coderifts 8.6.2 → 8.6.4

package/CHANGELOG.md

@@ -1,6 +1,15 @@
 # Changelog
 
-## Unreleased
+## 8.6.4 - 2026-09-18
+
+- Pre-push hook: missing API key is a **named failure** (exit 1, stderr names the gate). Absence of a key is not permission. Explicit opt-out is `CODERIFTS_ADVISORY=1|true` (same flag as `claude-hook` / `deploy-gate`). `CODERIFTS_SKIP=1` stays a loud escape hatch (stderr, exit 0). Env `CODERIFTS_API_KEY` is honored when `git config coderifts.apiKey` is empty (the previous assignment clobbered the env). Already-installed hooks are not auto-updated — re-run `coderifts hook install`.
+
+- `lock --check` and `adopt` load their core statically, so both exist in the published package. They were absent from the tarball because the require path was built at runtime and the bundler could not see it. The packed smoke test now runs `lock --check` against two fixtures rather than only `--help` and `--version`.
+
+## 8.6.3 - 2026-09-12
+
+js-yaml moves to 4.3.2 in the shipped dependency set. The generated strict workflow pins contract-gate v0.9.5, following the gate release. The package metadata points at the public site rather than the private app repository.
+
 
 ## 8.6.2 - 2026-09-10
 

package/README.md

@@ -293,8 +293,10 @@ Installs a **pre-push** hook that diffs the configured OpenAPI path against a
 resolved baseline (remote tip, or for new branches a merge-base with the
 default branch). Empty-before allow is not used. The hook prefers closed-set
 `execution_action` from the diff API (legacy `omega_decision` only when action
-is absent). Configure with `git config coderifts.apiKey` and optional
-`git config coderifts.specPath`.
+is absent). Configure with `git config coderifts.apiKey` or `CODERIFTS_API_KEY`,
+and optional `git config coderifts.specPath`. Installed with no key: the hook
+exits **1** (absence is not permission). Explicit opt-out: `CODERIFTS_ADVISORY=1`
+(same flag as `claude-hook` / `deploy-gate`). Loud skip: `CODERIFTS_SKIP=1`.
 
 After upgrading the `coderifts` CLI, re-run `coderifts hook install` so the
 installed hook matches the package (already-installed hooks are not
@@ -793,7 +795,8 @@ Two honest modes:
 | `CODERIFTS_API_KEY` | API key (alternative to `coderifts login`) |
 | `CODERIFTS_OASDIFF_BIN` | Explicit path to the `oasdiff` binary (overrides auto-detect) |
 | `CODERIFTS_STRICT` | `claude-hook`: `1` or `true` pins fail-closed (cannot be weakened by `CODERIFTS_ADVISORY`). Default is already fail-closed. |
-| `CODERIFTS_ADVISORY` | `claude-hook`: `1` or `true` is the **explicit** soft-allow opt-out on “governance could not run” sites. Absence of a key is not this flag. Also accepted by `deploy-gate` as the same opt-out as `CODERIFTS_DEPLOY_ADVISORY`. |
+| `CODERIFTS_ADVISORY` | `claude-hook`: `1` or `true` is the **explicit** soft-allow opt-out on “governance could not run” sites. Absence of a key is not this flag. Also accepted by `deploy-gate` as the same opt-out as `CODERIFTS_DEPLOY_ADVISORY`. Pre-push: `1` or `true` allows a push when no API key is configured (explicit opt-out; default is exit 1). |
+| `CODERIFTS_SKIP` | Pre-push: `1` is the **loud** escape hatch (`CodeRifts: CODERIFTS_SKIP=1 set — push allowed (explicit override).` on stderr, exit 0). Not the missing-key default. Same class as `git push --no-verify`. |
 | `CODERIFTS_MONITORING_SINK_WIRED` | `claude-hook`: `1` or `true` host-asserts a monitoring sink so `CONTINUE_WITH_MONITORING` may exit 0. Not delivery proof. |
 | `CODERIFTS_DEPLOY_ADVISORY` | `deploy-gate`: `1` or `true` is the **explicit** opt-out — print the verdict, print `ADVISORY MODE — this gate did not block`, exit 0. |
 | `CODERIFTS_DEPLOY_ENFORCE` | `deploy-gate`: `true` attests ENFORCING (same as `--enforce`; no-op for exit — default is already fail-closed); `unknown` is explicitly unobservable (never assume ENFORCING) |

package/dist/.build-source-sha

@@ -1,5 +1,5 @@
 {
-  "$comment": "GENERATED by scripts/build.js. sha256 over src/**.js + bin/**.js (path + bytes). test/build-freshness.test.js recomputes it; a mismatch means dist/cli.js is stale.",
-  "sha256": "3eec93dc767975626ebdebc8fe9ab226e6ea24668e2721af17e41ebc5c214495",
-  "file_count": 49
+  "$comment": "GENERATED by scripts/build.js. sha256 over src/** + bin/** (path + bytes), for every extension esbuild bundles — .js AND .json. scripts/lib/source-fingerprint.js is the single implementation; test/build-freshness.test.js recomputes it from there rather than from a copy. A mismatch means dist/cli.js is stale.",
+  "sha256": "697e0dbdd823fb24bbceac1bf11d9639ca9a593da9123714c944e25ec8313022",
+  "file_count": 51
 }