coderifts 8.0.0 → 8.0.1

package/dist/cli.js

@@ -3028,7 +3028,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "8.0.0",
+      version: "8.0.1",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -3068,13 +3068,13 @@ var require_package = __commonJS({
       },
       scripts: {
         build: "node scripts/copy-corpus.js && node scripts/build.js",
-        prepublishOnly: "node scripts/assert-guard-major.js && node scripts/assert-changelog-version.js && bash ../../scripts/freeze-gate.sh && npm run build",
+        prepublishOnly: "node scripts/assert-guard-major.js && node scripts/assert-changelog-version.js && bash ../../scripts/freeze-gate.sh && npm run build && bash ../../scripts/release-check.sh .",
         "assert-guard-major": "node scripts/assert-guard-major.js",
         postinstall: "node scripts/postinstall.js",
         test: "node --test test/*.test.js"
       },
       dependencies: {
-        "@coderifts/agent-guard": "^15.0.0",
+        "@coderifts/agent-guard": "^15.1.0",
         chalk: "^4.1.2",
         "cli-table3": "^0.6.4",
         commander: "^12.0.0",
@@ -68128,7 +68128,7 @@ var require_client = __commonJS({
         this.timeout = options.timeout || DEFAULT_TIMEOUT;
       }
       // ─── Internal HTTP helper ──────────────────────────────────────────────
-      async request(method, path, body) {
+      async request(method, path, body, extraHeaders) {
         const url = `${this.baseUrl}${path}`;
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), this.timeout);
@@ -68137,7 +68137,8 @@ var require_client = __commonJS({
             method,
             headers: {
               "Content-Type": "application/json",
-              Authorization: `Bearer ${this.apiKey}`
+              Authorization: `Bearer ${this.apiKey}`,
+              ...extraHeaders || {}
             },
             body: body ? JSON.stringify(body) : void 0,
             signal: controller.signal
@@ -68340,8 +68341,12 @@ var require_client = __commonJS({
        * `decision` / `safe_for_agent` (authorize) or `analysis_outcome` (analyze). Call
        * `analyzeChangeSet` / `authorizeChangeSet` instead to get an already-narrowed type.
        */
-      async preflightChangeSet(req) {
-        return this.request("POST", "/api/v1/preflight", req);
+      async preflightChangeSet(req, opts) {
+        const extra = {};
+        const token = opts && typeof opts.scmToken === "string" ? opts.scmToken.trim() : "";
+        if (token)
+          extra["X-Coderifts-Scm-Token"] = token;
+        return this.request("POST", "/api/v1/preflight", req, extra);
       }
       /**
        * Risk-only preflight (`preflight_mode: 'analyze'`). Informational — not permission;
@@ -68350,11 +68355,11 @@ var require_client = __commonJS({
        * The mode is fixed by this method, so the analyze branch is returned directly — there is no
        * `decision` / `execution_action` / `safe_for_agent` on it, by protocol.
        */
-      async analyzeChangeSet(req) {
+      async analyzeChangeSet(req, opts) {
         return this.preflightChangeSet({
           ...req,
           preflight_mode: "analyze"
-        });
+        }, opts);
       }
       /**
        * Operation-bound authorize preflight (`preflight_mode: 'authorize'`).
@@ -68364,11 +68369,11 @@ var require_client = __commonJS({
        * The mode is fixed by this method, so the authorize branch is returned directly:
        * `decision`, `execution_action` and `safe_for_agent` are present without narrowing.
        */
-      async authorizeChangeSet(req) {
+      async authorizeChangeSet(req, opts) {
         return this.preflightChangeSet({
           ...req,
           preflight_mode: "authorize"
-        });
+        }, opts);
       }
       // ─── 9. verifyReceipt ──────────────────────────────────────────────────
       /**
@@ -68581,7 +68586,7 @@ var require_execution_grant = __commonJS({
   "node_modules/@coderifts/sdk/dist/cjs/execution-grant.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.CLOCK_SKEW_LEEWAY_MS = exports2.GRANT_SIGNING_PREFIX = exports2.GRANT_VERSION = void 0;
+    exports2.CLOCK_SKEW_LEEWAY_MS = exports2.GRANT_SIGNING_PREFIX = exports2.GRANT_VERSION_V2 = exports2.GRANT_VERSION = void 0;
     exports2.afterPayloadCanonical = afterPayloadCanonical;
     exports2.computeScopeHash = computeScopeHash;
     exports2.receiptDigest = receiptDigest;
@@ -68592,6 +68597,7 @@ var require_execution_grant = __commonJS({
       return leeway_js_1.CLOCK_SKEW_LEEWAY_MS;
     } });
     exports2.GRANT_VERSION = "cr.exec.v1";
+    exports2.GRANT_VERSION_V2 = "cr.exec.v2";
     exports2.GRANT_SIGNING_PREFIX = "crexec.v1";
     var NUL = "";
     var SIGNED_FIELDS = [
@@ -69226,7 +69232,7 @@ var require_cjs3 = __commonJS({
   "node_modules/@coderifts/sdk/dist/cjs/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.MONITOR_ATTEST_ENVELOPE_TAG = exports2.MONITOR_ATTEST_SIGNING_PREFIX = exports2.MONITOR_ATTEST_VERSION = exports2.monitorAttestSigningInput = exports2.verifyMonitoringAttestation = exports2.ATTEST_ENVELOPE_TAG = exports2.ATTEST_SIGNING_PREFIX = exports2.ATTEST_VERSION = exports2.attestSigningInput = exports2.verifyExecutionAttestation = exports2.GRANT_SIGNING_PREFIX = exports2.GRANT_VERSION = exports2.receiptDigest = exports2.afterPayloadCanonical = exports2.computeScopeHash = exports2.verifyExecutionGrant = exports2.isIssuedInFuture = exports2.isReceiptExpired = exports2.declaresDestructiveProduction = exports2.expiryLeewayMs = exports2.CLOCK_SKEW_LEEWAY_MS = exports2.readDecision = exports2.AuthError = exports2.RateLimitError = exports2.TimeoutError = exports2.ApiError = exports2.CodeRiftsError = exports2.resetPolicyWarnForTests = exports2.warnPolicyAbsentOnce = exports2.observePolicyPresence = exports2.detectPolicyPresence = exports2.policyPresenceOf = exports2.withPolicy = exports2.POLICY_ABSENT_WARN = exports2.POLICY_MARKER = exports2.CODERIFTS_POLICY = exports2.CodeRifts = void 0;
+    exports2.MONITOR_ATTEST_ENVELOPE_TAG = exports2.MONITOR_ATTEST_SIGNING_PREFIX = exports2.MONITOR_ATTEST_VERSION = exports2.monitorAttestSigningInput = exports2.verifyMonitoringAttestation = exports2.ATTEST_ENVELOPE_TAG = exports2.ATTEST_SIGNING_PREFIX = exports2.ATTEST_VERSION = exports2.attestSigningInput = exports2.verifyExecutionAttestation = exports2.GRANT_SIGNING_PREFIX = exports2.GRANT_VERSION_V2 = exports2.GRANT_VERSION = exports2.receiptDigest = exports2.afterPayloadCanonical = exports2.computeScopeHash = exports2.verifyExecutionGrant = exports2.isIssuedInFuture = exports2.isReceiptExpired = exports2.declaresDestructiveProduction = exports2.expiryLeewayMs = exports2.CLOCK_SKEW_LEEWAY_MS = exports2.readDecision = exports2.AuthError = exports2.RateLimitError = exports2.TimeoutError = exports2.ApiError = exports2.CodeRiftsError = exports2.resetPolicyWarnForTests = exports2.warnPolicyAbsentOnce = exports2.observePolicyPresence = exports2.detectPolicyPresence = exports2.policyPresenceOf = exports2.withPolicy = exports2.POLICY_ABSENT_WARN = exports2.POLICY_MARKER = exports2.CODERIFTS_POLICY = exports2.CodeRifts = void 0;
     var client_js_1 = require_client();
     Object.defineProperty(exports2, "CodeRifts", { enumerable: true, get: function() {
       return client_js_1.CodeRifts;
@@ -69311,6 +69317,9 @@ var require_cjs3 = __commonJS({
     Object.defineProperty(exports2, "GRANT_VERSION", { enumerable: true, get: function() {
       return execution_grant_js_1.GRANT_VERSION;
     } });
+    Object.defineProperty(exports2, "GRANT_VERSION_V2", { enumerable: true, get: function() {
+      return execution_grant_js_1.GRANT_VERSION_V2;
+    } });
     Object.defineProperty(exports2, "GRANT_SIGNING_PREFIX", { enumerable: true, get: function() {
       return execution_grant_js_1.GRANT_SIGNING_PREFIX;
     } });
@@ -70168,6 +70177,35 @@ var require_deny_remedy = __commonJS({
   }
 });
 
+// node_modules/@coderifts/agent-guard/dist/cjs/next-agent-step.js
+var require_next_agent_step = __commonJS({
+  "node_modules/@coderifts/agent-guard/dist/cjs/next-agent-step.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.NEXT_STEP_NOTE = exports2.NEXT_AGENT_ACTIONS = void 0;
+    exports2.readNextAgentStep = readNextAgentStep;
+    exports2.NEXT_AGENT_ACTIONS = [
+      "re_preflight",
+      "revert",
+      "migrate",
+      "escalate",
+      "await_approval"
+    ];
+    function readNextAgentStep(envelope) {
+      if (!envelope || typeof envelope !== "object")
+        return null;
+      const raw = envelope.next_agent_step;
+      if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+      const step = raw;
+      if (typeof step.action !== "string" || step.action.length === 0)
+        return null;
+      return step;
+    }
+    exports2.NEXT_STEP_NOTE = "This is the decision's remediation suggestion, not permission; branch on execution_action.";
+  }
+});
+
 // node_modules/@coderifts/agent-guard/dist/cjs/execution-grant.js
 var require_execution_grant2 = __commonJS({
   "node_modules/@coderifts/agent-guard/dist/cjs/execution-grant.js"(exports2) {
@@ -70315,6 +70353,7 @@ var require_guard = __commonJS({
     var monitoring_attestation_js_1 = require_monitoring_attestation2();
     var policy_js_1 = require_policy2();
     var deny_remedy_js_1 = require_deny_remedy();
+    var next_agent_step_js_1 = require_next_agent_step();
     var execution_grant_js_1 = require_execution_grant2();
     var breakers = /* @__PURE__ */ new WeakMap();
     var nowMs = () => Date.now();
@@ -70494,6 +70533,7 @@ var require_guard = __commonJS({
       const base = { executionAttempted: false, executed: false, enforced: false, verdict, preflighted };
       const cov = coverageSnap(config);
       const cause = "cause" in verdict ? verdict.cause : null;
+      const nextStep = "envelope" in verdict && "receiptVerified" in verdict && verdict.receiptVerified === true ? (0, next_agent_step_js_1.readNextAgentStep)(verdict.envelope) : null;
       const remedy = call ? (0, deny_remedy_js_1.buildDenyRemedy)({
         error: (0, deny_remedy_js_1.denyErrorForReason)(cause),
         target: call.toolName || null,
@@ -70518,7 +70558,8 @@ var require_guard = __commonJS({
         ...monitoring_attestation ? { monitoring_attestation } : {},
         ...coverageOutcomeFieldsFrom(cov),
         ...grantObs ? { execution_grant: grantObs } : {},
-        ...remedy ? { remedy } : {}
+        ...remedy ? { remedy } : {},
+        ...nextStep ? { next_step: nextStep } : {}
       };
       return attachPolicyPresence(out, config);
     }
@@ -73582,6 +73623,7 @@ var require_deploy_receipt_token = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.CHAIN_SIGNING_PREFIX = void 0;
     exports2.verifyDeployReceiptToken = verifyDeployReceiptToken;
+    var next_agent_step_js_1 = require_next_agent_step();
     var node_crypto_1 = require("node:crypto");
     var sdk_1 = require_cjs3();
     var receipt_binding_js_1 = require_receipt_binding();
@@ -73714,7 +73756,12 @@ var require_deploy_receipt_token = __commonJS({
         bound_artifact_id: artifact == null ? null : String(artifact),
         verdict_fingerprint: typeof envelope.fingerprint === "string" ? envelope.fingerprint : typeof payload.fp === "string" ? payload.fp : void 0,
         body_hash: typeof payload.bh === "string" ? payload.bh : void 0,
-        target_id: envelope.target_id == null ? void 0 : String(envelope.target_id)
+        target_id: envelope.target_id == null ? void 0 : String(envelope.target_id),
+        // Read from the envelope the caller supplied. On the currently_authorized path the
+        // body hash has already bound it; on the expired / retired-key paths the signature
+        // was authentic too. Every path that did NOT authenticate returns through fail(),
+        // which sets view: null — so this field cannot carry an unsigned step.
+        next_agent_step: (0, next_agent_step_js_1.readNextAgentStep)(envelope)
       };
     }
     function verifyDeployReceiptToken(input, _intended = {}, nowMs) {
@@ -73847,6 +73894,7 @@ var require_deploy_gate = __commonJS({
     exports2.isVerifiedDeployReceiptView = isVerifiedDeployReceiptView;
     exports2.deployGate = deployGate;
     var deploy_receipt_token_js_1 = require_deploy_receipt_token();
+    var next_agent_step_js_1 = require_next_agent_step();
     exports2.DEPLOY_RECEIPT_VIEW_SPEC = "deploy-receipt-view.v1";
     function asVerifiedDeployReceiptView(view, verify_status = "VERIFIED_CURRENT") {
       return {
@@ -73908,16 +73956,21 @@ var require_deploy_gate = __commonJS({
         bound_artifact_id: r && r.bound_artifact_id != null ? norm(r.bound_artifact_id) : null,
         operation: r && r.operation != null ? String(r.operation) : null
       });
-      const deny = (state, reason) => ({
-        deploy_allowed: false,
-        state,
-        reason,
-        enforcement_state,
-        inescapable_deploy: false,
-        residuals: [],
-        detail: detailOf(receipt),
-        verification
-      });
+      const nextStepOf = (r) => verification.mode === "token" ? (0, next_agent_step_js_1.readNextAgentStep)(r) : null;
+      const deny = (state, reason) => {
+        const step = nextStepOf(receipt);
+        return {
+          deploy_allowed: false,
+          state,
+          reason,
+          enforcement_state,
+          inescapable_deploy: false,
+          residuals: [],
+          detail: detailOf(receipt),
+          verification,
+          ...step ? { next_step: step } : {}
+        };
+      };
       if (!target.environment || String(target.environment).trim() === "" || !target.artifact_id || String(target.artifact_id).trim() === "") {
         return deny(allowPending ? "pending" : "failure", "inputs_incomplete");
       }
@@ -74562,9 +74615,10 @@ var require_with_coderifts = __commonJS({
   "node_modules/@coderifts/agent-guard/dist/cjs/with-coderifts.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.PROFILE_ENFORCING_ATOMIC_V2 = exports2.PROFILE_ENFORCING_ATOMIC_V1 = exports2.PROFILE_ENFORCING_STRICT_V1 = void 0;
+    exports2.UNVERSIONED_PROFILE_NOTICE = exports2.PROFILE_ENFORCING_ATOMIC_V2 = exports2.PROFILE_ENFORCING_ATOMIC_V1 = exports2.PROFILE_ENFORCING_STRICT_V1 = void 0;
     exports2.foldTableSettledCalls = foldTableSettledCalls;
     exports2.guardedFractionAmongRoutes = guardedFractionAmongRoutes;
+    exports2._resetUnversionedProfileNoticeForTest = _resetUnversionedProfileNoticeForTest;
     exports2.withCodeRifts = withCodeRifts;
     var tool_registry_js_1 = require_tool_registry();
     var execution_grant_js_1 = require_execution_grant2();
@@ -74625,6 +74679,19 @@ var require_with_coderifts = __commonJS({
     function isEnforcingStrict(input) {
       return input.profile === "ENFORCING_STRICT" || input.profile === exports2.PROFILE_ENFORCING_STRICT_V1;
     }
+    exports2.UNVERSIONED_PROFILE_NOTICE = "ENFORCING_STRICT is the unversioned spelling of ENFORCING_STRICT_V1; prefer the versioned name.";
+    var noticedUnversionedProfile = false;
+    function _resetUnversionedProfileNoticeForTest() {
+      noticedUnversionedProfile = false;
+    }
+    function noticeUnversionedProfileOnce(profile) {
+      if (profile !== "ENFORCING_STRICT")
+        return;
+      if (noticedUnversionedProfile)
+        return;
+      noticedUnversionedProfile = true;
+      console.warn(exports2.UNVERSIONED_PROFILE_NOTICE);
+    }
     function enforcingStrictExecutionChainProblems(input) {
       const grant = input.executionGrant;
       const enabled = !!(grant && grant.enabled === true);
@@ -74855,6 +74922,7 @@ var require_with_coderifts = __commonJS({
       if (!input || typeof input !== "object") {
         throw new Error("withCodeRifts: input object is required");
       }
+      noticeUnversionedProfileOnce(input.profile);
       const problems = [];
       if (typeof input.operation !== "string" || input.operation.trim() === "") {
         problems.push("`operation` is required and must be a non-empty string (receipts bind to an operation; merge != deploy, so there is no safe default)");
@@ -75525,6 +75593,110 @@ var require_gemini = __commonJS({
   }
 });
 
+// node_modules/@coderifts/agent-guard/dist/cjs/adapters/langchain.js
+var require_langchain = __commonJS({
+  "node_modules/@coderifts/agent-guard/dist/cjs/adapters/langchain.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.LANGCHAIN_ARTIFACT_SPEC = void 0;
+    exports2.defaultSerializeLangChainToolResult = defaultSerializeLangChainToolResult;
+    exports2.bindLangChainToolOutcome = bindLangChainToolOutcome;
+    var final_answer_proof_js_1 = require_final_answer_proof();
+    var gate_refusal_js_1 = require_gate_refusal();
+    function defaultSerializeLangChainToolResult(result) {
+      if (typeof result === "string")
+        return result;
+      if (typeof result === "number" || typeof result === "boolean" || typeof result === "bigint" || result === null || result === void 0) {
+        return String(result);
+      }
+      try {
+        return JSON.stringify(result);
+      } catch {
+        return String(result);
+      }
+    }
+    exports2.LANGCHAIN_ARTIFACT_SPEC = "coderifts-guard-artifact.v1";
+    function bindLangChainToolOutcome(outcome, args) {
+      const serialize = args.serialize ?? defaultSerializeLangChainToolResult;
+      let body;
+      if (outcome.executed === true) {
+        body = serialize(outcome.result);
+      } else if (outcome.executionAttempted === false) {
+        body = (0, gate_refusal_js_1.formatGateRefusalBody)(outcome);
+      } else {
+        const err = "error" in outcome ? outcome.error : void 0;
+        const kind = (0, gate_refusal_js_1.verdictKind)(outcome);
+        body = `Tool execution failed after gate decision (verdict: ${kind}): ${(0, gate_refusal_js_1.formatGuardError)(err)}`;
+      }
+      const content = args.attachProof === false ? body : (0, final_answer_proof_js_1.attachProofToAgentResponse)(body, outcome.proof);
+      const out = {
+        content,
+        artifact: {
+          artifact_spec: exports2.LANGCHAIN_ARTIFACT_SPEC,
+          final_answer_proof: outcome.proof,
+          executed: outcome.executed === true,
+          enforced: outcome.enforced === true,
+          verdict: (0, gate_refusal_js_1.verdictKind)(outcome)
+        },
+        tool_call_id: args.tool_call_id
+      };
+      if (args.name != null && args.name !== "") {
+        out.name = args.name;
+      }
+      return out;
+    }
+  }
+});
+
+// node_modules/@coderifts/agent-guard/dist/cjs/adapters/crewai.js
+var require_crewai = __commonJS({
+  "node_modules/@coderifts/agent-guard/dist/cjs/adapters/crewai.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.defaultSerializeCrewAIToolResult = defaultSerializeCrewAIToolResult;
+    exports2.bindCrewAIToolOutcome = bindCrewAIToolOutcome;
+    var final_answer_proof_js_1 = require_final_answer_proof();
+    var gate_refusal_js_1 = require_gate_refusal();
+    function defaultSerializeCrewAIToolResult(result) {
+      if (typeof result === "string")
+        return result;
+      if (typeof result === "number" || typeof result === "boolean" || typeof result === "bigint" || result === null || result === void 0) {
+        return String(result);
+      }
+      try {
+        return JSON.stringify(result);
+      } catch {
+        return String(result);
+      }
+    }
+    function bindCrewAIToolOutcome(outcome, args) {
+      const serialize = args.serialize ?? defaultSerializeCrewAIToolResult;
+      let body;
+      let resultAsAnswer;
+      if (outcome.executed === true) {
+        body = serialize(outcome.result);
+        resultAsAnswer = false;
+      } else if (outcome.executionAttempted === false) {
+        body = (0, gate_refusal_js_1.formatGateRefusalBody)(outcome);
+        resultAsAnswer = true;
+      } else {
+        const err = "error" in outcome ? outcome.error : void 0;
+        const kind = (0, gate_refusal_js_1.verdictKind)(outcome);
+        body = `Tool execution failed after gate decision (verdict: ${kind}): ${(0, gate_refusal_js_1.formatGuardError)(err)}`;
+        resultAsAnswer = true;
+      }
+      const result = args.attachProof === false ? body : (0, final_answer_proof_js_1.attachProofToAgentResponse)(body, outcome.proof);
+      const out = {
+        result,
+        result_as_answer: resultAsAnswer,
+        tool_name: args.tool_name,
+        final_answer_proof: outcome.proof
+      };
+      return out;
+    }
+  }
+});
+
 // node_modules/@coderifts/agent-guard/dist/cjs/adapters/vercel.js
 var require_vercel = __commonJS({
   "node_modules/@coderifts/agent-guard/dist/cjs/adapters/vercel.js"(exports2) {
@@ -76221,9 +76393,9 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.monitorAttestSigningInput = exports2.kidFromMonitoringAttestation = exports2.tryIssueMonitoringAttestation = exports2.DEFAULT_MONITORING_SINK_TIMEOUT_MS = exports2.ackBytes = exports2.verifyAckHmac = exports2.monitoringDeliveryFailClosed = exports2.formatMonitoringDeliveryLine = exports2.deliverMonitoring = exports2.hashObservedContent = exports2.observeCommit = exports2.deriveKeySignal = exports2.pathClass = exports2.classifyCommand = exports2.projectState = exports2.emptySessionState = exports2.computeTainted = exports2.evaluate = exports2.updateSession = exports2.SESSION_TAINT_VERSION = exports2.SessionTaintTracker = exports2.readDecision = exports2.EXECUTION_TIME_FP_REASONS = exports2.EXECUTION_STATE_UNMEASURABLE_NOTE = exports2.isUnmeasurableExecutionStateReason = exports2.computeCanonicalBundleFingerprint = exports2.authorizedFingerprintFromEnvelope = exports2.checkExecutionTimeFingerprint = exports2.computeBundleFingerprint = exports2.computeArtifactDigest = exports2.evaluateEnvelope = exports2.RECEIPT_PREV_NULL = exports2.decodeReceiptBodyPrev = exports2.previousReceiptCommitment = exports2.verifyReceiptChainLinkage = exports2.canonicalJson = exports2.computeBodyHash = exports2.bindReceiptToEnvelope = exports2.DETECTOR_VERSION = exports2.builtinDetector = exports2.resetPolicyWarnForTests = exports2.warnPolicyAbsentOnce = exports2.observePolicyPresence = exports2.detectPolicyPresence = exports2.policyPresenceOf = exports2.withPolicy = exports2.POLICY_ABSENT_WARN = exports2.POLICY_MARKER = exports2.CODERIFTS_POLICY = exports2.guardToolCall = void 0;
     exports2.createDbVersionToken = exports2.API_ABSENT_TOKEN = exports2.API_VERSION_TOKEN_PREFIX = exports2.apiTokenRaw = exports2.writeApiIfUnchanged = exports2.createApiVersionToken = exports2.identitiesEqual = exports2.fsObjectIdentity = exports2.UnsafeCasPathError = exports2.assertSafeCasPath = exports2.FS_ABSENT_TOKEN = exports2.FS_VERSION_TOKEN_PREFIX = exports2.fsTokenContentHash = exports2.createFsPriorContentResolver = exports2.writeFileIfUnchanged = exports2.readVersionedFile = exports2.createFsVersionToken = exports2.StaleVersionTokenAbort = exports2.executeIfUnchanged = exports2.RESIDUAL_UNCONDITIONAL_WRITE = exports2.conditionalWriteResidual = exports2.tokensEqual = exports2.buildConditionalWriteBasis = exports2.buildFreshnessBasis = exports2.collectFreshnessCallContext = exports2.artifactIdsForResolve = exports2.isMutatingCall = exports2.isWriteStyleCall = exports2.freshnessAllowsEnforce = exports2.computePathSetTreeHash = exports2.contentByteIdentical = exports2.assessWriteStylePrior = exports2.assessFreshness = exports2.deriveProofBanner = exports2.attachProofToAgentResponse = exports2.renderFinalAnswerProof = exports2.EXECUTION_PROOF_SPEC = exports2.assertEnforcedReceiptInvariant = exports2.hashExecutionResult = exports2.buildExecutionProof = exports2.COVERAGE_ATTEST_ENVELOPE_TAG = exports2.COVERAGE_ATTEST_SIGNING_PREFIX = exports2.COVERAGE_ATTEST_VERSION = exports2.coverageAttestSigningInput = exports2.kidFromCoverageAttestation = exports2.tryIssueCoverageAttestation = exports2.MONITOR_ATTEST_ENVELOPE_TAG = exports2.MONITOR_ATTEST_SIGNING_PREFIX = exports2.MONITOR_ATTEST_VERSION = exports2.receiptDigestOfToken = void 0;
-    exports2.guardedFractionAmongRoutes = exports2.foldTableSettledCalls = exports2.withCodeRifts = exports2.AUTO_DERIVE_READ_TIMEOUT_MS = exports2.AUTO_DERIVE_SOURCE = exports2.defaultFsReader = exports2.normalizeAutoDerive = exports2.runAutoDerive = exports2.AUTO_RECHECK_MAX_CAP = exports2.clampMaxAttempts = exports2.normalizeAutoRecheck = exports2.runAutoRecheckLoop = exports2.coverageReport = exports2.DEPLOY_REPAIRABLE_REASONS = exports2.bindDeploy = exports2.verifyDeployReceiptToken = exports2.DEPLOY_RECEIPT_VIEW_SPEC = exports2.isVerifiedDeployReceiptView = exports2.asVerifiedDeployReceiptView = exports2.deployGate = exports2.gateDecision = exports2.RegistryConstructionError = exports2.guardToolRegistry = exports2.globToRegExp = exports2.matchGlob = exports2.blobMapKey = exports2.classifyByName = exports2.resolveArtifacts = exports2.REMEDIATION_LOOP_ATTESTATION_SPEC = exports2.isCasAttestation = exports2.readPriorBlockRemediation = exports2.readRemediationTransaction = exports2.buildRemediationLoopAttestation = exports2.COMMIT_EVIDENCE_MISSING = exports2.CAS_ATTESTATION_SPEC = exports2.strictCommitObservation = exports2.extractExecutorAttestationToken = exports2.evaluateCasEvidence = exports2.isExecuteIfUnchangedOutcome = exports2.isGuardExecutionProof = exports2.buildCasAttestation = exports2.REGISTRY_ABSENT_TOKEN = exports2.REGISTRY_VERSION_TOKEN_PREFIX = exports2.registryTokenRaw = exports2.writeRegistryIfUnchanged = exports2.createRegistryVersionToken = exports2.DB_ABSENT_TOKEN = exports2.DB_VERSION_TOKEN_PREFIX = exports2.dbTokenRaw = exports2.writeDbIfUnchanged = void 0;
-    exports2.withCodeRiftsGemini = exports2.measureFsAuthorizationToken = exports2.measureFsAuthorization = exports2.wrapWriteWithFsCas = exports2.inferFullFileWriteContent = exports2.inferFsPathFromArgs = exports2.FRESHNESS_RESOLVER_FIX = exports2.freshnessRefusalTeaching = exports2.formatGateRefusalBody = exports2.defaultSerializeLangGraphToolResult = exports2.bindLangGraphGuardOutcome = exports2.LangGraphToolsNotStructuredError = exports2.isLangGraphReactAgentTool = exports2.bindLangGraphTools = exports2.protectedToolToLangGraph = exports2.toLangGraphTools = exports2.langGraphToolAdapter = exports2.withCodeRiftsLangGraph = exports2.defaultSerializeAnthropicToolResult = exports2.bindAnthropicGuardOutcome = exports2.protectedToolToAnthropic = exports2.toAnthropicTools = exports2.anthropicToolAdapter = exports2.withCodeRiftsAnthropic = exports2.defaultSerializeOpenAIToolResult = exports2.bindOpenAIGuardOutcome = exports2.protectedToolToOpenAI = exports2.toOpenAITools = exports2.openAIToolAdapter = exports2.withCodeRiftsOpenAI = exports2.formatCoverageObservedLine = exports2.freezeCoverageObserved = exports2.createCoverageObserver = exports2.readExecutionGrantToken = exports2.isExecutionGrantEnabled = exports2.POSTURE_CLOCK_SKEW_TOLERANCE_MS = exports2.POSTURE_RECEIPT_V = exports2.verifyPostureReceipt = exports2.ATOMIC_V2_MAX_AGE_MS_CAP = exports2.CREDENTIAL_BOUNDARY_BARE_REJECTED = exports2.atomicConstructionProblems = exports2.isEnforcingAtomicV2 = exports2.PROFILE_ENFORCING_ATOMIC_V2 = exports2.isEnforcingAtomic = exports2.atomicOutcome = exports2.ATOMIC_PROFILE_UNSATISFIED = exports2.ATOMIC_INVARIANTS = exports2.createMutatorRegister = exports2.PROFILE_ENFORCING_ATOMIC_V1 = exports2.PROFILE_ENFORCING_STRICT_V1 = void 0;
-    exports2.kidFromToolsetAttestation = exports2.tryIssueToolsetAttestation = exports2.toolsetAttestSigningInput = exports2.declarationEntriesFromTools = exports2.computeToolsetDigest = exports2.TOOLSET_ATTEST_STATEMENT = exports2.TOOLSET_ATTEST_ENVELOPE_TAG = exports2.TOOLSET_ATTEST_SIGNING_PREFIX = exports2.TOOLSET_ATTEST_VERSION = exports2.surfaceEnvelopeFields = exports2.isGuardOutcome = exports2.executeVercelToolCall = exports2.executeLangGraphToolCall = exports2.executeGeminiToolCall = exports2.executeAnthropicToolCall = exports2.executeOpenAIToolCall = exports2.executeProtectedTool = exports2.defaultSerializeVercelToolResult = exports2.bindVercelGuardOutcome = exports2.protectedToolToVercel = exports2.toVercelTools = exports2.vercelToolAdapter = exports2.withCodeRiftsVercel = exports2.defaultSerializeGeminiToolResult = exports2.bindGeminiGuardOutcome = exports2.protectedToolToFunctionDeclaration = exports2.toGeminiTools = exports2.geminiToolAdapter = void 0;
+    exports2.AUTO_DERIVE_READ_TIMEOUT_MS = exports2.AUTO_DERIVE_SOURCE = exports2.defaultFsReader = exports2.normalizeAutoDerive = exports2.runAutoDerive = exports2.AUTO_RECHECK_MAX_CAP = exports2.clampMaxAttempts = exports2.normalizeAutoRecheck = exports2.runAutoRecheckLoop = exports2.coverageReport = exports2.DEPLOY_REPAIRABLE_REASONS = exports2.bindDeploy = exports2.NEXT_STEP_NOTE = exports2.NEXT_AGENT_ACTIONS = exports2.readNextAgentStep = exports2.verifyDeployReceiptToken = exports2.DEPLOY_RECEIPT_VIEW_SPEC = exports2.isVerifiedDeployReceiptView = exports2.asVerifiedDeployReceiptView = exports2.deployGate = exports2.gateDecision = exports2.RegistryConstructionError = exports2.guardToolRegistry = exports2.globToRegExp = exports2.matchGlob = exports2.blobMapKey = exports2.classifyByName = exports2.resolveArtifacts = exports2.REMEDIATION_LOOP_ATTESTATION_SPEC = exports2.isCasAttestation = exports2.readPriorBlockRemediation = exports2.readRemediationTransaction = exports2.buildRemediationLoopAttestation = exports2.COMMIT_EVIDENCE_MISSING = exports2.CAS_ATTESTATION_SPEC = exports2.strictCommitObservation = exports2.extractExecutorAttestationToken = exports2.evaluateCasEvidence = exports2.isExecuteIfUnchangedOutcome = exports2.isGuardExecutionProof = exports2.buildCasAttestation = exports2.REGISTRY_ABSENT_TOKEN = exports2.REGISTRY_VERSION_TOKEN_PREFIX = exports2.registryTokenRaw = exports2.writeRegistryIfUnchanged = exports2.createRegistryVersionToken = exports2.DB_ABSENT_TOKEN = exports2.DB_VERSION_TOKEN_PREFIX = exports2.dbTokenRaw = exports2.writeDbIfUnchanged = void 0;
+    exports2.inferFsPathFromArgs = exports2.FRESHNESS_RESOLVER_FIX = exports2.freshnessRefusalTeaching = exports2.formatGateRefusalBody = exports2.defaultSerializeLangGraphToolResult = exports2.bindLangGraphGuardOutcome = exports2.LangGraphToolsNotStructuredError = exports2.isLangGraphReactAgentTool = exports2.bindLangGraphTools = exports2.protectedToolToLangGraph = exports2.toLangGraphTools = exports2.langGraphToolAdapter = exports2.withCodeRiftsLangGraph = exports2.defaultSerializeAnthropicToolResult = exports2.bindAnthropicGuardOutcome = exports2.protectedToolToAnthropic = exports2.toAnthropicTools = exports2.anthropicToolAdapter = exports2.withCodeRiftsAnthropic = exports2.defaultSerializeOpenAIToolResult = exports2.bindOpenAIGuardOutcome = exports2.protectedToolToOpenAI = exports2.toOpenAITools = exports2.openAIToolAdapter = exports2.withCodeRiftsOpenAI = exports2.formatCoverageObservedLine = exports2.freezeCoverageObserved = exports2.createCoverageObserver = exports2.readExecutionGrantToken = exports2.isExecutionGrantEnabled = exports2.POSTURE_CLOCK_SKEW_TOLERANCE_MS = exports2.POSTURE_RECEIPT_V = exports2.verifyPostureReceipt = exports2.ATOMIC_V2_MAX_AGE_MS_CAP = exports2.CREDENTIAL_BOUNDARY_BARE_REJECTED = exports2.atomicConstructionProblems = exports2.isEnforcingAtomicV2 = exports2.PROFILE_ENFORCING_ATOMIC_V2 = exports2.isEnforcingAtomic = exports2.atomicOutcome = exports2.ATOMIC_PROFILE_UNSATISFIED = exports2.ATOMIC_INVARIANTS = exports2.createMutatorRegister = exports2._resetUnversionedProfileNoticeForTest = exports2.UNVERSIONED_PROFILE_NOTICE = exports2.PROFILE_ENFORCING_ATOMIC_V1 = exports2.PROFILE_ENFORCING_STRICT_V1 = exports2.guardedFractionAmongRoutes = exports2.foldTableSettledCalls = exports2.withCodeRifts = void 0;
+    exports2.kidFromToolsetAttestation = exports2.tryIssueToolsetAttestation = exports2.toolsetAttestSigningInput = exports2.declarationEntriesFromTools = exports2.computeToolsetDigest = exports2.TOOLSET_ATTEST_STATEMENT = exports2.TOOLSET_ATTEST_ENVELOPE_TAG = exports2.TOOLSET_ATTEST_SIGNING_PREFIX = exports2.TOOLSET_ATTEST_VERSION = exports2.surfaceEnvelopeFields = exports2.isGuardOutcome = exports2.executeVercelToolCall = exports2.executeLangGraphToolCall = exports2.executeGeminiToolCall = exports2.executeAnthropicToolCall = exports2.executeOpenAIToolCall = exports2.executeProtectedTool = exports2.defaultSerializeVercelToolResult = exports2.bindVercelGuardOutcome = exports2.protectedToolToVercel = exports2.toVercelTools = exports2.vercelToolAdapter = exports2.withCodeRiftsVercel = exports2.defaultSerializeCrewAIToolResult = exports2.bindCrewAIToolOutcome = exports2.LANGCHAIN_ARTIFACT_SPEC = exports2.defaultSerializeLangChainToolResult = exports2.bindLangChainToolOutcome = exports2.defaultSerializeGeminiToolResult = exports2.bindGeminiGuardOutcome = exports2.protectedToolToFunctionDeclaration = exports2.toGeminiTools = exports2.geminiToolAdapter = exports2.withCodeRiftsGemini = exports2.measureFsAuthorizationToken = exports2.measureFsAuthorization = exports2.wrapWriteWithFsCas = exports2.inferFullFileWriteContent = void 0;
     var guard_js_1 = require_guard();
     Object.defineProperty(exports2, "guardToolCall", { enumerable: true, get: function() {
       return guard_js_1.guardToolCall;
@@ -76658,6 +76830,16 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "verifyDeployReceiptToken", { enumerable: true, get: function() {
       return deploy_receipt_token_js_1.verifyDeployReceiptToken;
     } });
+    var next_agent_step_js_1 = require_next_agent_step();
+    Object.defineProperty(exports2, "readNextAgentStep", { enumerable: true, get: function() {
+      return next_agent_step_js_1.readNextAgentStep;
+    } });
+    Object.defineProperty(exports2, "NEXT_AGENT_ACTIONS", { enumerable: true, get: function() {
+      return next_agent_step_js_1.NEXT_AGENT_ACTIONS;
+    } });
+    Object.defineProperty(exports2, "NEXT_STEP_NOTE", { enumerable: true, get: function() {
+      return next_agent_step_js_1.NEXT_STEP_NOTE;
+    } });
     var deploy_bind_js_1 = require_deploy_bind();
     Object.defineProperty(exports2, "bindDeploy", { enumerable: true, get: function() {
       return deploy_bind_js_1.bindDeploy;
@@ -76714,6 +76896,12 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "PROFILE_ENFORCING_ATOMIC_V1", { enumerable: true, get: function() {
       return with_coderifts_js_1.PROFILE_ENFORCING_ATOMIC_V1;
     } });
+    Object.defineProperty(exports2, "UNVERSIONED_PROFILE_NOTICE", { enumerable: true, get: function() {
+      return with_coderifts_js_1.UNVERSIONED_PROFILE_NOTICE;
+    } });
+    Object.defineProperty(exports2, "_resetUnversionedProfileNoticeForTest", { enumerable: true, get: function() {
+      return with_coderifts_js_1._resetUnversionedProfileNoticeForTest;
+    } });
     var atomic_profile_js_1 = require_atomic_profile();
     Object.defineProperty(exports2, "createMutatorRegister", { enumerable: true, get: function() {
       return atomic_profile_js_1.createMutatorRegister;
@@ -76883,6 +77071,23 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "defaultSerializeGeminiToolResult", { enumerable: true, get: function() {
       return gemini_js_1.defaultSerializeGeminiToolResult;
     } });
+    var langchain_js_1 = require_langchain();
+    Object.defineProperty(exports2, "bindLangChainToolOutcome", { enumerable: true, get: function() {
+      return langchain_js_1.bindLangChainToolOutcome;
+    } });
+    Object.defineProperty(exports2, "defaultSerializeLangChainToolResult", { enumerable: true, get: function() {
+      return langchain_js_1.defaultSerializeLangChainToolResult;
+    } });
+    Object.defineProperty(exports2, "LANGCHAIN_ARTIFACT_SPEC", { enumerable: true, get: function() {
+      return langchain_js_1.LANGCHAIN_ARTIFACT_SPEC;
+    } });
+    var crewai_js_1 = require_crewai();
+    Object.defineProperty(exports2, "bindCrewAIToolOutcome", { enumerable: true, get: function() {
+      return crewai_js_1.bindCrewAIToolOutcome;
+    } });
+    Object.defineProperty(exports2, "defaultSerializeCrewAIToolResult", { enumerable: true, get: function() {
+      return crewai_js_1.defaultSerializeCrewAIToolResult;
+    } });
     var vercel_js_1 = require_vercel();
     Object.defineProperty(exports2, "withCodeRiftsVercel", { enumerable: true, get: function() {
       return vercel_js_1.withCodeRiftsVercel;
@@ -180784,6 +180989,32 @@ var require_comment_renderer = __commonJS({
       lines.push("");
       return lines.join("\n");
     }
+    var BREAKING_HIGHLIGHTS_TOP_N = 5;
+    function renderBreakingHighlights(results, topN = BREAKING_HIGHLIGHTS_TOP_N) {
+      if (!Array.isArray(results) || results.length === 0) return "";
+      const rows = [];
+      for (const r of results) {
+        const file = r && typeof r.schemaPath === "string" ? r.schemaPath : "";
+        for (const d of r && Array.isArray(r.breaking) ? r.breaking : []) {
+          const raw = extractRawLocation(d);
+          const pointer = raw && raw !== "N/A" ? raw : "";
+          if (!file && !pointer) continue;
+          rows.push({ file, pointer, code: d && d.code ? String(d.code) : "" });
+        }
+      }
+      if (rows.length === 0) return "";
+      const shown = rows.slice(0, topN);
+      const lines = ["## \u{1F3AF} Breaking elements\n"];
+      for (const row of shown) {
+        const where = row.file && row.pointer ? `\`${escapeMd(row.file)}\` \xB7 \`${escapeMd(row.pointer)}\`` : `\`${escapeMd(row.file || row.pointer)}\``;
+        lines.push(`- ${where}${row.code ? ` \u2014 \`${escapeMd(row.code)}\`` : ""}`);
+      }
+      if (rows.length > shown.length) {
+        lines.push(`- \u2026and ${rows.length - shown.length} more \u2014 see **Raw diff details** below.`);
+      }
+      lines.push("");
+      return lines.join("\n");
+    }
     function renderAgentImpactHeadline(options) {
       const n = (options.omegaAgentPatterns || []).length;
       if (n === 0) return "";
@@ -181033,6 +181264,10 @@ var require_comment_renderer = __commonJS({
         const changeList = renderCanonicalChangeList(options.detectedPatterns || []);
         if (changeList) lines.push(changeList);
       }
+      {
+        const highlights = renderBreakingHighlights(results);
+        if (highlights) lines.push(highlights);
+      }
       {
         const agentLine = renderAgentImpactHeadline(options);
         if (agentLine) lines.push(agentLine);
@@ -181515,6 +181750,8 @@ ${body}` : poison;
       renderBlockReason,
       renderUnblockActions,
       renderCanonicalChangeList,
+      renderBreakingHighlights,
+      BREAKING_HIGHLIGHTS_TOP_N,
       renderAgentImpactHeadline,
       renderEconomicHeadline,
       renderPoisonGateSection,
@@ -203274,6 +203511,83 @@ var require_remediation_taxonomy = __commonJS({
   }
 });
 
+// ../../src/next-agent-step.js
+var require_next_agent_step2 = __commonJS({
+  "../../src/next-agent-step.js"(exports2, module2) {
+    "use strict";
+    var NEXT_AGENT_ACTIONS = Object.freeze([
+      "re_preflight",
+      "revert",
+      "migrate",
+      "escalate",
+      "await_approval"
+    ]);
+    var NEXT_AGENT_ACTION_SET = new Set(NEXT_AGENT_ACTIONS);
+    function mapChoiceIdToNextAction(id) {
+      const s = String(id == null ? "" : id);
+      if (s === "re_preflight" || s === "re_preflight_deploy") return "re_preflight";
+      if (s === "fix_input") return "re_preflight";
+      if (s === "revert") return "revert";
+      if (s === "migrate") return "migrate";
+      if (s === "escalate") return "escalate";
+      if (s === "obtain_human_approval") return "await_approval";
+      return null;
+    }
+    function projectNextAgentStep(executionAction, requiredAction) {
+      const ea = executionAction != null ? String(executionAction) : "";
+      if (ea === "CONTINUE" || ea === "CONTINUE_WITH_MONITORING") return null;
+      if (ea !== "STOP" && ea !== "REQUEST_APPROVAL") return null;
+      const raObj = requiredAction && typeof requiredAction === "object" ? requiredAction : null;
+      const raStr = typeof requiredAction === "string" ? requiredAction : null;
+      const reason = raObj && raObj.reason_code != null && String(raObj.reason_code) || raObj && raObj.type != null && String(raObj.type) || raStr && raStr.slice(0, 200) || (ea === "REQUEST_APPROVAL" ? "request_approval" : "remediate_or_revert");
+      const resume_condition = raObj && typeof raObj.resume_condition === "string" ? raObj.resume_condition : raStr || "";
+      let action = null;
+      if (ea === "REQUEST_APPROVAL") {
+        action = "await_approval";
+      } else {
+        const choices = raObj && Array.isArray(raObj.choices) ? raObj.choices : [];
+        for (const c of choices) {
+          const id = typeof c === "string" ? c : c && c.id != null ? c.id : null;
+          const mapped = mapChoiceIdToNextAction(id);
+          if (mapped && NEXT_AGENT_ACTION_SET.has(mapped) && mapped !== "await_approval") {
+            action = mapped;
+            break;
+          }
+        }
+        if (!action) {
+          const t = raObj && raObj.type != null ? String(raObj.type) : "";
+          if (t === "re_preflight" || t === "remediate_or_revert" || t === "fix_coverage" || t === "revert") {
+            action = t === "revert" ? "revert" : "re_preflight";
+          } else if (raStr || ea === "STOP") {
+            action = "re_preflight";
+          }
+        }
+      }
+      if (!action || !NEXT_AGENT_ACTION_SET.has(action)) return null;
+      let then_call = null;
+      if (action === "re_preflight" || action === "revert" || action === "migrate") {
+        then_call = "preflight_change_set";
+      } else if (action === "await_approval") {
+        then_call = null;
+      } else if (action === "escalate") {
+        then_call = null;
+      }
+      return {
+        action,
+        reason: String(reason),
+        resume_condition: String(resume_condition),
+        then_call
+      };
+    }
+    module2.exports = {
+      NEXT_AGENT_ACTIONS,
+      NEXT_AGENT_ACTION_SET,
+      mapChoiceIdToNextAction,
+      projectNextAgentStep
+    };
+  }
+});
+
 // ../../src/response-envelope.js
 var require_response_envelope = __commonJS({
   "../../src/response-envelope.js"(exports2, module2) {
@@ -203517,70 +203831,10 @@ var require_response_envelope = __commonJS({
     function buildEnforcementDescriptor() {
       return { ...ENFORCEMENT_DESCRIPTOR };
     }
-    var NEXT_AGENT_ACTIONS = Object.freeze([
-      "re_preflight",
-      "revert",
-      "migrate",
-      "escalate",
-      "await_approval"
-    ]);
-    var NEXT_AGENT_ACTION_SET = new Set(NEXT_AGENT_ACTIONS);
-    function mapChoiceIdToNextAction(id) {
-      const s = String(id == null ? "" : id);
-      if (s === "re_preflight" || s === "re_preflight_deploy") return "re_preflight";
-      if (s === "fix_input") return "re_preflight";
-      if (s === "revert") return "revert";
-      if (s === "migrate") return "migrate";
-      if (s === "escalate") return "escalate";
-      if (s === "obtain_human_approval") return "await_approval";
-      return null;
-    }
-    function projectNextAgentStep(executionAction, requiredAction) {
-      const ea = executionAction != null ? String(executionAction) : "";
-      if (ea === "CONTINUE" || ea === "CONTINUE_WITH_MONITORING") return null;
-      if (ea !== "STOP" && ea !== "REQUEST_APPROVAL") return null;
-      const raObj = requiredAction && typeof requiredAction === "object" ? requiredAction : null;
-      const raStr = typeof requiredAction === "string" ? requiredAction : null;
-      const reason = raObj && raObj.reason_code != null && String(raObj.reason_code) || raObj && raObj.type != null && String(raObj.type) || raStr && raStr.slice(0, 200) || (ea === "REQUEST_APPROVAL" ? "request_approval" : "remediate_or_revert");
-      const resume_condition = raObj && typeof raObj.resume_condition === "string" ? raObj.resume_condition : raStr || "";
-      let action = null;
-      if (ea === "REQUEST_APPROVAL") {
-        action = "await_approval";
-      } else {
-        const choices = raObj && Array.isArray(raObj.choices) ? raObj.choices : [];
-        for (const c of choices) {
-          const id = typeof c === "string" ? c : c && c.id != null ? c.id : null;
-          const mapped = mapChoiceIdToNextAction(id);
-          if (mapped && NEXT_AGENT_ACTION_SET.has(mapped) && mapped !== "await_approval") {
-            action = mapped;
-            break;
-          }
-        }
-        if (!action) {
-          const t = raObj && raObj.type != null ? String(raObj.type) : "";
-          if (t === "re_preflight" || t === "remediate_or_revert" || t === "fix_coverage" || t === "revert") {
-            action = t === "revert" ? "revert" : "re_preflight";
-          } else if (raStr || ea === "STOP") {
-            action = "re_preflight";
-          }
-        }
-      }
-      if (!action || !NEXT_AGENT_ACTION_SET.has(action)) return null;
-      let then_call = null;
-      if (action === "re_preflight" || action === "revert" || action === "migrate") {
-        then_call = "preflight_change_set";
-      } else if (action === "await_approval") {
-        then_call = null;
-      } else if (action === "escalate") {
-        then_call = null;
-      }
-      return {
-        action,
-        reason: String(reason),
-        resume_condition: String(resume_condition),
-        then_call
-      };
-    }
+    var {
+      NEXT_AGENT_ACTIONS,
+      projectNextAgentStep
+    } = require_next_agent_step2();
     function buildControlEnvelope(verdict, authzContext) {
       const receipt_view = projectReceipt(verdict, authzContext);
       let safeForAgent = verdict.safe_for_agent;
@@ -205272,6 +205526,48 @@ var require_decision_result_v1_producer = __commonJS({
             }
           }
         },
+        next_agent_step: {
+          type: [
+            "object",
+            "null"
+          ],
+          additionalProperties: false,
+          required: [
+            "action",
+            "reason",
+            "resume_condition",
+            "then_call"
+          ],
+          description: "Additive (I-1288). The decision's own remediation SUGGESTION, projected at issuance from execution_action + required_action_core \u2014 the identical pure function that fills control_envelope.next_agent_step (src/next-agent-step.js). One projection, two placements, never two rules. INSIDE the envelope it is covered by decision_body_hash, so the signed receipt covers the suggestion along with the decision that produced it: a consumer handed only the envelope (k8s-admission, gateway-verifier, agent-guard deployGate) can render the next step without a second call to the issuer, and a tampered step no longer verifies. NOT PERMISSION and NOT a control-flow override \u2014 branch on execution_action. null on the allow class (CONTINUE / CONTINUE_WITH_MONITORING) is the correct value, not a missing measurement; null also on legacy non-additive envelopes, which never carry the field.",
+          properties: {
+            action: {
+              type: "string",
+              enum: [
+                "re_preflight",
+                "revert",
+                "migrate",
+                "escalate",
+                "await_approval"
+              ],
+              description: "Closed set \u2014 src/next-agent-step.js NEXT_AGENT_ACTIONS."
+            },
+            reason: {
+              type: "string",
+              description: "required_action reason_code / type, or the display string when that is all the issuance path had."
+            },
+            resume_condition: {
+              type: "string",
+              description: "What must hold before the caller retries. Projected from the FROZEN required_action_core, which carries no receipt-authz overlay, so this is the one subfield that may be thinner than control_envelope.next_agent_step.resume_condition (the live surface projects from deriveRequiredAction, which has the overlay and can name the approval receipt it wants). Signing the overlay text would sign a fact the envelope deliberately excludes. Empty string when the frozen core supplied none \u2014 not an error."
+            },
+            then_call: {
+              type: [
+                "string",
+                "null"
+              ],
+              description: "Tool to call after the step, or null when the next move is a human one."
+            }
+          }
+        },
         remediation_transaction: {
           type: [
             "object",
@@ -205966,6 +206262,174 @@ var require_decision_result_validator = __commonJS({
   }
 });
 
+// ../../schemas/execution-grant-request.v2.producer.json
+var require_execution_grant_request_v2_producer = __commonJS({
+  "../../schemas/execution-grant-request.v2.producer.json"(exports2, module2) {
+    module2.exports = {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      $id: "https://coderifts.com/schemas/execution-grant-request.v2.producer.json",
+      title: "CodeRifts Execution Grant Request v2 \u2014 PRODUCER schema",
+      description: "Execution-grant REQUEST v2 \u2014 the fields the authorize handler actually reads when minting a cr.exec.v2 grant. Measured from src/change-set.js:1209-1285 (the wantGrant/wantV2 block) plus the operation / audience / environment reads that same handler already performs, and pinned field-by-field by test/fixtures/v2-grant-field-matrix.json. PRODUCER-ONLY, DELIBERATELY. The pairing convention in schemas/ is not universal: decision-result.v1 and preflight-response.v2 have consumer twins because a GENERATOR derives one from the other (scripts/generate-consumer-schema.js), while control-envelope.v1 and verify-receipt.v1 are producer-only. No generator derives a request consumer, and the only thing a consumer twin would say differently is `additionalProperties`, which is stated here directly. A second hand-maintained file whose sole difference is one keyword is a drift risk, not a contract. ROLES ARE INVERTED relative to the response schemas: on a REQUEST the CLIENT is the producer and the SERVER is the consumer. `additionalProperties` is therefore TRUE, and that is a measurement of current behaviour, not an aspiration \u2014 the handler reads named fields off `input` and ignores everything else, so a client sending an extra key is accepted today. Validation is advisory by default (EXECUTION_GRANT_REQUEST_VALIDATOR_MODE=log); nothing in this schema starts rejecting a request that works now. NOT REQUEST FIELDS \u2014 MINTED BY THE ISSUER, and excluded on purpose: `jti`, `expires_at` / `expiry`, `after_payload_digest` (plus `kid`, `grant_id`, `receipt_hash`, `nonce_hash`, `not_before`, `max_attempts`). src/verdict-core/execution-grant-v2.js:110-154 derives every one of them from the signed receipt and the change set. A caller cannot supply them and the handler would not read them; listing them here would describe a request surface that does not exist. BOUND SINCE 1206 VARIANT A \u2014 `policy_hash` and `audience_hash`: both are now carried into the signed grant. `policy_hash` is forwarded by the authorize handler (src/change-set.js:1323) into the issuer, which binds it at src/verdict-core/execution-grant-v2.js:149; a verifier that states `intended.policy_hash` gets a GRANT_UNBOUND/policy_mismatch on a mismatch. `audience_hash` is NOT a request field of its own: it is derived from `audience` (execution-grant-v2.js:150) and was already enforced (:227-234), so sending it separately has no effect and it stays out of this schema. Before this change policy_hash was accepted on the wire and dropped at the handler, which minted every grant under the sha256('') default \u2014 a field that looked bound and was not.",
+      type: "object",
+      additionalProperties: true,
+      required: [
+        "include_execution_grant"
+      ],
+      properties: {
+        include_execution_grant: {
+          type: "boolean",
+          description: 'Gates the whole grant path. src/change-set.js:1209 \u2014 strictly `=== true`, so any other value (including the string "true") mints no grant.'
+        },
+        grant_version: {
+          type: "string",
+          enum: [
+            "v1",
+            "v2"
+          ],
+          description: "src/change-set.js:1268 \u2014 `v2` selects the cr.exec.v2 issuer. Absent or any other value takes the v1 branch. `grantVersion` (camelCase) is accepted as an alias at the same line; both are listed so neither reads as undeclared."
+        },
+        grantVersion: {
+          type: "string",
+          enum: [
+            "v1",
+            "v2"
+          ],
+          description: "camelCase alias of grant_version, read at src/change-set.js:1268. Declared because the handler reads it, not because it is recommended."
+        },
+        tenant_id: {
+          type: "string",
+          minLength: 1,
+          description: "src/change-set.js:1279 \u2014 `input.tenant_id || context.tenant_id || 'default'`. The default is a real value, not an absence: an unset tenant is issued as `default`, it is not left unbound."
+        },
+        executor_id: {
+          type: "string",
+          minLength: 1,
+          description: "src/change-set.js:1277 \u2014 `input.executor_id || context.executor_id || 'local'`."
+        },
+        adapter_id: {
+          type: "string",
+          minLength: 1,
+          description: "src/change-set.js:1278 \u2014 `input.adapter_id || context.adapter_id || 'fs'`."
+        },
+        target_uri: {
+          type: "string",
+          minLength: 1,
+          description: "src/change-set.js:1276 \u2014 `input.target_uri || context.target_uri`, else a derived `git://{context.repository||'local/repo'}@{context.head_sha||'unknown'}`. The derived form is a fallback, not a binding the caller asked for."
+        },
+        state_nonce: {
+          type: "string",
+          minLength: 1,
+          description: "src/change-set.js:1265-1267 \u2014 non-empty string only; anything else becomes null and the grant is issued without a nonce."
+        },
+        expected_state_token: {
+          type: "string",
+          description: "src/change-set.js:1281 \u2014 `nonEmptyStr(input.expected_state_token) || ''`. Empty string is the issued value when absent; there is no unbound state."
+        },
+        audience: {
+          type: "string",
+          pattern: "^v:[0-9a-f]{12}$",
+          description: "src/change-set.js:1120-1124 \u2014 ONLY the measured `v:<12 hex>` form is accepted; any other string is discarded to null rather than trusted as identity. A free-form caller-supplied name is never an audience."
+        },
+        policy_hash: {
+          type: "string",
+          minLength: 1,
+          description: "src/change-set.js:1305 \u2014 the policy identity this request is made under, bound into the signed grant (execution-grant-v2.js:149). A value already prefixed `sha256:` is carried through; anything else is hashed. Absent \u2192 the issuer's sha256('') default, which is what every grant carried before 1206 variant A. Enforced only by a verifier that states intended.policy_hash \u2014 binding is not by itself a check."
+        },
+        context: {
+          type: "object",
+          additionalProperties: true,
+          description: "The request context object (src/change-set.js:806). Only the keys the grant path reads are declared; the handler reads many others for unrelated purposes and tolerates the rest, so additionalProperties stays true here for the same reason it does at the root.",
+          properties: {
+            operation: {
+              type: "string",
+              minLength: 1,
+              description: "src/change-set.js:807-812 \u2014 REQUIRED for preflight_mode=authorize; the handler throws a typed input error without one. Authorization asks permission for a named operation."
+            },
+            environment: {
+              type: "string",
+              description: "src/change-set.js:1159 \u2014 carried onto the envelope. Not a grant field; read by the same handler on the same request."
+            },
+            target_id: {
+              type: "string",
+              description: "src/change-set.js:1264 \u2014 v1 grant target fallback; the v2 branch uses target_uri instead."
+            },
+            target_uri: {
+              type: "string",
+              description: "src/change-set.js:1276 \u2014 fallback when input.target_uri is absent."
+            },
+            executor_id: {
+              type: "string",
+              description: "src/change-set.js:1277 \u2014 fallback when input.executor_id is absent."
+            },
+            adapter_id: {
+              type: "string",
+              description: "src/change-set.js:1278 \u2014 fallback when input.adapter_id is absent."
+            },
+            tenant_id: {
+              type: "string",
+              description: "src/change-set.js:1279 \u2014 fallback when input.tenant_id is absent."
+            },
+            repository: {
+              type: "string",
+              description: "src/change-set.js:1276 \u2014 feeds the DERIVED target_uri when no explicit one was supplied."
+            },
+            head_sha: {
+              type: "string",
+              description: "src/change-set.js:1276 \u2014 feeds the DERIVED target_uri when no explicit one was supplied."
+            }
+          }
+        }
+      },
+      $comment: "Field set pinned by test/fixtures/v2-grant-field-matrix.json (schema column) and test/execution-grant-request-schema.test.js. Adding a property here without adding the matching matrix cell fails the drift gate."
+    };
+  }
+});
+
+// ../../src/execution-grant-request-validator.js
+var require_execution_grant_request_validator = __commonJS({
+  "../../src/execution-grant-request-validator.js"(exports2, module2) {
+    "use strict";
+    var Ajv2020 = require__();
+    var requestSchema = require_execution_grant_request_v2_producer();
+    var ajv = new Ajv2020({ strict: false, allErrors: true });
+    var _validate = ajv.compile(requestSchema);
+    function isV2GrantRequest(input) {
+      if (!input || typeof input !== "object") return false;
+      if (input.include_execution_grant !== true) return false;
+      return input.grant_version === "v2" || input.grantVersion === "v2";
+    }
+    function validateExecutionGrantRequest(input) {
+      const valid = _validate(input);
+      return { valid: !!valid, errors: valid ? [] : _validate.errors || [] };
+    }
+    function validatorMode() {
+      return process.env.EXECUTION_GRANT_REQUEST_VALIDATOR_MODE === "enforce" ? "enforce" : "log";
+    }
+    function guardExecutionGrantRequest(input, { logger } = {}) {
+      if (!isV2GrantRequest(input)) return { ok: true, skipped: true };
+      const { valid, errors } = validateExecutionGrantRequest(input);
+      if (valid) return { ok: true };
+      const error = { code: "GRANT_REQUEST_SCHEMA_VALIDATION_FAILED", errors };
+      if (validatorMode() === "enforce") {
+        return { ok: false, error };
+      }
+      if (logger && typeof logger.warn === "function") {
+        logger.warn(
+          { severity: "MEDIUM", event: "execution_grant_request_schema_violation", errors },
+          "v2 execution-grant request failed producer-schema validation (log mode \u2014 the request proceeds unchanged)"
+        );
+      }
+      return { ok: true };
+    }
+    module2.exports = {
+      validateExecutionGrantRequest,
+      guardExecutionGrantRequest,
+      isV2GrantRequest,
+      validatorMode
+    };
+  }
+});
+
 // ../../src/source-binding-gate.js
 var require_source_binding_gate = __commonJS({
   "../../src/source-binding-gate.js"(exports2, module2) {
@@ -206968,6 +207432,13 @@ var require_execution_grant_v2 = __commonJS({
       if (intended.audience_hash != null && String(intended.audience_hash).length > 0 && payload.audience_hash !== String(intended.audience_hash)) {
         return { valid: false, status: "GRANT_UNBOUND", reason: "audience_mismatch", payload };
       }
+      if (intended.policy_hash != null && String(intended.policy_hash).length > 0) {
+        const wantPolicy = String(intended.policy_hash);
+        const norm = wantPolicy.startsWith("sha256:") ? wantPolicy : sha256pref(wantPolicy);
+        if (payload.policy_hash !== norm) {
+          return { valid: false, status: "GRANT_UNBOUND", reason: "policy_mismatch", payload };
+        }
+      }
       if (intended.after_payload != null) {
         if (payload.after_payload_hash !== sha256pref(intended.after_payload)) {
           return { valid: false, status: "GRANT_UNBOUND", reason: "after_payload_mismatch", payload };
@@ -207404,6 +207875,7 @@ var require_change_set = __commonJS({
     var { buildDecisionResultV1 } = require_decision_result();
     var { deriveRequiredAction } = require_response_envelope();
     var { guardDecisionResult } = require_decision_result_validator();
+    var { guardExecutionGrantRequest } = require_execution_grant_request_validator();
     var { issueReceipt, isConfigured, sha256hex } = require_chain_attestation();
     var { getPatternConfigHash } = require_omega_scoring();
     var { computeBlastRadiusCounts } = require_blast_radius_counts();
@@ -208275,6 +208747,16 @@ var require_change_set = __commonJS({
       }
       const authorizeAction = preflightMode === "authorize" ? deriveExecutionAction(core.decision) : null;
       const allowClass = authorizeAction === "CONTINUE" || authorizeAction === "CONTINUE_WITH_MONITORING";
+      if (preflightMode === "authorize" && wantGrant) {
+        const reqGuard = guardExecutionGrantRequest(input, { logger });
+        if (!reqGuard.ok) {
+          throw typedError(
+            reqGuard.error.code,
+            "execution-grant request failed producer-schema validation",
+            { errors: reqGuard.error.errors }
+          );
+        }
+      }
       if (preflightMode === "authorize" && wantGrant && allowClass && typeof receipt === "string" && receipt.length > 0) {
         try {
           const {
@@ -208296,7 +208778,25 @@ var require_change_set = __commonJS({
               adapter_id: nonEmptyStr(input.adapter_id) || nonEmptyStr(context.adapter_id) || "fs",
               tenant_id: nonEmptyStr(input.tenant_id) || nonEmptyStr(context.tenant_id) || "default",
               nonce: stateNonce,
-              expected_state_token: nonEmptyStr(input.expected_state_token) || ""
+              expected_state_token: nonEmptyStr(input.expected_state_token) || "",
+              // 1206 variant A — the caller's claimed policy identity, BOUND into the signed grant.
+              //
+              // It was the one v2 field a client could send and the server would drop: the issuer
+              // has always read args.policy_hash (verdict-core/execution-grant-v2.js:132) and the
+              // wire has always carried a policy_hash slot, but this handler never forwarded it, so
+              // every grant was minted with the sha256('') default. A field that looks bound and is
+              // not is worse than an absent one — a reader of the token cannot tell the difference.
+              //
+              // AUDIENCE NEEDS NO LINE HERE: `audience` is already passed at the top of this call
+              // and the issuer derives audience_hash from it (:150), which the verifier already
+              // enforces (:227-234). Only policy_hash was missing.
+              //
+              // This binds what the CALLER CLAIMS, which is the whole point: the grant becomes
+              // tamper-evident about the policy it was issued under, and a verifier that knows which
+              // policy it expects can refuse a mismatch (intended.policy_hash, added symmetrically
+              // to the existing intended.audience_hash check). Absent → the issuer's sha256('')
+              // default, exactly as before.
+              policy_hash: nonEmptyStr(input.policy_hash) || void 0
             } : {
               target_id: grantTarget,
               ...stateNonce ? { state_nonce: stateNonce } : {}
@@ -225661,6 +226161,7 @@ var require_decision_result = __commonJS({
     } = require_policy_pin();
     var { sha256hex } = require_chain_attestation();
     var { canonicalJson } = require_canonical_json();
+    var { projectNextAgentStep } = require_next_agent_step2();
     var {
       buildRemediationTransaction,
       blockRequiredActionCore
@@ -225877,8 +226378,27 @@ var require_decision_result = __commonJS({
       // RT-P-20 — fingerprint rebind expected bit (SERVER-authored; under body_hash).
       // true = gate must rebind; null/absent on legacy = not_expected (wire compat residual).
       // Caller cannot set/delete this — author only in change-set issuance path.
-      fingerprint_binding_expected: null
+      fingerprint_binding_expected: null,
       // true | false | null (legacy)
+      // I-1288 — the decision's own remediation SUGGESTION, INSIDE the signed envelope.
+      //
+      // WHY IT MOVED IN. The identical projection has always been on the response root, at
+      // control_envelope.next_agent_step. But k8s-admission, gateway-verifier and the guard's
+      // deployGate are handed the ENVELOPE and nothing else: they could verify the decision and
+      // still not say what to do about it without a second network call to the issuer. A field
+      // that only exists next to the envelope is not available to the parties the envelope was
+      // built for. Placed here it is covered by decision_body_hash, so the receipt signs the
+      // suggestion along with the decision that produced it — a tampered next step no longer
+      // verifies.
+      //
+      // STILL NOT PERMISSION. Being signed makes it authentic, not authoritative: agents branch
+      // on execution_action, exactly as before. Null on the allow class (CONTINUE /
+      // CONTINUE_WITH_MONITORING) is the correct value, not an absent measurement.
+      //
+      // ADDITIVE, so spec_version stays decision-result.v1.1 (producer ENVELOPE COMPATIBILITY
+      // rule 5: additive optional fields do not bump the major). control_envelope keeps emitting
+      // its copy from the same pure function — one projection, two placements, never two rules.
+      next_agent_step: null
     });
     var SOURCE_SLOTS = Object.freeze([
       "repository",
@@ -226044,6 +226564,10 @@ var require_decision_result = __commonJS({
       if (hasAdditive && decision === "BLOCK" && additive.required_action_core == null) {
         additive.required_action_core = blockRequiredActionCore(reasonCode(context, breakingCount));
       }
+      if (hasAdditive) {
+        const raForStep = additive.required_action_core != null && typeof additive.required_action_core === "object" ? additive.required_action_core : required_action;
+        additive.next_agent_step = projectNextAgentStep(execution_action, raForStep);
+      }
       if (hasAdditive) {
         if (remediation_transaction) {
           additive.remediation_transaction = remediation_transaction;
@@ -227959,10 +228483,10 @@ var require_gate_pin = __commonJS({
   "src/generated/gate-pin.json"(exports2, module2) {
     module2.exports = {
       repo: "coderifts/contract-gate",
-      sha: "90de4be6641bbbc76b647d55bdec1e9019fd1d20",
-      tag: "v0.7.0",
+      sha: "1fae5d2bb2b52e1e1b745e649eab8834eac45645",
+      tag: "v0.8.0",
       resolved_from: "https://github.com/coderifts/contract-gate refs/tags/v0",
-      resolved_at: "2026-09-01T13:10:37Z",
+      resolved_at: "2026-09-02T07:25:19Z",
       note: "STRICT template pins this full commit SHA (GitHub: only a full SHA is immutable). v0 is a tag we move on every release, so it is NOT a pin. Re-run scripts/generate-gate-pin.js on each gate release; Dependabot bumps adopters."
     };
   }
@@ -229638,13 +230162,13 @@ var require_agent_host_files_embedded = __commonJS({
       ".cursor/hooks.json"
     ]);
     var AGENT_HOST_FILES = Object.freeze({
-      "AGENTS.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent rules\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
-      "CLAUDE.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
-      ".cursor/rules/coderifts.mdc": '---\ndescription: CodeRifts API governance \u2014 when to preflight and how to branch\nglobs:\nalwaysApply: true\n---\n\n<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
-      ".github/copilot-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts instructions for GitHub Copilot\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
-      "coderifts-langgraph-policy.js": '// GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js\n// System policy string for a LangGraph (or similar) agent. Content is generated;\n// identical rule sentences to AGENTS.md / other formats.\n\'use strict\';\n\nmodule.exports = "Call `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\\n\\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\\n\\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\\n\\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\\n\\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\\n\\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not \\"proceed with caution\\" without monitoring.\\n\\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\\n\\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\\n\\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\\n\\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\\n\\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\\n\\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\\n\\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\\n\\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\\n\\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\\n\\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\\n\\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\\n\\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\\n\\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\\n\\nWith a proven tenant\u2194repo binding you may request `derivation:\\"server\\"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\\n\\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say \\"authorized, commit not proven\\".";\n',
-      "openai-agent-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent instructions\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
-      "skills/api-governance/SKILL.md": '---\nname: api-governance\ndescription: Before merging or shipping any API or tool-contract change: preflight the change set, then branch on execution_action.\n---\n\n# CodeRifts API Governance\n\n<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      "AGENTS.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent rules\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nVersions you may meet elsewhere: `cr.exec.v2` is the issued-token version for atomic execution, and `ENFORCING_STRICT_V1` is the versioned spelling of the strict profile. Neither is the default and neither is required by these rules \u2014 see `docs/grant-versions.md`.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      "CLAUDE.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nVersions you may meet elsewhere: `cr.exec.v2` is the issued-token version for atomic execution, and `ENFORCING_STRICT_V1` is the versioned spelling of the strict profile. Neither is the default and neither is required by these rules \u2014 see `docs/grant-versions.md`.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      ".cursor/rules/coderifts.mdc": '---\ndescription: CodeRifts API governance \u2014 when to preflight and how to branch\nglobs:\nalwaysApply: true\n---\n\n<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nVersions you may meet elsewhere: `cr.exec.v2` is the issued-token version for atomic execution, and `ENFORCING_STRICT_V1` is the versioned spelling of the strict profile. Neither is the default and neither is required by these rules \u2014 see `docs/grant-versions.md`.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      ".github/copilot-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts instructions for GitHub Copilot\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nVersions you may meet elsewhere: `cr.exec.v2` is the issued-token version for atomic execution, and `ENFORCING_STRICT_V1` is the versioned spelling of the strict profile. Neither is the default and neither is required by these rules \u2014 see `docs/grant-versions.md`.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      "coderifts-langgraph-policy.js": '// GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js\n// System policy string for a LangGraph (or similar) agent. Content is generated;\n// identical rule sentences to AGENTS.md / other formats.\n\'use strict\';\n\nmodule.exports = "Call `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\\n\\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\\n\\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\\n\\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\\n\\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\\n\\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not \\"proceed with caution\\" without monitoring.\\n\\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\\n\\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\\n\\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\\n\\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\\n\\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\\n\\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\\n\\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\\n\\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\\n\\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\\n\\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\\n\\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\\n\\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\\n\\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\\n\\nVersions you may meet elsewhere: `cr.exec.v2` is the issued-token version for atomic execution, and `ENFORCING_STRICT_V1` is the versioned spelling of the strict profile. Neither is the default and neither is required by these rules \u2014 see `docs/grant-versions.md`.\\n\\nWith a proven tenant\u2194repo binding you may request `derivation:\\"server\\"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\\n\\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say \\"authorized, commit not proven\\".";\n',
+      "openai-agent-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent instructions\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nVersions you may meet elsewhere: `cr.exec.v2` is the issued-token version for atomic execution, and `ENFORCING_STRICT_V1` is the versioned spelling of the strict profile. Neither is the default and neither is required by these rules \u2014 see `docs/grant-versions.md`.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      "skills/api-governance/SKILL.md": '---\nname: api-governance\ndescription: Before merging or shipping any API or tool-contract change: preflight the change set, then branch on execution_action.\n---\n\n# CodeRifts API Governance\n\n<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nVersions you may meet elsewhere: `cr.exec.v2` is the issued-token version for atomic execution, and `ENFORCING_STRICT_V1` is the versioned spelling of the strict profile. Neither is the default and neither is required by these rules \u2014 see `docs/grant-versions.md`.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
       ".claude/settings.json": '{\n  "hooks": {\n    "PreToolUse": [\n      {\n        "matcher": "Write|Edit|MultiEdit",\n        "hooks": [\n          {\n            "type": "command",\n            "command": "coderifts claude-hook",\n            "timeout": 60\n          }\n        ]\n      }\n    ]\n  }\n}\n',
       ".cursor/hooks.json": '{\n  "version": 1,\n  "hooks": {\n    "preToolUse": [\n      {\n        "command": "coderifts cursor-hook",\n        "matcher": "Write|Delete",\n        "timeout": 60,\n        "failClosed": true\n      }\n    ]\n  }\n}\n'
     });
@@ -258366,9 +258890,22 @@ var require_enforce_check = __commonJS({
           );
         }
       }
+      const requireBinding = options.requireWorkflowBinding === true;
+      const bindingGrantsPass = report.workflow_binding && report.workflow_binding.grants_pass === true;
+      const bindingExit = requireBinding && !bindingGrantsPass ? 1 : 0;
+      if (bindingExit !== 0) {
+        const wb = report.workflow_binding || {};
+        errLog(chalk.red(
+          `--require-workflow-binding: the required workflow is not sha-pinned to this head (status ${wb.status || "UNKNOWN"}${wb.reason_code ? `, ${wb.reason_code}` : ""}).`
+        ));
+        if (wb.reason) errLog(chalk.dim(`  ${wb.reason}`));
+        errLog(chalk.dim(
+          "  This is the CLI audit verdict on the Action path, not a merge block \u2014 the App-path clamp is a separate control."
+        ));
+      }
       if (options.json) log(JSON.stringify(report, null, 2));
       else log(renderHuman(report));
-      return { exitCode: 0, report };
+      return { exitCode: bindingExit, report };
     }
     module2.exports = {
       runEnforceCheck,
@@ -258461,7 +258998,7 @@ var require_enforce = __commonJS({
           return { exitCode: 1, error: "check_apply_conflict", outcomes: [] };
         }
         const { runEnforceCheck } = require_enforce_check();
-        return runEnforceCheck(options, deps);
+        return runEnforceCheck({ ...options, requireWorkflowBinding: options.requireWorkflowBinding === true }, deps);
       }
       const apply = options.apply === true;
       const getKey = deps.getApiKey || getApiKey;