FIELD_NOW_OPTIONAL",
+            `${pathPrefix}.${fieldName}`,
+            `Payload field '${fieldName}' in message '${messageId}' changed from required to optional.`
+          );
+        }
+      }
+      for (const fieldName in baseProps) {
+        const baseField = resolveLocalRef(baseRoot, baseProps[fieldName], []);
+        const headFieldRaw = headProps[fieldName];
+        if (!headFieldRaw) {
+          addBreakingChange(
+            "PAYLOAD_FIELD_REMOVED",
+            `${pathPrefix}.${fieldName}`,
+            `Payload field '${fieldName}' was removed from message '${messageId}'.`
+          );
+          continue;
+        }
+        const headField = resolveLocalRef(headRoot, headFieldRaw, []);
+        if (stillHasRef(baseField) || stillHasRef(headField)) {
+          const ref = stillHasRef(baseField) && baseField.$ref || stillHasRef(headField) && headField.$ref || "";
+          addNonBreakingChange(
+            "PAYLOAD_REF_UNCOMPARED",
+            `${pathPrefix}.${fieldName}`,
+            `Payload field '${fieldName}' in message '${messageId}' uses unresolved $ref '${ref}' and was not compared.`
+          );
+          continue;
+        }
+        if (baseField && headField && baseField.type !== headField.type) {
+          addBreakingChange(
+            "PAYLOAD_FIELD_TYPE_CHANGED",
+            `${pathPrefix}.${fieldName}`,
+            `Payload field '${fieldName}' in message '${messageId}' changed type from '${baseField.type}' to '${headField.type}'.`
+          );
+          continue;
+        }
+        if (baseField && headField && Array.isArray(baseField.enum) && Array.isArray(headField.enum)) {
+          for (const val of baseField.enum) {
+            if (!headField.enum.includes(val)) {
+              addBreakingChange(
+                "ENUM_VALUE_REMOVED",
+                `${pathPrefix}.${fieldName}.${val}`,
+                `Enum value '${val}' was removed from field '${fieldName}' in message '${messageId}'.`
+              );
+            }
+          }
+          for (const val of headField.enum) {
+            if (!baseField.enum.includes(val)) {
+              addNonBreakingChange(
+                "ENUM_VALUE_ADDED",
+                `${pathPrefix}.${fieldName}.${val}`,
+                `New enum value '${val}' was added to field '${fieldName}' in message '${messageId}'.`
+              );
+            }
+          }
+        }
+        if (baseField && headField && (baseField.properties || headField.properties || baseField.type === "object" || headField.type === "object")) {
+          comparePayload(baseField, headField, `${pathPrefix}.${fieldName}`, messageId, baseRoot, headRoot, addBreakingChange, addNonBreakingChange);
+        }
+      }
+      for (const fieldName in headProps) {
+        if (!baseProps[fieldName]) {
+          const addedIsRequired = headReq.has(fieldName);
+          if (!addedIsRequired) {
+            addNonBreakingChange(
+              "PAYLOAD_FIELD_ADDED",
+              `${pathPrefix}.${fieldName}`,
+              `New optional payload field '${fieldName}' was added to message '${messageId}'.`
+            );
+          }
+        }
+      }
     }
     function diffAsyncAPISchemas(base_schema_content, head_schema_content) {
       const base = parseAsyncAPI(base_schema_content);
@@ -201601,42 +202738,17 @@ var require_asyncapi_diff = __commonJS({
             }
             const basePayload = baseMessage.payload;
             const headPayload = headMessage.payload;
-            if (basePayload && headPayload && basePayload.properties && headPayload.properties) {
-              for (const fieldName in basePayload.properties) {
-                const baseField = basePayload.properties[fieldName];
-                const headField = headPayload.properties[fieldName];
-                if (!headField) {
-                  addBreakingChange("PAYLOAD_FIELD_REMOVED", `${channelName}.${opType}.${messageId}.${fieldName}`, `Payload field '${fieldName}' was removed from message '${messageId}'.`);
-                } else if (baseField.type !== headField.type) {
-                  addBreakingChange("PAYLOAD_FIELD_TYPE_CHANGED", `${channelName}.${opType}.${messageId}.${fieldName}`, `Payload field '${fieldName}' in message '${messageId}' changed type from '${baseField.type}' to '${headField.type}'.`);
-                } else if (Array.isArray(baseField.enum) && Array.isArray(headField.enum)) {
-                  for (const val of baseField.enum) {
-                    if (!headField.enum.includes(val)) {
-                      addBreakingChange("ENUM_VALUE_REMOVED", `${channelName}.${opType}.${messageId}.${fieldName}.${val}`, `Enum value '${val}' was removed from field '${fieldName}' in message '${messageId}'.`);
-                    }
-                  }
-                  for (const val of headField.enum) {
-                    if (!baseField.enum.includes(val)) {
-                      addNonBreakingChange("ENUM_VALUE_ADDED", `${channelName}.${opType}.${messageId}.${fieldName}.${val}`, `New enum value '${val}' was added to field '${fieldName}' in message '${messageId}'.`);
-                    }
-                  }
-                }
-              }
-              for (const fieldName in headPayload.properties) {
-                if (!basePayload.properties[fieldName]) {
-                  const addedIsRequired = Array.isArray(headPayload.required) && headPayload.required.includes(fieldName);
-                  if (!addedIsRequired) {
-                    addNonBreakingChange("PAYLOAD_FIELD_ADDED", `${channelName}.${opType}.${messageId}.${fieldName}`, `New optional payload field '${fieldName}' was added to message '${messageId}'.`);
-                  }
-                }
-              }
-              if (headPayload.required && Array.isArray(headPayload.required)) {
-                for (const requiredField of headPayload.required) {
-                  if (!basePayload.required || !basePayload.required.includes(requiredField)) {
-                    addBreakingChange("REQUIRED_PAYLOAD_FIELD_ADDED", `${channelName}.${opType}.${messageId}.${requiredField}`, `Required payload field '${requiredField}' was added to message '${messageId}'.`);
-                  }
-                }
-              }
+            if (basePayload && headPayload) {
+              comparePayload(
+                basePayload,
+                headPayload,
+                `${channelName}.${opType}.${messageId}`,
+                messageId,
+                base.root,
+                head.root,
+                addBreakingChange,
+                addNonBreakingChange
+              );
             }
           }
           for (const messageId in headOperation.messages) {
@@ -202399,6 +203511,83 @@ var require_remediation_taxonomy = __commonJS({
   }
 });
 
+// ../../src/next-agent-step.js
+var require_next_agent_step2 = __commonJS({
+  "../../src/next-agent-step.js"(exports2, module2) {
+    "use strict";
+    var NEXT_AGENT_ACTIONS = Object.freeze([
+      "re_preflight",
+      "revert",
+      "migrate",
+      "escalate",
+      "await_approval"
+    ]);
+    var NEXT_AGENT_ACTION_SET = new Set(NEXT_AGENT_ACTIONS);
+    function mapChoiceIdToNextAction(id) {
+      const s = String(id == null ? "" : id);
+      if (s === "re_preflight" || s === "re_preflight_deploy") return "re_preflight";
+      if (s === "fix_input") return "re_preflight";
+      if (s === "revert") return "revert";
+      if (s === "migrate") return "migrate";
+      if (s === "escalate") return "escalate";
+      if (s === "obtain_human_approval") return "await_approval";
+      return null;
+    }
+    function projectNextAgentStep(executionAction, requiredAction) {
+      const ea = executionAction != null ? String(executionAction) : "";
+      if (ea === "CONTINUE" || ea === "CONTINUE_WITH_MONITORING") return null;
+      if (ea !== "STOP" && ea !== "REQUEST_APPROVAL") return null;
+      const raObj = requiredAction && typeof requiredAction === "object" ? requiredAction : null;
+      const raStr = typeof requiredAction === "string" ? requiredAction : null;
+      const reason = raObj && raObj.reason_code != null && String(raObj.reason_code) || raObj && raObj.type != null && String(raObj.type) || raStr && raStr.slice(0, 200) || (ea === "REQUEST_APPROVAL" ? "request_approval" : "remediate_or_revert");
+      const resume_condition = raObj && typeof raObj.resume_condition === "string" ? raObj.resume_condition : raStr || "";
+      let action = null;
+      if (ea === "REQUEST_APPROVAL") {
+        action = "await_approval";
+      } else {
+        const choices = raObj && Array.isArray(raObj.choices) ? raObj.choices : [];
+        for (const c of choices) {
+          const id = typeof c === "string" ? c : c && c.id != null ? c.id : null;
+          const mapped = mapChoiceIdToNextAction(id);
+          if (mapped && NEXT_AGENT_ACTION_SET.has(mapped) && mapped !== "await_approval") {
+            action = mapped;
+            break;
+          }
+        }
+        if (!action) {
+          const t = raObj && raObj.type != null ? String(raObj.type) : "";
+          if (t === "re_preflight" || t === "remediate_or_revert" || t === "fix_coverage" || t === "revert") {
+            action = t === "revert" ? "revert" : "re_preflight";
+          } else if (raStr || ea === "STOP") {
+            action = "re_preflight";
+          }
+        }
+      }
+      if (!action || !NEXT_AGENT_ACTION_SET.has(action)) return null;
+      let then_call = null;
+      if (action === "re_preflight" || action === "revert" || action === "migrate") {
+        then_call = "preflight_change_set";
+      } else if (action === "await_approval") {
+        then_call = null;
+      } else if (action === "escalate") {
+        then_call = null;
+      }
+      return {
+        action,
+        reason: String(reason),
+        resume_condition: String(resume_condition),
+        then_call
+      };
+    }
+    module2.exports = {
+      NEXT_AGENT_ACTIONS,
+      NEXT_AGENT_ACTION_SET,
+      mapChoiceIdToNextAction,
+      projectNextAgentStep
+    };
+  }
+});
+
 // ../../src/response-envelope.js
 var require_response_envelope = __commonJS({
   "../../src/response-envelope.js"(exports2, module2) {
@@ -202642,70 +203831,10 @@ var require_response_envelope = __commonJS({
     function buildEnforcementDescriptor() {
       return { ...ENFORCEMENT_DESCRIPTOR };
     }
-    var NEXT_AGENT_ACTIONS = Object.freeze([
-      "re_preflight",
-      "revert",
-      "migrate",
-      "escalate",
-      "await_approval"
-    ]);
-    var NEXT_AGENT_ACTION_SET = new Set(NEXT_AGENT_ACTIONS);
-    function mapChoiceIdToNextAction(id) {
-      const s = String(id == null ? "" : id);
-      if (s === "re_preflight" || s === "re_preflight_deploy") return "re_preflight";
-      if (s === "fix_input") return "re_preflight";
-      if (s === "revert") return "revert";
-      if (s === "migrate") return "migrate";
-      if (s === "escalate") return "escalate";
-      if (s === "obtain_human_approval") return "await_approval";
-      return null;
-    }
-    function projectNextAgentStep(executionAction, requiredAction) {
-      const ea = executionAction != null ? String(executionAction) : "";
-      if (ea === "CONTINUE" || ea === "CONTINUE_WITH_MONITORING") return null;
-      if (ea !== "STOP" && ea !== "REQUEST_APPROVAL") return null;
-      const raObj = requiredAction && typeof requiredAction === "object" ? requiredAction : null;
-      const raStr = typeof requiredAction === "string" ? requiredAction : null;
-      const reason = raObj && raObj.reason_code != null && String(raObj.reason_code) || raObj && raObj.type != null && String(raObj.type) || raStr && raStr.slice(0, 200) || (ea === "REQUEST_APPROVAL" ? "request_approval" : "remediate_or_revert");
-      const resume_condition = raObj && typeof raObj.resume_condition === "string" ? raObj.resume_condition : raStr || "";
-      let action = null;
-      if (ea === "REQUEST_APPROVAL") {
-        action = "await_approval";
-      } else {
-        const choices = raObj && Array.isArray(raObj.choices) ? raObj.choices : [];
-        for (const c of choices) {
-          const id = typeof c === "string" ? c : c && c.id != null ? c.id : null;
-          const mapped = mapChoiceIdToNextAction(id);
-          if (mapped && NEXT_AGENT_ACTION_SET.has(mapped) && mapped !== "await_approval") {
-            action = mapped;
-            break;
-          }
-        }
-        if (!action) {
-          const t = raObj && raObj.type != null ? String(raObj.type) : "";
-          if (t === "re_preflight" || t === "remediate_or_revert" || t === "fix_coverage" || t === "revert") {
-            action = t === "revert" ? "revert" : "re_preflight";
-          } else if (raStr || ea === "STOP") {
-            action = "re_preflight";
-          }
-        }
-      }
-      if (!action || !NEXT_AGENT_ACTION_SET.has(action)) return null;
-      let then_call = null;
-      if (action === "re_preflight" || action === "revert" || action === "migrate") {
-        then_call = "preflight_change_set";
-      } else if (action === "await_approval") {
-        then_call = null;
-      } else if (action === "escalate") {
-        then_call = null;
-      }
-      return {
-        action,
-        reason: String(reason),
-        resume_condition: String(resume_condition),
-        then_call
-      };
-    }
+    var {
+      NEXT_AGENT_ACTIONS,
+      projectNextAgentStep
+    } = require_next_agent_step2();
     function buildControlEnvelope(verdict, authzContext) {
       const receipt_view = projectReceipt(verdict, authzContext);
       let safeForAgent = verdict.safe_for_agent;
@@ -202829,6 +203958,7 @@ var require_response_envelope = __commonJS({
         return response;
       }
       response.control_envelope = buildControlEnvelope(response, authzContext);
+      if (isCoverageFailClosed(response)) response.safe_for_agent = false;
       response.analysis = buildAnalysisTier(response);
       try {
         response.analysis.remediations = buildRemediations(response);
@@ -204396,6 +205526,48 @@ var require_decision_result_v1_producer = __commonJS({
             }
           }
         },
+        next_agent_step: {
+          type: [
+            "object",
+            "null"
+          ],
+          additionalProperties: false,
+          required: [
+            "action",
+            "reason",
+            "resume_condition",
+            "then_call"
+          ],
+          description: "Additive (I-1288). The decision's own remediation SUGGESTION, projected at issuance from execution_action + required_action_core \u2014 the identical pure function that fills control_envelope.next_agent_step (src/next-agent-step.js). One projection, two placements, never two rules. INSIDE the envelope it is covered by decision_body_hash, so the signed receipt covers the suggestion along with the decision that produced it: a consumer handed only the envelope (k8s-admission, gateway-verifier, agent-guard deployGate) can render the next step without a second call to the issuer, and a tampered step no longer verifies. NOT PERMISSION and NOT a control-flow override \u2014 branch on execution_action. null on the allow class (CONTINUE / CONTINUE_WITH_MONITORING) is the correct value, not a missing measurement; null also on legacy non-additive envelopes, which never carry the field.",
+          properties: {
+            action: {
+              type: "string",
+              enum: [
+                "re_preflight",
+                "revert",
+                "migrate",
+                "escalate",
+                "await_approval"
+              ],
+              description: "Closed set \u2014 src/next-agent-step.js NEXT_AGENT_ACTIONS."
+            },
+            reason: {
+              type: "string",
+              description: "required_action reason_code / type, or the display string when that is all the issuance path had."
+            },
+            resume_condition: {
+              type: "string",
+              description: "What must hold before the caller retries. Projected from the FROZEN required_action_core, which carries no receipt-authz overlay, so this is the one subfield that may be thinner than control_envelope.next_agent_step.resume_condition (the live surface projects from deriveRequiredAction, which has the overlay and can name the approval receipt it wants). Signing the overlay text would sign a fact the envelope deliberately excludes. Empty string when the frozen core supplied none \u2014 not an error."
+            },
+            then_call: {
+              type: [
+                "string",
+                "null"
+              ],
+              description: "Tool to call after the step, or null when the next move is a human one."
+            }
+          }
+        },
         remediation_transaction: {
           type: [
             "object",
@@ -205090,6 +206262,174 @@ var require_decision_result_validator = __commonJS({
   }
 });
 
+// ../../schemas/execution-grant-request.v2.producer.json
+var require_execution_grant_request_v2_producer = __commonJS({
+  "../../schemas/execution-grant-request.v2.producer.json"(exports2, module2) {
+    module2.exports = {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      $id: "https://coderifts.com/schemas/execution-grant-request.v2.producer.json",
+      title: "CodeRifts Execution Grant Request v2 \u2014 PRODUCER schema",
+      description: "Execution-grant REQUEST v2 \u2014 the fields the authorize handler actually reads when minting a cr.exec.v2 grant. Measured from src/change-set.js:1209-1285 (the wantGrant/wantV2 block) plus the operation / audience / environment reads that same handler already performs, and pinned field-by-field by test/fixtures/v2-grant-field-matrix.json. PRODUCER-ONLY, DELIBERATELY. The pairing convention in schemas/ is not universal: decision-result.v1 and preflight-response.v2 have consumer twins because a GENERATOR derives one from the other (scripts/generate-consumer-schema.js), while control-envelope.v1 and verify-receipt.v1 are producer-only. No generator derives a request consumer, and the only thing a consumer twin would say differently is `additionalProperties`, which is stated here directly. A second hand-maintained file whose sole difference is one keyword is a drift risk, not a contract. ROLES ARE INVERTED relative to the response schemas: on a REQUEST the CLIENT is the producer and the SERVER is the consumer. `additionalProperties` is therefore TRUE, and that is a measurement of current behaviour, not an aspiration \u2014 the handler reads named fields off `input` and ignores everything else, so a client sending an extra key is accepted today. Validation is advisory by default (EXECUTION_GRANT_REQUEST_VALIDATOR_MODE=log); nothing in this schema starts rejecting a request that works now. NOT REQUEST FIELDS \u2014 MINTED BY THE ISSUER, and excluded on purpose: `jti`, `expires_at` / `expiry`, `after_payload_digest` (plus `kid`, `grant_id`, `receipt_hash`, `nonce_hash`, `not_before`, `max_attempts`). src/verdict-core/execution-grant-v2.js:110-154 derives every one of them from the signed receipt and the change set. A caller cannot supply them and the handler would not read them; listing them here would describe a request surface that does not exist. BOUND SINCE 1206 VARIANT A \u2014 `policy_hash` and `audience_hash`: both are now carried into the signed grant. `policy_hash` is forwarded by the authorize handler (src/change-set.js:1323) into the issuer, which binds it at src/verdict-core/execution-grant-v2.js:149; a verifier that states `intended.policy_hash` gets a GRANT_UNBOUND/policy_mismatch on a mismatch. `audience_hash` is NOT a request field of its own: it is derived from `audience` (execution-grant-v2.js:150) and was already enforced (:227-234), so sending it separately has no effect and it stays out of this schema. Before this change policy_hash was accepted on the wire and dropped at the handler, which minted every grant under the sha256('') default \u2014 a field that looked bound and was not.",
+      type: "object",
+      additionalProperties: true,
+      required: [
+        "include_execution_grant"
+      ],
+      properties: {
+        include_execution_grant: {
+          type: "boolean",
+          description: 'Gates the whole grant path. src/change-set.js:1209 \u2014 strictly `=== true`, so any other value (including the string "true") mints no grant.'
+        },
+        grant_version: {
+          type: "string",
+          enum: [
+            "v1",
+            "v2"
+          ],
+          description: "src/change-set.js:1268 \u2014 `v2` selects the cr.exec.v2 issuer. Absent or any other value takes the v1 branch. `grantVersion` (camelCase) is accepted as an alias at the same line; both are listed so neither reads as undeclared."
+        },
+        grantVersion: {
+          type: "string",
+          enum: [
+            "v1",
+            "v2"
+          ],
+          description: "camelCase alias of grant_version, read at src/change-set.js:1268. Declared because the handler reads it, not because it is recommended."
+        },
+        tenant_id: {
+          type: "string",
+          minLength: 1,
+          description: "src/change-set.js:1279 \u2014 `input.tenant_id || context.tenant_id || 'default'`. The default is a real value, not an absence: an unset tenant is issued as `default`, it is not left unbound."
+        },
+        executor_id: {
+          type: "string",
+          minLength: 1,
+          description: "src/change-set.js:1277 \u2014 `input.executor_id || context.executor_id || 'local'`."
+        },
+        adapter_id: {
+          type: "string",
+          minLength: 1,
+          description: "src/change-set.js:1278 \u2014 `input.adapter_id || context.adapter_id || 'fs'`."
+        },
+        target_uri: {
+          type: "string",
+          minLength: 1,
+          description: "src/change-set.js:1276 \u2014 `input.target_uri || context.target_uri`, else a derived `git://{context.repository||'local/repo'}@{context.head_sha||'unknown'}`. The derived form is a fallback, not a binding the caller asked for."
+        },
+        state_nonce: {
+          type: "string",
+          minLength: 1,
+          description: "src/change-set.js:1265-1267 \u2014 non-empty string only; anything else becomes null and the grant is issued without a nonce."
+        },
+        expected_state_token: {
+          type: "string",
+          description: "src/change-set.js:1281 \u2014 `nonEmptyStr(input.expected_state_token) || ''`. Empty string is the issued value when absent; there is no unbound state."
+        },
+        audience: {
+          type: "string",
+          pattern: "^v:[0-9a-f]{12}$",
+          description: "src/change-set.js:1120-1124 \u2014 ONLY the measured `v:<12 hex>` form is accepted; any other string is discarded to null rather than trusted as identity. A free-form caller-supplied name is never an audience."
+        },
+        policy_hash: {
+          type: "string",
+          minLength: 1,
+          description: "src/change-set.js:1305 \u2014 the policy identity this request is made under, bound into the signed grant (execution-grant-v2.js:149). A value already prefixed `sha256:` is carried through; anything else is hashed. Absent \u2192 the issuer's sha256('') default, which is what every grant carried before 1206 variant A. Enforced only by a verifier that states intended.policy_hash \u2014 binding is not by itself a check."
+        },
+        context: {
+          type: "object",
+          additionalProperties: true,
+          description: "The request context object (src/change-set.js:806). Only the keys the grant path reads are declared; the handler reads many others for unrelated purposes and tolerates the rest, so additionalProperties stays true here for the same reason it does at the root.",
+          properties: {
+            operation: {
+              type: "string",
+              minLength: 1,
+              description: "src/change-set.js:807-812 \u2014 REQUIRED for preflight_mode=authorize; the handler throws a typed input error without one. Authorization asks permission for a named operation."
+            },
+            environment: {
+              type: "string",
+              description: "src/change-set.js:1159 \u2014 carried onto the envelope. Not a grant field; read by the same handler on the same request."
+            },
+            target_id: {
+              type: "string",
+              description: "src/change-set.js:1264 \u2014 v1 grant target fallback; the v2 branch uses target_uri instead."
+            },
+            target_uri: {
+              type: "string",
+              description: "src/change-set.js:1276 \u2014 fallback when input.target_uri is absent."
+            },
+            executor_id: {
+              type: "string",
+              description: "src/change-set.js:1277 \u2014 fallback when input.executor_id is absent."
+            },
+            adapter_id: {
+              type: "string",
+              description: "src/change-set.js:1278 \u2014 fallback when input.adapter_id is absent."
+            },
+            tenant_id: {
+              type: "string",
+              description: "src/change-set.js:1279 \u2014 fallback when input.tenant_id is absent."
+            },
+            repository: {
+              type: "string",
+              description: "src/change-set.js:1276 \u2014 feeds the DERIVED target_uri when no explicit one was supplied."
+            },
+            head_sha: {
+              type: "string",
+              description: "src/change-set.js:1276 \u2014 feeds the DERIVED target_uri when no explicit one was supplied."
+            }
+          }
+        }
+      },
+      $comment: "Field set pinned by test/fixtures/v2-grant-field-matrix.json (schema column) and test/execution-grant-request-schema.test.js. Adding a property here without adding the matching matrix cell fails the drift gate."
+    };
+  }
+});
+
+// ../../src/execution-grant-request-validator.js
+var require_execution_grant_request_validator = __commonJS({
+  "../../src/execution-grant-request-validator.js"(exports2, module2) {
+    "use strict";
+    var Ajv2020 = require__();
+    var requestSchema = require_execution_grant_request_v2_producer();
+    var ajv = new Ajv2020({ strict: false, allErrors: true });
+    var _validate = ajv.compile(requestSchema);
+    function isV2GrantRequest(input) {
+      if (!input || typeof input !== "object") return false;
+      if (input.include_execution_grant !== true) return false;
+      return input.grant_version === "v2" || input.grantVersion === "v2";
+    }
+    function validateExecutionGrantRequest(input) {
+      const valid = _validate(input);
+      return { valid: !!valid, errors: valid ? [] : _validate.errors || [] };
+    }
+    function validatorMode() {
+      return process.env.EXECUTION_GRANT_REQUEST_VALIDATOR_MODE === "enforce" ? "enforce" : "log";
+    }
+    function guardExecutionGrantRequest(input, { logger } = {}) {
+      if (!isV2GrantRequest(input)) return { ok: true, skipped: true };
+      const { valid, errors } = validateExecutionGrantRequest(input);
+      if (valid) return { ok: true };
+      const error = { code: "GRANT_REQUEST_SCHEMA_VALIDATION_FAILED", errors };
+      if (validatorMode() === "enforce") {
+        return { ok: false, error };
+      }
+      if (logger && typeof logger.warn === "function") {
+        logger.warn(
+          { severity: "MEDIUM", event: "execution_grant_request_schema_violation", errors },
+          "v2 execution-grant request failed producer-schema validation (log mode \u2014 the request proceeds unchanged)"
+        );
+      }
+      return { ok: true };
+    }
+    module2.exports = {
+      validateExecutionGrantRequest,
+      guardExecutionGrantRequest,
+      isV2GrantRequest,
+      validatorMode
+    };
+  }
+});
+
 // ../../src/source-binding-gate.js
 var require_source_binding_gate = __commonJS({
   "../../src/source-binding-gate.js"(exports2, module2) {
@@ -206092,6 +207432,13 @@ var require_execution_grant_v2 = __commonJS({
       if (intended.audience_hash != null && String(intended.audience_hash).length > 0 && payload.audience_hash !== String(intended.audience_hash)) {
         return { valid: false, status: "GRANT_UNBOUND", reason: "audience_mismatch", payload };
       }
+      if (intended.policy_hash != null && String(intended.policy_hash).length > 0) {
+        const wantPolicy = String(intended.policy_hash);
+        const norm = wantPolicy.startsWith("sha256:") ? wantPolicy : sha256pref(wantPolicy);
+        if (payload.policy_hash !== norm) {
+          return { valid: false, status: "GRANT_UNBOUND", reason: "policy_mismatch", payload };
+        }
+      }
       if (intended.after_payload != null) {
         if (payload.after_payload_hash !== sha256pref(intended.after_payload)) {
           return { valid: false, status: "GRANT_UNBOUND", reason: "after_payload_mismatch", payload };
@@ -206528,6 +207875,7 @@ var require_change_set = __commonJS({
     var { buildDecisionResultV1 } = require_decision_result();
     var { deriveRequiredAction } = require_response_envelope();
     var { guardDecisionResult } = require_decision_result_validator();
+    var { guardExecutionGrantRequest } = require_execution_grant_request_validator();
     var { issueReceipt, isConfigured, sha256hex } = require_chain_attestation();
     var { getPatternConfigHash } = require_omega_scoring();
     var { computeBlastRadiusCounts } = require_blast_radius_counts();
@@ -207399,6 +208747,16 @@ var require_change_set = __commonJS({
       }
       const authorizeAction = preflightMode === "authorize" ? deriveExecutionAction(core.decision) : null;
       const allowClass = authorizeAction === "CONTINUE" || authorizeAction === "CONTINUE_WITH_MONITORING";
+      if (preflightMode === "authorize" && wantGrant) {
+        const reqGuard = guardExecutionGrantRequest(input, { logger });
+        if (!reqGuard.ok) {
+          throw typedError(
+            reqGuard.error.code,
+            "execution-grant request failed producer-schema validation",
+            { errors: reqGuard.error.errors }
+          );
+        }
+      }
       if (preflightMode === "authorize" && wantGrant && allowClass && typeof receipt === "string" && receipt.length > 0) {
         try {
           const {
@@ -207420,7 +208778,25 @@ var require_change_set = __commonJS({
               adapter_id: nonEmptyStr(input.adapter_id) || nonEmptyStr(context.adapter_id) || "fs",
               tenant_id: nonEmptyStr(input.tenant_id) || nonEmptyStr(context.tenant_id) || "default",
               nonce: stateNonce,
-              expected_state_token: nonEmptyStr(input.expected_state_token) || ""
+              expected_state_token: nonEmptyStr(input.expected_state_token) || "",
+              // 1206 variant A — the caller's claimed policy identity, BOUND into the signed grant.
+              //
+              // It was the one v2 field a client could send and the server would drop: the issuer
+              // has always read args.policy_hash (verdict-core/execution-grant-v2.js:132) and the
+              // wire has always carried a policy_hash slot, but this handler never forwarded it, so
+              // every grant was minted with the sha256('') default. A field that looks bound and is
+              // not is worse than an absent one — a reader of the token cannot tell the difference.
+              //
+              // AUDIENCE NEEDS NO LINE HERE: `audience` is already passed at the top of this call
+              // and the issuer derives audience_hash from it (:150), which the verifier already
+              // enforces (:227-234). Only policy_hash was missing.
+              //
+              // This binds what the CALLER CLAIMS, which is the whole point: the grant becomes
+              // tamper-evident about the policy it was issued under, and a verifier that knows which
+              // policy it expects can refuse a mismatch (intended.policy_hash, added symmetrically
+              // to the existing intended.audience_hash check). Absent → the issuer's sha256('')
+              // default, exactly as before.
+              policy_hash: nonEmptyStr(input.policy_hash) || void 0
             } : {
               target_id: grantTarget,
               ...stateNonce ? { state_nonce: stateNonce } : {}
@@ -220480,6 +221856,15 @@ var require_persist_decision = __commonJS({
         return null;
       }
     }
+    function persistMeta(decisionId) {
+      if (typeof decisionId === "string" && decisionId.length > 0) {
+        return { stored: true };
+      }
+      return {
+        stored: false,
+        reason: persistenceEnabled() ? "storage_unavailable" : "persistence_disabled"
+      };
+    }
     var AFTER_HEX_RE = /^[0-9a-f]{64}$/;
     function normalizeAfterHex(raw) {
       if (raw == null) return "";
@@ -220862,6 +222247,8 @@ var require_persist_decision = __commonJS({
     }
     module2.exports = {
       persistDecision,
+      persistMeta,
+      persistenceEnabled,
       persistAuthorizedPaths,
       findDecisionsByAfterHash,
       getAuthorizedPathsCollectingSince,
@@ -223317,82 +224704,7 @@ var require_mcp_streamable = __commonJS({
       });
       next();
     });
-    var DESC_PREFLIGHT_CHANGE_SET = `Preflight a COMPLETE base\u2192head change set of contract artifacts and return
-risk score and breaking-change analysis \u2014 plus, on the AUTHORIZE path only, a governance decision
-(ALLOW / WARN / REQUIRE_APPROVAL / BLOCK) and a signed chain-receipt when applicable. ANALYZE
-returns informational risk only: analysis_outcome, may_execute:false, no decision, no receipt.
-
-Requires a pending base\u2192head (before/after) contract change you are about to
-act on (merge, deploy, publish, or register tools). No pending change set \u2192
-do not call this tool.
-
-Use this when:
-- You are about to merge, push, deploy, publish, or register/expose agent tools,
-  AND the change includes \u22651 contract artifact (OpenAPI/Swagger, GraphQL SDL,
-  gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas: type=agent_tools,
-  including before re-registering tools with a runtime).
-- You have (or can assemble) FULL base and head for every changed contract
-  artifact in this set \u2014 not a single-file subset when other contract files also
-  change.
-- You need a NEW decision for the CURRENT change; you do not already hold a
-  currently-valid receipt for this exact target/operation.
-- You hold a receipt for a different operation or target than the act you will
-  perform (e.g. ALLOW for merge, now deploying). A receipt authorizes ONE
-  operation: a merge receipt does not authorize a deploy. Run a NEW preflight
-  with context.operation set to that operation (deploy, publish); a
-  differently-scoped receipt is not reusable authorization and will fail at
-  the gate.
-
-Do not use when:
-- The change is documentation-only (README, guides, comments) with no contract
-  artifact content change \u2014 do not call any CodeRifts tool.
-- You already hold a signed receipt and only need to check it is authentic and
-  currently valid \u2014 use coderifts.verify_receipt instead.
-- You need details of a PREVIOUS decision by decision_id \u2014 use
-  coderifts.get_decision_details instead.
-- You want a static 0\u2013100 "agent readiness" score for one OpenAPI/MCP file and
-  there is no pending base\u2192head mutate \u2014 use coderifts.agent_readiness_score
-  (advanced / opt-in; not one of the three default tools). If that tool is not
-  in your available list, call none of the CodeRifts tools; do not substitute
-  preflight_change_set.
-- You cannot supply both before and after (or base and head) for the artifacts
-  that change \u2014 fix the change set first; do not invent empty before specs.
-
-Inputs: list of artifacts, each with type, before, after (or equivalent), plus
-optional operation (merge|deploy|tool_call|publish), environment/stakes, and
-context. Opt-in derivation:"server" (proven tenant\u2194repo binding + context.repository
-+ base + head): omit artifacts[] \u2014 the server lists the contract-class set via the
-SCM provider for the proven binding (GitHub App Compare, or GitLab/Bitbucket Compare
-with a per-request X-Coderifts-Scm-Token, never stored; completeness_mode
-SERVER_DERIVED). Default (flag absent) is unchanged. Returns decision,
-execution_action, risk fields, and chain_receipt when issued.
-
-CHANGE SOURCE \u2014 EXACTLY ONE, ENFORCED AT THE ROUTE (400), NOT BY THIS SCHEMA.
-Supply either artifacts[] OR derivation:"server". All three of these are rejected
-with HTTP 400 INVALID_INPUT, on analyze and on authorize alike:
-  \u2022 neither artifacts[] nor derivation      \u2192 "artifacts must be a non-empty array"
-  \u2022 authorize with context.operation but no change source \u2192 same 400
-  \u2022 artifacts[] together with derivation:"server" \u2192 "derivation:"server" forbids
-    caller-supplied artifacts[] \u2014 one source of truth per request"
-This constraint is NOT expressible in the schema you are reading: a top-level
-oneOf/allOf union is rejected by at least one major MCP client (measured), so the
-schema stays permissive and the route is the enforcement point. Do not read schema
-acceptance as request validity \u2014 verified live against these exact three shapes on
-2026-08-26, over REST and over MCP tools/call (isError:true on all three).
-
-Mode (required): pass preflight_mode. Use "analyze" for informational risk only
-(returns analysis_outcome with may_execute:false, no decision/execution_action/
-safe_for_agent, no receipt). Use "authorize" for the operation-bound path that can
-mint a receipt (requires context.operation: merge|deploy|publish|tool_call). Under
-Decision Spec 2.0 the mode is mandatory; omission is an error unless a legacy
-decision_spec_version "1.0" pin is set.
-
-Branch on execution_action only (CONTINUE | CONTINUE_WITH_MONITORING | REQUEST_APPROVAL | STOP).
-On non-CONTINUE authorize responses, control_envelope.next_agent_step is a structured
-remediation SUGGESTION the agent MAY follow (action, reason, resume_condition, then_call).
-It is NOT permission and NOT a control-flow override \u2014 still branch on execution_action.
-On CONTINUE / CONTINUE_WITH_MONITORING, next_agent_step is null (no remediation step).
-Human tier remains human_report.next_steps_prose (same source; prose, not machine).`;
+    var DESC_PREFLIGHT_CHANGE_SET = "Use this when: a change set of contract artifacts modifies OpenAPI, GraphQL, protobuf, AsyncAPI, MCP manifests, or agent tool schemas before merge, deploy, publish, or tool registration. Do not call for documentation-only changes, static readiness scoring, or receipt verification. Use analyze for risk only; authorize requires context.operation for permission. For receipt verification use coderifts.verify_receipt instead; for details of a past decision use coderifts.get_decision_details instead.";
     var DESC_VERIFY_RECEIPT = `Verify a CodeRifts signed chain-receipt you ALREADY HOLD: cryptographic
 authenticity (signature + key id), body binding, and \u2014 when lifecycle indices
 are available \u2014 whether it is currently valid authorization (not expired,
@@ -223725,7 +225037,11 @@ next_agent_step is a suggestion, not permission.`;
               }
             }
           },
-          annotations: { readOnlyHint: true, openWorldHint: false }
+          // Authorize CREATES an authorization (receipt / grant). readOnlyHint:true over-stated
+          // the mixed tool (roadmap 1212). Analyze is still informational (no receipt) — that
+          // is the mode, not this annotation. Split into two tools is deferred: then_call in
+          // response-envelope.js still names preflight_change_set, and the canonical set is 3.
+          annotations: { readOnlyHint: false, openWorldHint: false }
         },
         {
           name: "get_decision_details",
@@ -224255,9 +225571,9 @@ var require_generate_surface_anchor = __commonJS({
     var OUT = path.join(__dirname, "..", "src", "generated", "surface-anchor.json");
     var ENDPOINT = "https://app.coderifts.com/mcp";
     var VOLATILE_KEYS = Object.freeze([]);
-    var SOURCE_REF = "https://raw.githubusercontent.com/coderifts/api-governance/surface-db5cea2f/tools.wire.v1.json";
-    var SOURCE_REF_COMMIT = "95999b6553c1f91ed9fd140f60440ee3e1f0dcd6";
-    var SOURCE_REF_STATUS = `PINNED TO ONE REVISION. source_ref is the wire-format tools[] as served, published in the public coderifts/api-governance repo at tag surface-db5cea2f (commit ${SOURCE_REF_COMMIT}). Verified at fill time: the file's own tools_sha256, its tools[] recomputed under the canonical rule in digest_input, and this anchor's tools_sha256 are the same value. HOW TO USE IT: fetch it, recompute the digest yourself, and compare it to tools_sha256 here. IF THEY DIFFER, TRUST NEITHER -- it means the surface moved and this ref was not re-tagged. A tag can be force-moved; the commit SHA above cannot, so pin the SHA URL if you want the stronger form. OUR OBLIGATION: every surface change requires a NEW tag and a NEW source_ref in this file. Skipping that leaves this field pointing at an old surface while still looking authoritative, which is worse than the null it replaced. HOW THE OBLIGATION IS ENFORCED, on both sides: this repo CI-runs generate-surface-anchor.js --check --verify-source-ref, which fetches the ref above, recomputes its digest under the rule in digest_input, and FAILS if it is stale, self-inconsistent, or its tag is gone. The target repo runs scripts/validate-tools-wire.mjs from its own npm test and a CI workflow -- on push, on PR, and daily, because the wire target can go stale without anything in that repo changing. Both SKIP LOUDLY rather than fail on a transport error, and both treat a 404 as a real verdict rather than a network problem. Neither this ref nor those gates is a root of trust: pin the digest at YOUR approval time -- see honesty.pin_at_approval_time.`;
+    var SOURCE_REF = "https://raw.githubusercontent.com/coderifts/api-governance/surface-c3ec5f69/tools.wire.v1.json";
+    var SOURCE_REF_COMMIT = "2496038c4bca672e0e9730a8de92db34d0556bb5";
+    var SOURCE_REF_STATUS = `PINNED TO ONE REVISION. source_ref is the wire-format tools[] as served, published in the public coderifts/api-governance repo at tag surface-c3ec5f69 (commit ${SOURCE_REF_COMMIT}). Verified at fill time: the file's own tools_sha256, its tools[] recomputed under the canonical rule in digest_input, and this anchor's tools_sha256 are the same value. HOW TO USE IT: fetch it, recompute the digest yourself, and compare it to tools_sha256 here. IF THEY DIFFER, TRUST NEITHER -- it means the surface moved and this ref was not re-tagged. A tag can be force-moved; the commit SHA above cannot, so pin the SHA URL if you want the stronger form. OUR OBLIGATION: every surface change requires a NEW tag and a NEW source_ref in this file. Skipping that leaves this field pointing at an old surface while still looking authoritative, which is worse than the null it replaced. HOW THE OBLIGATION IS ENFORCED, on both sides: this repo CI-runs generate-surface-anchor.js --check --verify-source-ref, which fetches the ref above, recomputes its digest under the rule in digest_input, and FAILS if it is stale, self-inconsistent, or its tag is gone. The target repo runs scripts/validate-tools-wire.mjs from its own npm test and a CI workflow -- on push, on PR, and daily, because the wire target can go stale without anything in that repo changing. Both SKIP LOUDLY rather than fail on a transport error, and both treat a 404 as a real verdict rather than a network problem. Neither this ref nor those gates is a root of trust: pin the digest at YOUR approval time -- see honesty.pin_at_approval_time.`;
     var HONESTY = Object.freeze({
       pins_bytes_not_behaviour: "This anchor pins BYTES, not behaviour. It says the tool text you received is the text that was published. It says nothing about whether the model read it, understood it, or obeyed it.",
       scoped_to_its_profile: "This digest is scoped to the profile named above and to nothing else. The default-profile digest says NOTHING about the surface served with include_advanced_tools, which is a different tool set with a different digest. A hash without its profile does not identify a surface.",
@@ -224845,6 +226161,7 @@ var require_decision_result = __commonJS({
     } = require_policy_pin();
     var { sha256hex } = require_chain_attestation();
     var { canonicalJson } = require_canonical_json();
+    var { projectNextAgentStep } = require_next_agent_step2();
     var {
       buildRemediationTransaction,
       blockRequiredActionCore
@@ -224885,6 +226202,41 @@ var require_decision_result = __commonJS({
     function envelopeSafeForAgent(decision) {
       return decision === "ALLOW" || decision === "WARN";
     }
+    var SAFE_FOR_AGENT_SEMANTICS = Object.freeze({
+      "decision_result.safe_for_agent": Object.freeze({
+        question: "is the verdict ALLOW/WARN?",
+        kind: "verdict",
+        forced_false_by: Object.freeze([])
+      }),
+      safe_for_agent: Object.freeze({
+        question: "is it actually safe to proceed?",
+        kind: "defense_in_depth",
+        note: "1227: the most-read (flat) field is now defense-in-depth, same as control_envelope. A naive agent reading it must not proceed on a coverage-gapped ALLOW. The raw verdict stays on decision_result \u2014 no information lost.",
+        forced_false_by: Object.freeze([
+          "decision BLOCK",
+          "decision REQUIRE_APPROVAL",
+          "degraded",
+          "coverage_gap",
+          "fallback_reason",
+          "coverage_gap rule_id",
+          "webhook_surface_unanalyzed"
+        ])
+      }),
+      "control_envelope.safe_for_agent": Object.freeze({
+        question: "is it actually safe to proceed?",
+        kind: "defense_in_depth",
+        note: "the verdict AND the coverage check; this is the field to gate on",
+        forced_false_by: Object.freeze([
+          "degraded",
+          "coverage_gap",
+          "fallback_reason",
+          "coverage_gap rule_id",
+          "webhook_surface_unanalyzed"
+        ])
+      }),
+      invariant: "safe_for_agent == control_envelope.safe_for_agent <= decision_result.safe_for_agent",
+      invariant_means: "defense-in-depth only tightens: true may become false, false never becomes true. The flat field equals control_envelope (1227)."
+    });
     function mapSeverity(sev) {
       const up = String(sev || "").toUpperCase();
       return EVIDENCE_SEVERITIES.includes(up) ? up : "MEDIUM";
@@ -225026,8 +226378,27 @@ var require_decision_result = __commonJS({
       // RT-P-20 — fingerprint rebind expected bit (SERVER-authored; under body_hash).
       // true = gate must rebind; null/absent on legacy = not_expected (wire compat residual).
       // Caller cannot set/delete this — author only in change-set issuance path.
-      fingerprint_binding_expected: null
+      fingerprint_binding_expected: null,
       // true | false | null (legacy)
+      // I-1288 — the decision's own remediation SUGGESTION, INSIDE the signed envelope.
+      //
+      // WHY IT MOVED IN. The identical projection has always been on the response root, at
+      // control_envelope.next_agent_step. But k8s-admission, gateway-verifier and the guard's
+      // deployGate are handed the ENVELOPE and nothing else: they could verify the decision and
+      // still not say what to do about it without a second network call to the issuer. A field
+      // that only exists next to the envelope is not available to the parties the envelope was
+      // built for. Placed here it is covered by decision_body_hash, so the receipt signs the
+      // suggestion along with the decision that produced it — a tampered next step no longer
+      // verifies.
+      //
+      // STILL NOT PERMISSION. Being signed makes it authentic, not authoritative: agents branch
+      // on execution_action, exactly as before. Null on the allow class (CONTINUE /
+      // CONTINUE_WITH_MONITORING) is the correct value, not an absent measurement.
+      //
+      // ADDITIVE, so spec_version stays decision-result.v1.1 (producer ENVELOPE COMPATIBILITY
+      // rule 5: additive optional fields do not bump the major). control_envelope keeps emitting
+      // its copy from the same pure function — one projection, two placements, never two rules.
+      next_agent_step: null
     });
     var SOURCE_SLOTS = Object.freeze([
       "repository",
@@ -225193,6 +226564,10 @@ var require_decision_result = __commonJS({
       if (hasAdditive && decision === "BLOCK" && additive.required_action_core == null) {
         additive.required_action_core = blockRequiredActionCore(reasonCode(context, breakingCount));
       }
+      if (hasAdditive) {
+        const raForStep = additive.required_action_core != null && typeof additive.required_action_core === "object" ? additive.required_action_core : required_action;
+        additive.next_agent_step = projectNextAgentStep(execution_action, raForStep);
+      }
       if (hasAdditive) {
         if (remediation_transaction) {
           additive.remediation_transaction = remediation_transaction;
@@ -225251,6 +226626,7 @@ var require_decision_result = __commonJS({
     module2.exports = {
       buildDecisionResultV1,
       envelopeSafeForAgent,
+      SAFE_FOR_AGENT_SEMANTICS,
       proseToType,
       toUtcSeconds,
       computeBodyHash,
@@ -227107,10 +228483,10 @@ var require_gate_pin = __commonJS({
   "src/generated/gate-pin.json"(exports2, module2) {
     module2.exports = {
       repo: "coderifts/contract-gate",
-      sha: "e5b6315e38c66a2274583ddf4d7be11515180326",
-      tag: "v0.5.0",
+      sha: "1fae5d2bb2b52e1e1b745e649eab8834eac45645",
+      tag: "v0.8.0",
       resolved_from: "https://github.com/coderifts/contract-gate refs/tags/v0",
-      resolved_at: "2026-08-26T08:37:01Z",
+      resolved_at: "2026-09-02T07:25:19Z",
       note: "STRICT template pins this full commit SHA (GitHub: only a full SHA is immutable). v0 is a tag we move on every release, so it is NOT a pin. Re-run scripts/generate-gate-pin.js on each gate release; Dependabot bumps adopters."
     };
   }
@@ -228786,13 +230162,13 @@ var require_agent_host_files_embedded = __commonJS({
       ".cursor/hooks.json"
     ]);
     var AGENT_HOST_FILES = Object.freeze({
-      "AGENTS.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent rules\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
-      "CLAUDE.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
-      ".cursor/rules/coderifts.mdc": '---\ndescription: CodeRifts API governance \u2014 when to preflight and how to branch\nglobs:\nalwaysApply: true\n---\n\n<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
-      ".github/copilot-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts instructions for GitHub Copilot\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
-      "coderifts-langgraph-policy.js": '// GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js\n// System policy string for a LangGraph (or similar) agent. Content is generated;\n// identical rule sentences to AGENTS.md / other formats.\n\'use strict\';\n\nmodule.exports = "Call `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\\n\\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\\n\\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\\n\\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\\n\\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\\n\\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not \\"proceed with caution\\" without monitoring.\\n\\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\\n\\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\\n\\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\\n\\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\\n\\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\\n\\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\\n\\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\\n\\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\\n\\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\\n\\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\\n\\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\\n\\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\\n\\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\\n\\nWith a proven tenant\u2194repo binding you may request `derivation:\\"server\\"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\\n\\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say \\"authorized, commit not proven\\".";\n',
-      "openai-agent-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent instructions\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
-      "skills/api-governance/SKILL.md": '---\nname: api-governance\ndescription: Before merging or shipping any API or tool-contract change: preflight the change set, then branch on execution_action.\n---\n\n# CodeRifts API Governance\n\n<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      "AGENTS.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent rules\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nVersions you may meet elsewhere: `cr.exec.v2` is the issued-token version for atomic execution, and `ENFORCING_STRICT_V1` is the versioned spelling of the strict profile. Neither is the default and neither is required by these rules \u2014 see `docs/grant-versions.md`.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      "CLAUDE.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nVersions you may meet elsewhere: `cr.exec.v2` is the issued-token version for atomic execution, and `ENFORCING_STRICT_V1` is the versioned spelling of the strict profile. Neither is the default and neither is required by these rules \u2014 see `docs/grant-versions.md`.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      ".cursor/rules/coderifts.mdc": '---\ndescription: CodeRifts API governance \u2014 when to preflight and how to branch\nglobs:\nalwaysApply: true\n---\n\n<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nVersions you may meet elsewhere: `cr.exec.v2` is the issued-token version for atomic execution, and `ENFORCING_STRICT_V1` is the versioned spelling of the strict profile. Neither is the default and neither is required by these rules \u2014 see `docs/grant-versions.md`.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      ".github/copilot-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts instructions for GitHub Copilot\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nVersions you may meet elsewhere: `cr.exec.v2` is the issued-token version for atomic execution, and `ENFORCING_STRICT_V1` is the versioned spelling of the strict profile. Neither is the default and neither is required by these rules \u2014 see `docs/grant-versions.md`.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      "coderifts-langgraph-policy.js": '// GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js\n// System policy string for a LangGraph (or similar) agent. Content is generated;\n// identical rule sentences to AGENTS.md / other formats.\n\'use strict\';\n\nmodule.exports = "Call `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\\n\\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\\n\\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\\n\\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\\n\\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\\n\\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not \\"proceed with caution\\" without monitoring.\\n\\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\\n\\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\\n\\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\\n\\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\\n\\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\\n\\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\\n\\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\\n\\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\\n\\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\\n\\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\\n\\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\\n\\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\\n\\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\\n\\nVersions you may meet elsewhere: `cr.exec.v2` is the issued-token version for atomic execution, and `ENFORCING_STRICT_V1` is the versioned spelling of the strict profile. Neither is the default and neither is required by these rules \u2014 see `docs/grant-versions.md`.\\n\\nWith a proven tenant\u2194repo binding you may request `derivation:\\"server\\"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\\n\\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say \\"authorized, commit not proven\\".";\n',
+      "openai-agent-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent instructions\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nVersions you may meet elsewhere: `cr.exec.v2` is the issued-token version for atomic execution, and `ENFORCING_STRICT_V1` is the versioned spelling of the strict profile. Neither is the default and neither is required by these rules \u2014 see `docs/grant-versions.md`.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      "skills/api-governance/SKILL.md": '---\nname: api-governance\ndescription: Before merging or shipping any API or tool-contract change: preflight the change set, then branch on execution_action.\n---\n\n# CodeRifts API Governance\n\n<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nVersions you may meet elsewhere: `cr.exec.v2` is the issued-token version for atomic execution, and `ENFORCING_STRICT_V1` is the versioned spelling of the strict profile. Neither is the default and neither is required by these rules \u2014 see `docs/grant-versions.md`.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
       ".claude/settings.json": '{\n  "hooks": {\n    "PreToolUse": [\n      {\n        "matcher": "Write|Edit|MultiEdit",\n        "hooks": [\n          {\n            "type": "command",\n            "command": "coderifts claude-hook",\n            "timeout": 60\n          }\n        ]\n      }\n    ]\n  }\n}\n',
       ".cursor/hooks.json": '{\n  "version": 1,\n  "hooks": {\n    "preToolUse": [\n      {\n        "command": "coderifts cursor-hook",\n        "matcher": "Write|Delete",\n        "timeout": 60,\n        "failClosed": true\n      }\n    ]\n  }\n}\n'
     });
@@ -228958,6 +230334,7 @@ ${USAGE}` };
     var AGENT_SETUP_HOOK_WIRE_LINES = Object.freeze([
       chalk.bold("  Claude Code hook (.claude/settings.json): fail-closed PreToolUse"),
       chalk.dim("  matcher Write|Edit|MultiEdit \u2192 coderifts claude-hook (exit 2 = BLOCK)."),
+      chalk.dim("  Path family: OpenAPI/Swagger, GraphQL, *.proto, AsyncAPI, MCP, tool-schema.json (plus git config coderifts.specPath; exclude via coderifts.specPathExclude)."),
       chalk.dim("  Missing key / API down / unreadable spec \u2192 exit 2 (enforce_indeterminate), not ALLOW."),
       chalk.dim("  Opt-out: CODERIFTS_ADVISORY=1|true restores soft-allow when governance could not run."),
       chalk.dim("  CODERIFTS_STRICT=1 cannot be weakened by ADVISORY.")
@@ -229358,6 +230735,7 @@ exit 0
       say(`Claude Code PreToolUse hook written to ${dest}`);
       if (backedUp) say(`Backup: ${backedUp}`);
       say("matcher Write|Edit|MultiEdit \u2192 coderifts claude-hook (exit 2 = BLOCK).");
+      say("governs the contract path family (OpenAPI/Swagger, GraphQL, *.proto, AsyncAPI, MCP, tool-schema) plus git config coderifts.specPath; opt out one path with coderifts.specPathExclude.");
       return { exitCode: 0, code: "OK", path: dest, backedUp, wrote: true };
     }
     var CURSOR_HOOK_BIN = "coderifts cursor-hook";
@@ -256034,10 +257412,12 @@ var require_github_workflow_pin = __commonJS({
     "use strict";
     var { STATUS } = require_github_enforcement();
     var PIN_REASON = Object.freeze({
-      /** The pinned sha is the blob sha of the workflow file at the head being merged. */
+      /** The pinned sha is the head commit sha being merged — GitHub's field, grants PASS. */
       WORKFLOW_SHA_MATCHES_HEAD: "workflow_sha_matches_head",
       /** A pin exists, but it names bytes that are not what is at the head. */
       WORKFLOW_SHA_STALE: "workflow_sha_stale",
+      /** Pin equals the file blob SHA, not a commit. Named; does NOT grant PASS. */
+      WORKFLOW_SHA_IS_BLOB: "workflow_sha_is_blob",
       /** No sha in the rule — the ruleset names a path, so rewriting the file changes what runs. */
       WORKFLOW_NOT_PINNED: "workflow_not_pinned",
       /** We could not read the workflow file at the head, so no comparison is possible. */
@@ -256053,7 +257433,8 @@ var require_github_workflow_pin = __commonJS({
         workflow_ref: null,
         workflow_sha: null,
         workflow_sha_matches_head: false,
-        matched_against: null
+        matched_against: null,
+        grants_pass: false
       };
       if (!pin || !Array.isArray(pin.workflows) || pin.workflows.length === 0) {
         return {
@@ -256091,14 +257472,26 @@ var require_github_workflow_pin = __commonJS({
       }
       const matchedBlob = sameSha(pinned.sha, blobSha);
       const matchedCommit = sameSha(pinned.sha, headCommitSha);
-      if (matchedBlob || matchedCommit) {
+      if (matchedCommit) {
         return {
           ...fields,
           status: STATUS.VERIFIED,
           reason_code: PIN_REASON.WORKFLOW_SHA_MATCHES_HEAD,
           workflow_sha_matches_head: true,
-          matched_against: matchedBlob ? "blob" : "commit",
-          reason: `the ruleset pins ${fields.workflow_path} to ${fields.workflow_sha}, which is the ${matchedBlob ? "blob sha of that file" : "head commit"} being merged. Moving this pin requires editing the ruleset (repository administration), a different permission from workflow write \u2014 so the check is attributable to THIS workflow, not merely to Actions. It still does not establish that the pinned workflow ran, nor that bypass actors cannot skip the ruleset entirely.`
+          matched_against: "commit",
+          grants_pass: true,
+          reason: `the ruleset pins ${fields.workflow_path} to ${fields.workflow_sha}, which is the head commit being merged (GitHub workflows[].sha is a commit SHA, not a file blob). That match grants PASS. Moving this pin requires editing the ruleset (repository administration), a different permission from workflow write \u2014 so the check is attributable to THIS workflow, not merely to Actions. It still does not establish that the pinned workflow ran, nor that bypass actors cannot skip the ruleset entirely, nor that the pin equals the file blob SHA.`
+        };
+      }
+      if (matchedBlob) {
+        return {
+          ...fields,
+          status: STATUS.UNVERIFIABLE,
+          reason_code: PIN_REASON.WORKFLOW_SHA_IS_BLOB,
+          workflow_sha_matches_head: false,
+          matched_against: "blob",
+          grants_pass: false,
+          reason: "pinned sha matches the file blob, not a commit \u2014 GitHub treats workflows[].sha as a commit SHA. Blob equality is named and does not grant PASS."
         };
       }
       return {
@@ -256107,9 +257500,26 @@ var require_github_workflow_pin = __commonJS({
         reason_code: PIN_REASON.WORKFLOW_SHA_STALE,
         workflow_sha_matches_head: false,
         matched_against: null,
+        grants_pass: false,
         reason: `the ruleset pins ${fields.workflow_path} to ${fields.workflow_sha}, but the head carries ${blobSha || headCommitSha || "(nothing readable)"}. A pin to bytes nobody is merging gates nothing.`
       };
     }
+    function evidenceStatement(headComparison) {
+      if (headComparison && headComparison.grants_pass === true) {
+        return "With the required workflow pinned by sha and that sha matching the head commit SHA (GitHub workflows[].sha is a commit SHA, not a file blob), the check is attributable to this workflow rather than to GitHub Actions in general: moving the pin requires repository administration, which is a different permission from workflow write. The common-issuer objection is closed WITHOUT a second GitHub App. This is not a blob-sha content pin.";
+      }
+      if (headComparison && headComparison.matched_against === "blob") {
+        return "The pinned sha equals the workflow file blob, not the head commit. GitHub treats workflows[].sha as a commit SHA, so blob equality does not grant PASS. The common-issuer objection is not closed by a blob match.";
+      }
+      const code = headComparison && headComparison.reason_code;
+      if (code === PIN_REASON.WORKFLOW_SHA_STALE) {
+        return "A sha-pinned required workflow exists, but the pin names bytes that are not on the head. A stale pin gates nothing and does not grant PASS.";
+      }
+      if (code === PIN_REASON.WORKFLOW_FILE_UNREADABLE) {
+        return "A sha-pinned required workflow exists, but the pin could not be compared with the head. That is UNVERIFIABLE, not a match, and does not grant PASS.";
+      }
+      return "Without a sha-pinned required workflow, the issuer proves the check came from GitHub Actions, not that it came from this workflow. Anyone who can write .github/workflows can post a passing check under the same shared issuer id.";
+    }
     function workflowBindingEvidence(pin, headComparison) {
       return {
         pin_status: pin ? pin.status : STATUS.UNVERIFIABLE,
@@ -256119,10 +257529,11 @@ var require_github_workflow_pin = __commonJS({
         workflow_sha: headComparison.workflow_sha,
         workflow_sha_matches_head: headComparison.workflow_sha_matches_head,
         matched_against: headComparison.matched_against,
+        grants_pass: headComparison.grants_pass === true,
         status: headComparison.status,
         reason_code: headComparison.reason_code,
         reason: headComparison.reason,
-        statement: headComparison.workflow_sha_matches_head ? "With the required workflow pinned by sha and that sha present on the head, the check is attributable to this workflow file rather than to GitHub Actions in general: moving the pin requires repository administration, which is a different permission from workflow write. The common-issuer objection is closed WITHOUT a second GitHub App." : "Without a sha-pinned required workflow, the issuer proves the check came from GitHub Actions, not that it came from this workflow. Anyone who can write .github/workflows can post a passing check under the same shared issuer id."
+        statement: evidenceStatement(headComparison)
       };
     }
     module2.exports = { PIN_REASON, evaluateWorkflowShaMatchesHead, workflowBindingEvidence };
@@ -256645,12 +258056,27 @@ var require_setup_required_check = __commonJS({
       }
       const commitRead = runApi([`repos/${owner}/${repo}/commits/${encodeURIComponent(branch)}`], { cwd });
       const commitSha = commitRead && commitRead.ok && commitRead.body && (typeof commitRead.body.sha === "string" ? commitRead.body.sha : commitRead.body.commit && commitRead.body.commit.sha) || null;
+      if (!commitSha || !/^[0-9a-f]{40}$/i.test(commitSha)) {
+        if (!options.json) {
+          logErr(chalk.red(`Could not resolve a commit SHA for ${branch}.`));
+          logErr("  GitHub ruleset workflows[].sha is a commit SHA, not a file blob SHA \u2014 refusing to pin.");
+        }
+        return finish(EXIT.ERROR, {
+          ok: false,
+          code: "WORKFLOW_COMMIT_SHA_UNRESOLVED",
+          owner,
+          repo,
+          branch,
+          workflow_path: WORKFLOW_REL,
+          http_status: commitRead ? commitRead.status : null
+        });
+      }
       const rulesetDocs = fetchRulesetDocs(runApi, owner, repo, cwd) || [];
       const existing = findExistingWorkflowRuleset(rulesetDocs, WORKFLOW_REL);
       const created = buildWorkflowRulesetPayload({
         repositoryId,
         branch,
-        sha: blobSha,
+        sha: commitSha,
         path: WORKFLOW_REL
       });
       const payload = existing ? mergeWorkflowRule(existing, created) : created;
@@ -256661,7 +258087,8 @@ var require_setup_required_check = __commonJS({
         if (!options.json) {
           log(chalk.yellow(`Dry-run: pin ${WORKFLOW_REL} as a required workflow on ${branch}.`));
           log(`  repo:   ${owner}/${repo} (id ${repositoryId})`);
-          log(`  blob:   ${blobSha}`);
+          log(`  commit: ${commitSha}`);
+          log(`  blob (file object): ${blobSha}`);
           log(`  ${existing ? `update ruleset ${existing.id}` : "create ruleset"} ${payload.name}`);
           log("");
           log(cmdText);
@@ -257463,9 +258890,22 @@ var require_enforce_check = __commonJS({
           );
         }
       }
+      const requireBinding = options.requireWorkflowBinding === true;
+      const bindingGrantsPass = report.workflow_binding && report.workflow_binding.grants_pass === true;
+      const bindingExit = requireBinding && !bindingGrantsPass ? 1 : 0;
+      if (bindingExit !== 0) {
+        const wb = report.workflow_binding || {};
+        errLog(chalk.red(
+          `--require-workflow-binding: the required workflow is not sha-pinned to this head (status ${wb.status || "UNKNOWN"}${wb.reason_code ? `, ${wb.reason_code}` : ""}).`
+        ));
+        if (wb.reason) errLog(chalk.dim(`  ${wb.reason}`));
+        errLog(chalk.dim(
+          "  This is the CLI audit verdict on the Action path, not a merge block \u2014 the App-path clamp is a separate control."
+        ));
+      }
       if (options.json) log(JSON.stringify(report, null, 2));
       else log(renderHuman(report));
-      return { exitCode: 0, report };
+      return { exitCode: bindingExit, report };
     }
     module2.exports = {
       runEnforceCheck,
@@ -257558,7 +258998,7 @@ var require_enforce = __commonJS({
           return { exitCode: 1, error: "check_apply_conflict", outcomes: [] };
         }
         const { runEnforceCheck } = require_enforce_check();
-        return runEnforceCheck(options, deps);
+        return runEnforceCheck({ ...options, requireWorkflowBinding: options.requireWorkflowBinding === true }, deps);
       }
       const apply = options.apply === true;
       const getKey = deps.getApiKey || getApiKey;