coderifts 8.0.0 → 8.0.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 8.0.1 - 2026-09-02
+
+### Changed
+- `--require-workflow-binding` now gates the exit code: `enforce --check` exits non-zero when the required workflow is not SHA-pinned to the head (Action-path audit verdict; default off, advisory output unchanged without the flag).
+- The generated strict workflow pins contract-gate v0.8.0 (1fae5d2); the previously published 8.0.0 still pinned 0.7.0.
+- `@coderifts/agent-guard` range follows the published 15.1.0; embedded agent rule text regenerated (names cr.exec.v2 and ENFORCING_STRICT_V1 once).
+
 ## 8.0.0
 
 ### Security

package/README.md

@@ -86,13 +86,13 @@ coderifts init --agents --check          # which of the four pieces are present
 | **Host hook** | `.claude/settings.json`, `.cursor/hooks.json` | Reuses `hook install --claude` / `--cursor` (JSON-merge, backup, idempotent). Copilot shares Claude's `.claude/settings.json` — VS Code reads it by default. |
 | **CI workflow** | `.github/workflows/coderifts.yml` | `coderifts/contract-gate@v0`. Default: `require-verified-monitoring` commented (honest default: **false**). `--strict`: the same file with `require-verified-monitoring: 'true'` |
 
-**Grant versions** (these names are not interchangeable):
+**Grant versions** (these names are not interchangeable; field-by-field matrix: [Grant versions](https://github.com/coderifts/app/blob/main/docs/grant-versions.md)):
 
 | What | Who uses it | What it proves |
 |------|-------------|----------------|
 | `cr.exec.v1` | capability-demo and the strict-install workflow (`require-grant`) | A reference/teaching execution grant bound to `operation ∥ target_id ∥ after_payload`. The demo and `coderifts init --agents --strict` use this form. |
-| Atomic V2 request (`execution-grant-request.v2` fields) | SDK, Guard, executor | The request contract those three speak when minting/verifying a grant. Not the same bytes as a `cr.exec.v1` token. |
-| `ENFORCING_STRICT` | Guard `withCodeRifts({ profile })` | The current **profile name**. It is unsuffixed today and will become a versioned name; it is not a grant format and not Atomic V1. |
+| Atomic V2 request (the V2 fields of the authorize request; see docs/grant-versions.md) | TS SDK, Python SDK, Guard (not MCP; not the capability-demo executor) | The request contract those three speak when minting a grant. Not the same bytes as a `cr.exec.v1` token. |
+| `ENFORCING_STRICT` | Guard `withCodeRifts({ profile })` | Permanent alias of `ENFORCING_STRICT_V1` (must resolve to `_V1` forever). Not a grant format. Different axis from `ENFORCING_ATOMIC_V1`/`V2`. |
 
 `--strict` turns on `require-grant` and `require-verified-monitoring` in the workflow; it does not rename those three things.
 
@@ -453,7 +453,7 @@ failed, **1** on missing repo/key, API error, or any apply failure.
 | `--branch <name>` | With `--check`: branch (default: repo default) | default branch |
 | `--provider <name>` | With `--check`: provider adapter. `github` only; others report UNVERIFIABLE and are never stubbed | `github` |
 | `--head-sha <sha>` | With `--check`: pull-request head commit, so the required-workflow pin can be compared with the bytes being merged | none |
-| `--require-workflow-binding` | With `--check`: also require a sha-pinned required workflow matching the head. **Default OFF** — without it the evidence still gains a `workflow_binding` section and neither the verdict nor the exit code changes | `false` |
+| `--require-workflow-binding` | With `--check`: **exit non-zero** when the required workflow is not sha-pinned to the head (`workflow_binding.grants_pass !== true`). Scope: the CLI's own audit verdict on the **Action path** — it is not the App-path merge clamp, which is decided server-side and is a separate control. **Default OFF** — without the flag the evidence is byte-identical, the verdict is unchanged and the exit code stays 0 (advisory) | `false` |
 | `--json` | Machine-readable JSON result | `false` |
 
 ```bash