coderifts 8.0.0 → 8.1.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 8.1.0 - 2026-09-05
+
+### Changed
+- `@coderifts/agent-guard` range raised to `^16.0.0` (MIN_GUARD_MAJOR 16). Guard 16 makes `UNGUARDED_MUTATION` fail-closed the default; the CLI range must match so `npm i -g coderifts` installs the guard whose default the docs describe, not the 15.x advisory-default it shipped alongside before. No CLI behaviour change beyond the installed guard major.
+
+
+## 8.0.1 - 2026-09-02
+
+### Changed
+- `--require-workflow-binding` now gates the exit code: `enforce --check` exits non-zero when the required workflow is not SHA-pinned to the head (Action-path audit verdict; default off, advisory output unchanged without the flag).
+- The generated strict workflow pins contract-gate v0.8.0 (1fae5d2); the previously published 8.0.0 still pinned 0.7.0.
+- `@coderifts/agent-guard` range follows the published 15.1.0; embedded agent rule text regenerated (names cr.exec.v2 and ENFORCING_STRICT_V1 once).
+
 ## 8.0.0
 
 ### Security

package/README.md

@@ -86,13 +86,13 @@ coderifts init --agents --check          # which of the four pieces are present
 | **Host hook** | `.claude/settings.json`, `.cursor/hooks.json` | Reuses `hook install --claude` / `--cursor` (JSON-merge, backup, idempotent). Copilot shares Claude's `.claude/settings.json` — VS Code reads it by default. |
 | **CI workflow** | `.github/workflows/coderifts.yml` | `coderifts/contract-gate@v0`. Default: `require-verified-monitoring` commented (honest default: **false**). `--strict`: the same file with `require-verified-monitoring: 'true'` |
 
-**Grant versions** (these names are not interchangeable):
+**Grant versions** (these names are not interchangeable; field-by-field matrix: [Grant versions](https://github.com/coderifts/app/blob/main/docs/grant-versions.md)):
 
 | What | Who uses it | What it proves |
 |------|-------------|----------------|
 | `cr.exec.v1` | capability-demo and the strict-install workflow (`require-grant`) | A reference/teaching execution grant bound to `operation ∥ target_id ∥ after_payload`. The demo and `coderifts init --agents --strict` use this form. |
-| Atomic V2 request (`execution-grant-request.v2` fields) | SDK, Guard, executor | The request contract those three speak when minting/verifying a grant. Not the same bytes as a `cr.exec.v1` token. |
-| `ENFORCING_STRICT` | Guard `withCodeRifts({ profile })` | The current **profile name**. It is unsuffixed today and will become a versioned name; it is not a grant format and not Atomic V1. |
+| Atomic V2 request (the V2 fields of the authorize request; see docs/grant-versions.md) | TS SDK, Python SDK, Guard (not MCP; not the capability-demo executor) | The request contract those three speak when minting a grant. Not the same bytes as a `cr.exec.v1` token. |
+| `ENFORCING_STRICT` | Guard `withCodeRifts({ profile })` | Permanent alias of `ENFORCING_STRICT_V1` (must resolve to `_V1` forever). Not a grant format. Different axis from `ENFORCING_ATOMIC_V1`/`V2`. |
 
 `--strict` turns on `require-grant` and `require-verified-monitoring` in the workflow; it does not rename those three things.
 
@@ -412,21 +412,31 @@ Do not copy one file onto another host.
 
 ### `coderifts status [repo]`
 
-**Read-only** cross-layer enforcement report (Runtime / Merge / Deploy, plus
-Content). Calls `GET /api/v1/enforcement-status` and prints the statuses the
-endpoint measured — no GitHub writes, no branch-protection changes. Pair with
-`coderifts enforce` (that command **acts**; this one only **shows**).
+Prints three lines derived from **this process's actual config**, not a static
+string: Runtime / Merge / Deploy = `PREVENTS` or `REPORTS`.
 
-Requires a cloud API key. Distinct from `coderifts hook status` (local
-pre-push hook install state). Exit **0** on a successful read, **1** on
-missing/invalid repo, missing key, or API error.
+| Line | PREVENTS when | REPORTS when |
+|------|----------------|--------------|
+| Runtime | host wrap fail-closed (`CODERIFTS_ADVISORY` unset) | `CODERIFTS_ADVISORY=1\|true` |
+| Merge | `MERGEGATE_ENFORCE=true` (exact string; `1` is not enough) | otherwise (the App default) |
+| Deploy | deploy-gate fail-closed | `CODERIFTS_DEPLOY_ADVISORY=1\|true` or `CODERIFTS_ADVISORY=1\|true` |
+
+`REPORTS` is `REPORTS` — this does not claim a wrap or required check is
+installed on a repository. With `[repo]` / `--repo owner/repo`, also calls
+`GET /api/v1/enforcement-status` and prints the statuses the endpoint measured
+(API key required for that half). No GitHub writes. Pair with `coderifts
+enforce` (that command **acts**; this one only **shows**). Distinct from
+`coderifts hook status`. Exit **0** on the local three-liner or a successful
+cloud read, **1** on invalid repo, missing key (when a repo is given), or API
+error.
 
 | Flag | Description | Default |
 |------|-------------|---------|
-| `[repo]` / `--repo <owner/repo>` | Repository | none (required) |
-| `--json` | Machine-readable JSON (raw API body) | `false` |
+| `[repo]` / `--repo <owner/repo>` | Repository (cloud report) | none (local posture only) |
+| `--json` | Machine-readable JSON (local posture, or raw API body when a repo is given) | `false` |
 
 ```bash
+coderifts status
 coderifts status owner/repo
 coderifts status --repo owner/repo --json
 ```
@@ -453,7 +463,7 @@ failed, **1** on missing repo/key, API error, or any apply failure.
 | `--branch <name>` | With `--check`: branch (default: repo default) | default branch |
 | `--provider <name>` | With `--check`: provider adapter. `github` only; others report UNVERIFIABLE and are never stubbed | `github` |
 | `--head-sha <sha>` | With `--check`: pull-request head commit, so the required-workflow pin can be compared with the bytes being merged | none |
-| `--require-workflow-binding` | With `--check`: also require a sha-pinned required workflow matching the head. **Default OFF** — without it the evidence still gains a `workflow_binding` section and neither the verdict nor the exit code changes | `false` |
+| `--require-workflow-binding` | With `--check`: **exit non-zero** when the required workflow is not sha-pinned to the head (`workflow_binding.grants_pass !== true`). Scope: the CLI's own audit verdict on the **Action path** — it is not the App-path merge clamp, which is decided server-side and is a separate control. **Default OFF** — without the flag the evidence is byte-identical, the verdict is unchanged and the exit code stays 0 (advisory) | `false` |
 | `--json` | Machine-readable JSON result | `false` |
 
 ```bash

package/bin/coderifts.js

@@ -15,9 +15,11 @@ program
   .command('diff <old-spec> <new-spec>')
   .description('Compare two OpenAPI specs and report breaking changes')
   .option('-f, --format <format>', 'Output format: terminal (default), json, markdown', 'terminal')
-  .option('--ci', 'CI mode — exit with code 1 if breaking changes exceed threshold')
+  .option('--ci', 'CI mode — exit 1 when risk exceeds --threshold (add --fail-on-breaking to also fail on any break)')
   .option('--threshold <number>', 'Risk score threshold for CI mode (0-100)', '50')
+  .option('--fail-on-breaking', 'CI mode: exit 1 on ANY breaking change, even under --threshold. Opt-in: the local analyser has a known false positive on additive request-body changes.')
   .option('--cloud', 'Use the CodeRifts cloud API instead of local analysis')
+  .option('--gate', 'Quote the server authorize verdict + receipt (the gate). Not a local recompute. Requires an API key.')
   .option('-c, --config <path>', 'Path to .coderifts.yml config file')
   .option('--no-normalize', 'Skip spec normalization (raw diff mode)')
   .action(async (oldSpec, newSpec, options) => {
@@ -36,7 +38,8 @@ program
   .option('--artifact <artifact_id>', 'Immutable artifact identity being deployed (content digest or commit SHA)')
   .option('--receipt <file>', 'Path to the signed chain_receipt token + decision envelope JSON')
   .option('--fingerprint <fp>', 'Optional intended fingerprint the receipt must match')
-  .option('--keys <file-or-url>', 'Ed25519 key registry (file or URL). Default: https://app.coderifts.com/.well-known/coderifts-keys.json')
+  .option('--keys <file-or-url>', 'Ed25519 key registry (file or URL). Default: the vendored offline snapshot (keys/coderifts-keys.json)')
+  .option('--refresh-keys', 'Opt in to LIVE key discovery for this run (fetches the well-known registry). Default verification is offline.')
   .option('--pinned-key <file>', 'Air-gapped PEM public key (skips registry fetch)')
   .option('--json', 'Output the binding result as JSON')
   .option('--enforce', 'Accepted silently (exit is fail-closed by default). Still attests ENFORCING for inescapable_deploy.')
@@ -222,7 +225,7 @@ program
 // GET /api/v1/enforcement-status — no GitHub writes. Distinct from `coderifts hook status`.
 program
   .command('status [repo]')
-  .description('Show cross-layer enforcement status (Runtime / Merge / Deploy) for a repo — read-only')
+  .description('Show Runtime / Merge / Deploy = PREVENTS or REPORTS from local config; with a repo, also the cloud enforcement-status report — read-only')
   .option('--repo <owner/repo>', 'Repository (owner/repo); also accepted as a positional argument')
   .option('--json', 'Machine-readable JSON (raw API body)')
   .action(async (repoPositional, options) => {

package/dist/.build-source-sha

@@ -0,0 +1,5 @@
+{
+  "$comment": "GENERATED by scripts/build.js. sha256 over src/**.js + bin/**.js (path + bytes). test/build-freshness.test.js recomputes it; a mismatch means dist/cli.js is stale.",
+  "sha256": "d9d48f2b01fa76855978dbbaa67d81be419b7632e1cc80eb5b999d5efcf9c090",
+  "file_count": 42
+}