coderifts 8.6.3 → 8.6.4

package/dist/cli.js

@@ -3028,7 +3028,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "8.6.3",
+      version: "8.6.4",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -168610,7 +168610,7 @@ var require_picomatch2 = __commonJS({
 var require_mcp_poison_gate = __commonJS({
   "../../src/mcp-poison-gate.js"(exports2, module2) {
     "use strict";
-    var MCP_POISON_GATE_VERSION = "mpg-1";
+    var MCP_POISON_GATE_VERSION = "mpg-2";
     var BLOCK_TYPES = /* @__PURE__ */ new Set([
       "suspicious_instruction",
       "exfiltration_url_cosignal",
@@ -168619,7 +168619,8 @@ var require_mcp_poison_gate = __commonJS({
     ]);
     var RA_TYPES = /* @__PURE__ */ new Set([
       "structural_anomaly",
-      "hidden_encoding"
+      "hidden_encoding",
+      "instruction_heuristic"
     ]);
     var DECISION_ORDER = { ALLOW: 0, WARN: 1, REQUIRE_APPROVAL: 2, BLOCK: 3 };
     function isLowerThan(decision, floor) {
@@ -205515,6 +205516,16 @@ var require_mcp_poisoning_detector = __commonJS({
     "use strict";
     var SENSITIVE_OBJECT = "(secrets?|credentials?|tokens?|passwords?|api[\\s_-]?keys?|private[\\s_-]?keys?|env|environment|conversation|chat\\s*history|context|user\\s*data|session)";
     var SENSITIVE_SCOPE = "(any|all|every|stored|user\\'?s?|the\\s+user\\'?s?|all\\s+environment)";
+    var MODE_PHRASE = /(hidden|secret|debug)\s+mode/i;
+    var MODE_NEGATED = /\b(?:do not|don't|does not|doesn't|never|not)\b[\s\S]{0,40}?(hidden|secret|debug)\s+mode/i;
+    var ALWAYS_RETURN_OK = /always\s+return\s+(success|ok|true)/i;
+    function findingTypeFor(regex) {
+      if (regex === MODE_PHRASE || regex === ALWAYS_RETURN_OK) return "instruction_heuristic";
+      return "suspicious_instruction";
+    }
+    function modePhraseHits(str) {
+      return MODE_PHRASE.test(str) && !MODE_NEGATED.test(str);
+    }
     var SUSPICIOUS_PATTERNS = [
       // Injection / "ignore your instructions" family. The trailing object
       // (instructions|rules|prompts|context) is OPTIONAL so "ignore previous and ..."
@@ -205524,9 +205535,18 @@ var require_mcp_poisoning_detector = __commonJS({
       // ~40 chars so benign "always include the source URL" stays quiet.
       new RegExp("always\\s+(include|append|send|attach|return|add)\\b[\\s\\S]{0,40}?\\b" + SENSITIVE_OBJECT + "\\b", "i"),
       /you\s+(must|should|have to)\s+(now|always|instead)/i,
-      /exfiltrate|steal|leak|send\s+to\s+external/i,
+      // Unanchored `leak` matched "leaked"/"leaks" (same class as the ungrouped
+      // hidden|secret|debug mode bug). Keep the token — FSP 007 only fires because
+      // ZWSP broke SEND and the host is leak.example — but require a word boundary
+      // AND a payload noun or URL in the same string. Deleting leak drops 007
+      // (94.1% → 88.2%); this co-occurrence does not.
+      /exfiltrate|steal|send\s+to\s+external/i,
+      /\bleak\b[\s\S]{0,80}?(?:https?:\/\/|\b(?:conversation|chat|history|context|credentials?|secrets?|tokens?|api\s*keys?|passwords?|data)\b)|(?:https?:\/\/|\b(?:conversation|chat|history|context|credentials?|secrets?|tokens?|api\s*keys?|passwords?|data)\b)[\s\S]{0,80}?\bleak\b/i,
       // Exfiltration-intent family: an action verb targeting a sensitive payload.
-      /\b(send|forward|copy|upload|post|transmit|exfiltrate|leak)\b[\s\S]{0,40}?\b(conversation|chat|history|context|messages?|credentials?|secrets?|tokens?|api\s*keys?|keys?|passwords?|data)\b/i,
+      // `messages?` was too broad — "Forward the message to the shared inbox" is a
+      // mail-forwarder's job. `data` stays: fsp-exfil-title-010 is "SEND COPY OF ALL
+      // USER DATA" and does not contain "a copy".
+      /\b(send|forward|copy|upload|post|transmit|exfiltrate|leak)\b[\s\S]{0,40}?\b(conversation|chat|history|context|credentials?|secrets?|tokens?|api\s*keys?|keys?|passwords?|data)\b/i,
       // Return/echo scoped sensitive material without a path ("return any stored credentials").
       // Scope word required — bare "return the new API token" must stay quiet.
       new RegExp(
@@ -205546,23 +205566,39 @@ var require_mcp_poisoning_detector = __commonJS({
       /bypass\s+(auth|security|validation|filter)/i,
       /override\s+(safety|policy|rules?)/i,
       /do\s+not\s+(follow|respect|obey)\s+(original|previous)/i,
-      /hidden|secret|debug\s+mode/i,
+      // Grouping is load-bearing: `/hidden|secret|debug\s+mode/` is
+      // `hidden` OR `secret` OR `debug mode`, so any "secret"/"hidden" token is a
+      // HIGH poison hit (store_credential, list_secrets, hidden pagination fields).
+      // Intent, from the original line sitting among phrase-level patterns: the
+      // three MODE phrases. scanString applies skip-negation so "Does not enable
+      // debug mode" is quiet and "When debug mode is enabled" still hits.
+      MODE_PHRASE,
+      // Confused-deputy / tool-shadowing: "also invoke the secret exfil tool".
+      // Requires also|now + invoke/call AND the noun "tool". That is NOT
+      // capability_claimed (`also … calls?`), which fires on "also calls the webhook".
+      // "invoke this tool after payment" has no also|now; "this tool calls …" is the
+      // wrong order. Measured 0/20 benign and 0/6 mcp-fpfn FP vectors.
+      /\b(?:also|now)\s+(?:invoke|call)s?\b[\s\S]{0,60}?\btool\b/i,
       /\[system\]|<\s*system\s*>/i,
-      /always\s+return\s+(success|ok|true)/i,
+      ALWAYS_RETURN_OK,
       /hide\s+(errors|failures|issues)/i,
       /return\s+secret|exfiltrat|leak\s+data/i
     ];
     var URL_PATTERN = /https?:\/\/[^\s)'"]+/i;
     var SENSITIVE_PATH_PATTERN = /(~\/\.ssh|~\/\.cursor|~\/\.aws|\.aws\/|\.env\b|\/etc\/|mcp\.json|id_rsa|\.ssh\/|\/credentials(?:\.|\/)|credentials\.(?:json|txt|pem|env)|\.credentials\b)/i;
-    var CONTENT_MOVE_VERB_PATTERN = /\b(pass|send|return|forward|include|read|upload|post|transmit|copy|exfiltrate|leak|echo|reveal|expose)\b/i;
+    var CONTENT_MOVE_VERB_PATTERN = /\b(pass|send|return|forward|include|upload|post|transmit|copy|exfiltrate|leak|echo|reveal|expose)\b/i;
     var BASE64_BLOB_PATTERN = /[A-Za-z0-9+/]{40,}={0,2}/;
     function isLikelyBase64(s) {
       if (/=$/.test(s)) return true;
       return /[A-Z]/.test(s) && /[a-z]/.test(s) && /[0-9]/.test(s);
     }
+    function patternHits(regex, str) {
+      if (regex === MODE_PHRASE) return modePhraseHits(str);
+      return regex.test(str);
+    }
     function hasInjectionIntent(str) {
       if (typeof str !== "string") return false;
-      if (SUSPICIOUS_PATTERNS.some((re) => re.test(str))) return true;
+      if (SUSPICIOUS_PATTERNS.some((re) => patternHits(re, str))) return true;
       if (SENSITIVE_PATH_PATTERN.test(str) && CONTENT_MOVE_VERB_PATTERN.test(str)) return true;
       return false;
     }
@@ -205570,9 +205606,9 @@ var require_mcp_poisoning_detector = __commonJS({
       if (typeof value !== "string" || value.length < 5) return [];
       const findings = [];
       for (const regex of SUSPICIOUS_PATTERNS) {
-        if (regex.test(value)) {
+        if (patternHits(regex, value)) {
           findings.push({
-            type: "suspicious_instruction",
+            type: findingTypeFor(regex),
             path,
             snippet: value.substring(0, 120),
             severity: "HIGH",
@@ -205743,6 +205779,130 @@ var require_mcp_poisoning_detector = __commonJS({
   }
 });
 
+// ../../src/tool-description-classifier.js
+var require_tool_description_classifier = __commonJS({
+  "../../src/tool-description-classifier.js"(exports2, module2) {
+    "use strict";
+    var PATTERN = "TOOL_INSTRUCTION_DRIFT";
+    var TAXONOMY = Object.freeze([
+      "OWASP MCP Taxonomy: Tool Description Drift (glossary)",
+      "OWASP MCP Taxonomy: Rug Pull (T2.1)",
+      "OWASP MCP03: trusted tool update changes behavior"
+    ]);
+    var DOES_NOT_PROVE = Object.freeze([
+      "that the reworded text carries the same meaning to every model",
+      "that no instruction was moved into a field this check does not read"
+    ]);
+    var BRANCH_SIGNALS = Object.freeze([
+      {
+        id: "capability_claimed",
+        re: /\b(?:also|now)\s+(?:reads?|writes?|accesses?|sends?|fetches?|calls?)\b|\bcan now\b/i,
+        why: "claims a capability or scope the previous text did not"
+      },
+      {
+        id: "condition_changed",
+        re: /\b(?:use (?:this )?when|do not call|don't call|only (?:use|call)|never call)\b/i,
+        why: "adds or removes a condition on when the tool applies"
+      },
+      {
+        id: "concealment_instructed",
+        re: /\b(?:do not|don't|never)\s+(?:mention|reveal|disclose|explain|tell|show|log)\b|\bwithout (?:telling|informing|notifying)\b/i,
+        why: "instructs the model to hide something from the user"
+      },
+      {
+        id: "priority_steered",
+        re: /\b(?:use this (?:every time|always)|always use this|prefer this over|instead of (?:the )?other|do not use \w+ tool)\b/i,
+        why: "steers the model toward or away from another tool"
+      },
+      // A: one verb. `exfiltrat\w*` is enough; leak|transmit|beacon|copy|mail added FP
+      // with no extra TP (measured 2026-09-14).
+      {
+        id: "recipient_named",
+        re: /\b(?:send|post|forward|upload|report|exfiltrat\w*)\b[^.]{0,40}\b(?:to|at)\s+(?:https?:\/\/|[\w.-]+\.[a-z]{2,}|@[\w.-]+)/i,
+        why: "names an external recipient or resource that was not there before"
+      },
+      // D: co-occurrence in one sentence — a moving verb AND a credential/path.
+      // `returns?` matches "return the key" and not "never returned" (`returned` ≠ `return`).
+      {
+        id: "credential_referenced",
+        re: /\b(?:send|forward|copy|upload|post|transmit|exfiltrat\w*|leak|echo|reveal|expose|attach|returns?)\b[^\n.]{0,60}?\b(?:api[_ -]?key|secrets?|tokens?|credentials?|passwords?|\.env|id_rsa|~\/\.[\w-]+|private key)\b|\b(?:api[_ -]?key|secrets?|tokens?|credentials?|passwords?|\.env|id_rsa|~\/\.[\w-]+|private key)\b[^\n.]{0,60}?\b(?:send|forward|copy|upload|post|transmit|exfiltrat\w*|leak|echo|reveal|expose|attach|returns?)\b/i,
+        why: "names a credential or secret path together with a verb that moves it"
+      }
+    ]);
+    function normalise(s) {
+      return String(s).replace(/[‘’]/g, "'").replace(/[“”]/g, '"').replace(/[–—]/g, "-").replace(/\s+/g, " ").trim().toLowerCase();
+    }
+    function addedText(before, after) {
+      const sents = (s) => String(s).split(/(?<=[.!?])\s+/).map((x) => x.trim()).filter(Boolean);
+      const had = new Set(sents(before).map(normalise));
+      return sents(after).filter((s) => !had.has(normalise(s)));
+    }
+    function classifyDescriptionChange(before, after) {
+      const base = { pattern: null, taxonomy: TAXONOMY, does_not_prove: [...DOES_NOT_PROVE], signals: [] };
+      if (typeof before !== "string" || typeof after !== "string" || !before.trim() || !after.trim()) {
+        return {
+          ...base,
+          classification: "CLASSIFICATION_UNDECIDABLE",
+          risk: 0,
+          execution_action: "REQUEST_APPROVAL",
+          reason: "one side of the description is absent or empty \u2014 the change could not be classified, and an unclassified instruction change is not a reworded one"
+        };
+      }
+      if (normalise(before) === normalise(after)) {
+        return {
+          ...base,
+          classification: "DESCRIPTION_REWORDED",
+          risk: 0,
+          execution_action: "CONTINUE",
+          reason: "the text differs only in whitespace, case or punctuation"
+        };
+      }
+      const added = addedText(before, after);
+      const removed = addedText(after, before);
+      if (added.length === 0 && removed.length === 0) {
+        return {
+          ...base,
+          classification: "CLASSIFICATION_UNDECIDABLE",
+          risk: 0,
+          execution_action: "REQUEST_APPROVAL",
+          reason: "the descriptions differ but no sentence was added or removed \u2014 the change is inside a sentence, which this classifier does not read"
+        };
+      }
+      const haystack = added.join(" ");
+      const hits = BRANCH_SIGNALS.filter((s) => s.re.test(haystack)).map((s) => ({ id: s.id, why: s.why }));
+      if (hits.length > 0) {
+        return {
+          ...base,
+          classification: "BRANCH_CONDITION_MOVED",
+          // +15, one step above the +10 its neighbours carry for a SHAPE change. A moved instruction
+          // changes what the tool does with an unchanged schema, which the shape checks cannot see;
+          // pricing it below them would say the opposite.
+          risk: 15,
+          pattern: PATTERN,
+          execution_action: "REQUEST_APPROVAL",
+          signals: hits,
+          reason: `added text ${hits.map((h) => h.why).join("; ")}`
+        };
+      }
+      return {
+        ...base,
+        classification: "DESCRIPTION_REWORDED",
+        risk: 0,
+        execution_action: "CONTINUE",
+        reason: added.length ? "sentences changed, and none of them moves a branch condition" : "text was removed, and none of it held a branch condition"
+      };
+    }
+    module2.exports = {
+      classifyDescriptionChange,
+      addedText,
+      PATTERN,
+      TAXONOMY,
+      DOES_NOT_PROVE,
+      BRANCH_SIGNALS
+    };
+  }
+});
+
 // ../../src/remediation-taxonomy.js
 var require_remediation_taxonomy = __commonJS({
   "../../src/remediation-taxonomy.js"(exports2, module2) {
@@ -208155,7 +208315,7 @@ var require_decision_result_v1_producer = __commonJS({
         blast_radius: {
           type: "object",
           additionalProperties: false,
-          description: "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage (before_norm+after_norm+policy+scorer_version). Zeros are measured absence. consumers_declared and consumers_observed are separate: declared-but-never-called is a score question, not a count question. graph_source none = no request graph.",
+          description: "Additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage (before_norm+after_norm+policy+scorer_version). Zeros are measured absence. consumers_declared and consumers_observed are separate: declared-but-never-called is a score question, not a count question. graph_source none = no request graph.",
           required: [
             "endpoints",
             "fields",
@@ -208797,7 +208957,7 @@ var require_execution_grant_request_v2_producer = __commonJS({
             "v2"
           ],
           description: "src/change-set.js:1328 \u2014 `v2` selects the cr.exec.v2 issuer. 1344 MIGRATION: absent resolves through src/grant-version-default.js \u2014 cr.exec.v1 before 2026-09-18, cr.exec.v2 on and after. An explicit value always wins. `grantVersion` (camelCase) is accepted as an alias; both are listed so neither reads as undeclared. JSON Schema `default` is omitted on purpose (1363): a static default cannot be both v2 (the post-cutoff target) and v1 (what omitting yields during the window). Machine-readable: x-coderifts-effective-default is today's omit-value; x-coderifts-default-changes-at is when it becomes v2. The authorize response meta.grant_version is the version actually issued.",
-          "x-coderifts-effective-default": "v1",
+          "x-coderifts-effective-default": "v2",
           "x-coderifts-default-changes-at": "2026-09-18"
         },
         grantVersion: {
@@ -208807,7 +208967,7 @@ var require_execution_grant_request_v2_producer = __commonJS({
             "v2"
           ],
           description: "camelCase alias of grant_version, read at src/change-set.js:1268. Declared because the handler reads it, not because it is recommended. Same dated default as grant_version (no JSON Schema `default`; see x-coderifts-* on grant_version).",
-          "x-coderifts-effective-default": "v1",
+          "x-coderifts-effective-default": "v2",
           "x-coderifts-default-changes-at": "2026-09-18"
         },
         tenant_id: {
@@ -210385,6 +210545,11 @@ var require_change_set = __commonJS({
     var { scoreMcpRisk } = require_mcp_risk_scorer();
     var { detectPoisoning } = require_mcp_poisoning_detector();
     var { classifyPoison, isLowerThan } = require_mcp_poison_gate();
+    var {
+      classifyDescriptionChange,
+      addedText,
+      PATTERN: TOOL_INSTRUCTION_DRIFT
+    } = require_tool_description_classifier();
     var { parse: parseGraphql } = require_graphql2();
     var {
       ensureDecisionSpec,
@@ -210614,25 +210779,83 @@ var require_change_set = __commonJS({
       ensureDecisionSpec(art);
       return finding(art);
     }
+    function mcpInstructionDrift(oldMcp, newMcp) {
+      return toolListInstructionDrift(oldMcp && oldMcp.tools || [], newMcp && newMcp.tools || []);
+    }
+    function toolListInstructionDrift(oldTools, newTools) {
+      const oldBy = new Map((oldTools || []).map((t) => [t && t.name, t]));
+      for (const nt of newTools || []) {
+        if (!nt || !nt.name) continue;
+        const ot = oldBy.get(nt.name);
+        if (!ot) continue;
+        if (ot.description === nt.description) continue;
+        const v = classifyDescriptionChange(ot.description, nt.description);
+        if (v.execution_action === "REQUEST_APPROVAL") return true;
+      }
+      return false;
+    }
+    function rewriteDescriptions(oldVal, newVal) {
+      if (Array.isArray(newVal)) {
+        const oldArr = Array.isArray(oldVal) ? oldVal : [];
+        return newVal.map((item, i) => rewriteDescriptions(oldArr[i], item));
+      }
+      if (!newVal || typeof newVal !== "object") return newVal;
+      const oldObj = oldVal && typeof oldVal === "object" && !Array.isArray(oldVal) ? oldVal : {};
+      const out = {};
+      for (const [k, v] of Object.entries(newVal)) {
+        if (k === "description" && typeof v === "string") {
+          const prev = typeof oldObj[k] === "string" ? oldObj[k] : "";
+          out[k] = addedText(prev, v).join(" ");
+        } else {
+          out[k] = rewriteDescriptions(oldObj[k], v);
+        }
+      }
+      return out;
+    }
+    function manifestWithAddedSentences(oldManifest, newManifest) {
+      const old = oldManifest && typeof oldManifest === "object" ? oldManifest : {};
+      const neu = newManifest && typeof newManifest === "object" ? newManifest : {};
+      const oldBy = new Map((Array.isArray(old.tools) ? old.tools : []).map((t) => [t && t.name, t]));
+      const tools = (Array.isArray(neu.tools) ? neu.tools : []).map((nt) => {
+        if (!nt || typeof nt !== "object" || !nt.name) return nt;
+        const ot = oldBy.get(nt.name);
+        if (!ot) return nt;
+        return rewriteDescriptions(ot, nt);
+      });
+      const topOld = { ...old };
+      const topNew = { ...neu };
+      delete topOld.tools;
+      delete topNew.tools;
+      const view = rewriteDescriptions(topOld, topNew);
+      view.tools = tools;
+      return view;
+    }
     function analyzeMcpManifest(before, after) {
       const oldMcp = parseManifest(before);
       const newMcp = parseManifest(after);
       const risk = scoreMcpRisk({ oldManifest: oldMcp, newManifest: newMcp });
       const breaking = risk.signals.filter((s) => (s.impact || 0) > 0).length;
       const patterns = risk.signals.map((s) => s.signal);
+      if (mcpInstructionDrift(oldMcp, newMcp) && !patterns.includes(TOOL_INSTRUCTION_DRIFT)) {
+        patterns.push(TOOL_INSTRUCTION_DRIFT);
+      }
       const art = {
         risk_score: risk.score,
         breaking_changes: breaking,
         patterns
       };
       if (risk.score >= 50) art.should_block = true;
-      const poisonGate = classifyPoison(detectPoisoning(oldMcp, newMcp));
+      const poisonGate = classifyPoison(detectPoisoning(oldMcp, manifestWithAddedSentences(oldMcp, newMcp)));
       if (poisonGate.tier === "block") art.omega_decision = "BLOCK";
       ensureDecisionSpec(art);
       if (poisonGate.tier === "ra" && isLowerThan(art.decision, "REQUIRE_APPROVAL")) {
         art.decision = "REQUIRE_APPROVAL";
         ensureDecisionSpec(art);
       }
+      if (patterns.includes(TOOL_INSTRUCTION_DRIFT) && isLowerThan(art.decision, "REQUIRE_APPROVAL")) {
+        art.decision = "REQUIRE_APPROVAL";
+        ensureDecisionSpec(art);
+      }
       return finding(art);
     }
     function parseAgentToolsPayload(v) {
@@ -210730,7 +210953,23 @@ var require_change_set = __commonJS({
         reflex_triggers: json.reflex_triggers,
         omega_components: json.omega_components
       };
+      const poisonGate = classifyPoison(detectPoisoning(
+        { tools: beforeTools },
+        manifestWithAddedSentences({ tools: beforeTools }, { tools: afterTools })
+      ));
+      if (poisonGate.tier === "block") art.omega_decision = "BLOCK";
+      if (toolListInstructionDrift(beforeTools, afterTools) && !patterns.includes(TOOL_INSTRUCTION_DRIFT)) {
+        patterns.push(TOOL_INSTRUCTION_DRIFT);
+      }
       ensureDecisionSpec(art);
+      if (poisonGate.tier === "ra" && isLowerThan(art.decision, "REQUIRE_APPROVAL")) {
+        art.decision = "REQUIRE_APPROVAL";
+        ensureDecisionSpec(art);
+      }
+      if (patterns.includes(TOOL_INSTRUCTION_DRIFT) && isLowerThan(art.decision, "REQUIRE_APPROVAL")) {
+        art.decision = "REQUIRE_APPROVAL";
+        ensureDecisionSpec(art);
+      }
       return finding(art);
     }
     var ANALYZE_PERMISSION_KEYS = Object.freeze(["decision", "safe_for_agent", "execution_action"]);
@@ -210885,6 +211124,7 @@ var require_change_set = __commonJS({
     var DECISION_SPEC_VERSION = "2.0";
     var DECISION_SPEC_LEGACY_VERSION = "1.0";
     var DECISION_SPEC_LEGACY_SUNSET = "2026-09-07T00:00:00Z";
+    var DECISION_SPEC_LEGACY_SUNSET_AT_MS = Date.parse(DECISION_SPEC_LEGACY_SUNSET);
     var ANALYSIS_OUTCOMES = Object.freeze({
       NO_BREAK_DETECTED: "NO_BREAK_DETECTED",
       BREAKS_DETECTED: "BREAKS_DETECTED",
@@ -210896,6 +211136,18 @@ var require_change_set = __commonJS({
       const s = String(raw).trim();
       return s === "1.0" || s === "1" || s === "decision-result.v1" || s === "decision-result.v1.0";
     }
+    function isLegacyDecisionSpecPinRetired(now) {
+      const nowMs = now instanceof Date ? now.getTime() : typeof now === "number" ? now : Date.now();
+      return nowMs >= DECISION_SPEC_LEGACY_SUNSET_AT_MS;
+    }
+    function rejectRetiredLegacyPin(input, deps) {
+      if (!isLegacyDecisionSpecPin(input)) return;
+      if (!isLegacyDecisionSpecPinRetired(deps && deps.now)) return;
+      throw typedError(
+        "INVALID_INPUT",
+        `decision_spec_version '${DECISION_SPEC_LEGACY_VERSION}' retired at ${DECISION_SPEC_LEGACY_SUNSET}; Decision Spec ${DECISION_SPEC_VERSION} is required (preflight_mode required; analyze omits execution fields). Do not pin 1.0.`
+      );
+    }
     function deriveAnalysisOutcome({ hasDegraded, decision, breaking_changes }) {
       if (hasDegraded) return ANALYSIS_OUTCOMES.ANALYSIS_FAILED;
       if (decision !== "ALLOW" || (breaking_changes || 0) > 0) return ANALYSIS_OUTCOMES.BREAKS_DETECTED;
@@ -210907,7 +211159,7 @@ var require_change_set = __commonJS({
         if (legacy) return { mode: "analyze", defaulted: true };
         throw typedError(
           "INVALID_INPUT",
-          "preflight_mode is required: 'analyze' (informational risk only) or 'authorize' (operation-bound; may mint a receipt). Migration: pass preflight_mode explicitly. For 30-day legacy (soft-default + old analyze shape) send decision_spec_version: '1.0'."
+          "preflight_mode is required: 'analyze' (informational risk only) or 'authorize' (operation-bound; may mint a receipt). Migration: pass preflight_mode explicitly. Decision Spec 2.0 does not soft-default the mode."
         );
       }
       if (raw === "analyze" || raw === "authorize") {
@@ -210946,6 +211198,7 @@ var require_change_set = __commonJS({
         if (seen.has(key)) throw typedError("INVALID_INPUT", `duplicate artifact (type, id): (${a.type}, ${a.id})`);
         seen.add(key);
       }
+      rejectRetiredLegacyPin(input, deps);
       const legacyPin = isLegacyDecisionSpecPin(input);
       const { mode: preflightMode, defaulted: preflightModeDefaulted } = resolvePreflightMode(input, {
         legacy: legacyPin
@@ -211516,6 +211769,7 @@ var require_change_set = __commonJS({
       resolvePreflightMode,
       deriveAnalysisOutcome,
       isLegacyDecisionSpecPin,
+      isLegacyDecisionSpecPinRetired,
       artifactSidesIdentical,
       isNoChangeBundle,
       isContractChangeTrigger,
@@ -211525,6 +211779,7 @@ var require_change_set = __commonJS({
       DECISION_SPEC_VERSION,
       DECISION_SPEC_LEGACY_VERSION,
       DECISION_SPEC_LEGACY_SUNSET,
+      DECISION_SPEC_LEGACY_SUNSET_AT_MS,
       ANALYSIS_OUTCOMES,
       MAX_ARTIFACTS,
       SUPPORTED_TYPES,
@@ -224882,17 +225137,17 @@ var require_mcp_decision_result_shape = __commonJS({
         audience: { type: ["string", "null"] },
         authority: {
           type: ["object", "null"],
-          description: "ID963 additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational \u2014 not permission, not a verify-receipt gate, not an ACL."
+          description: "Additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational \u2014 not permission, not a verify-receipt gate, not an ACL."
         },
         derivation: {
           type: ["object", "null"],
-          description: 'ID637 6b additive. Present only when derivation:"server" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.'
+          description: 'Additive. Present only when derivation:"server" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.'
         },
         receipt: { type: "object" },
         expires_at: { type: "string" },
         blast_radius: {
           type: "object",
-          description: "ID27 additive COUNTS (not a score). Not permission.",
+          description: "Additive COUNTS (not a score). Not permission.",
           properties: {
             endpoints: { type: "integer", minimum: 0 },
             fields: { type: "integer", minimum: 0 },
@@ -225031,7 +225286,7 @@ var require_mcp_preflight_output_schema = __commonJS({
               },
               "detected_patterns": {
                 "type": "array",
-                "description": "GOVERNANCE detector detail rows (src/change-patterns.js; validated by decision-spec-fields.js). Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names \u2286 patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.",
+                "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names \u2286 patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.",
                 "items": {
                   "type": "object",
                   "additionalProperties": false,
@@ -225081,7 +225336,7 @@ var require_mcp_preflight_output_schema = __commonJS({
               },
               "breaking_changes_details": {
                 "type": "array",
-                "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).",
+                "description": "Per-change IR/detail rows, mapped from the engine's change IR. Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).",
                 "items": {
                   "type": "object",
                   "additionalProperties": true,
@@ -225110,7 +225365,7 @@ var require_mcp_preflight_output_schema = __commonJS({
               },
               "severity_summary": {
                 "type": "object",
-                "description": "Bundle severity axes (src/change-set.js severity_summary). Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.",
+                "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.",
                 "additionalProperties": false,
                 "properties": {
                   "diff_severity": {
@@ -225133,7 +225388,7 @@ var require_mcp_preflight_output_schema = __commonJS({
               "decision_basis": {},
               "analysis": {
                 "type": "object",
-                "description": "Tier-2 analysis mirror (src/response-envelope.js buildAnalysisTier / attachControlSurface). Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED from ANALYSIS_TIER_FIELDS + remediations by scripts/generate-analysis-tier-schema.js \u2014 do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input \u2014 a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.",
+                "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED \u2014 do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input \u2014 a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.",
                 "properties": {
                   "breaking_changes": {
                     "type": "integer"
@@ -225260,7 +225515,7 @@ var require_mcp_preflight_output_schema = __commonJS({
               },
               "human_report": {
                 "type": "object",
-                "description": "Human-readable report tier (src/response-envelope.js buildHumanReport / analyze v2 stub). Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.",
+                "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.",
                 "additionalProperties": false,
                 "properties": {
                   "summary": {
@@ -225320,7 +225575,7 @@ var require_mcp_preflight_output_schema = __commonJS({
               "blast_radius": {
                 "type": "object",
                 "additionalProperties": false,
-                "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.",
+                "description": "Additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.",
                 "required": [
                   "endpoints",
                   "fields",
@@ -225485,7 +225740,7 @@ var require_mcp_preflight_output_schema = __commonJS({
               },
               "detected_patterns": {
                 "type": "array",
-                "description": "GOVERNANCE detector detail rows (src/change-patterns.js; validated by decision-spec-fields.js). Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names \u2286 patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.",
+                "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names \u2286 patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.",
                 "items": {
                   "type": "object",
                   "additionalProperties": false,
@@ -225535,7 +225790,7 @@ var require_mcp_preflight_output_schema = __commonJS({
               },
               "breaking_changes_details": {
                 "type": "array",
-                "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).",
+                "description": "Per-change IR/detail rows, mapped from the engine's change IR. Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).",
                 "items": {
                   "type": "object",
                   "additionalProperties": true,
@@ -225564,7 +225819,7 @@ var require_mcp_preflight_output_schema = __commonJS({
               },
               "severity_summary": {
                 "type": "object",
-                "description": "Bundle severity axes (src/change-set.js severity_summary). Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.",
+                "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.",
                 "additionalProperties": false,
                 "properties": {
                   "diff_severity": {
@@ -225587,7 +225842,7 @@ var require_mcp_preflight_output_schema = __commonJS({
               "decision_basis": {},
               "analysis": {
                 "type": "object",
-                "description": "Tier-2 analysis mirror (src/response-envelope.js buildAnalysisTier / attachControlSurface). Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED from ANALYSIS_TIER_FIELDS + remediations by scripts/generate-analysis-tier-schema.js \u2014 do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input \u2014 a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.",
+                "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED \u2014 do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input \u2014 a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.",
                 "properties": {
                   "breaking_changes": {
                     "type": "integer"
@@ -225714,7 +225969,7 @@ var require_mcp_preflight_output_schema = __commonJS({
               },
               "human_report": {
                 "type": "object",
-                "description": "Human-readable report tier (src/response-envelope.js buildHumanReport / analyze v2 stub). Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.",
+                "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.",
                 "additionalProperties": false,
                 "properties": {
                   "summary": {
@@ -225736,7 +225991,7 @@ var require_mcp_preflight_output_schema = __commonJS({
               },
               "execution_grant": {
                 "type": "string",
-                "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash. See docs/cr-exec-v1.md / docs/cr-exec-attest-v1.md."
+                "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash."
               },
               "chain_status": {
                 "type": "string"
@@ -225826,14 +226081,14 @@ var require_mcp_preflight_output_schema = __commonJS({
                       "object",
                       "null"
                     ],
-                    "description": "ID963 additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational \u2014 not permission, not a verify-receipt gate, not an ACL."
+                    "description": "Additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational \u2014 not permission, not a verify-receipt gate, not an ACL."
                   },
                   "derivation": {
                     "type": [
                       "object",
                       "null"
                     ],
-                    "description": 'ID637 6b additive. Present only when derivation:"server" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.'
+                    "description": 'Additive. Present only when derivation:"server" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.'
                   },
                   "receipt": {
                     "type": "object"
@@ -225843,7 +226098,7 @@ var require_mcp_preflight_output_schema = __commonJS({
                   },
                   "blast_radius": {
                     "type": "object",
-                    "description": "ID27 additive COUNTS (not a score). Not permission.",
+                    "description": "Additive COUNTS (not a score). Not permission.",
                     "properties": {
                       "endpoints": {
                         "type": "integer",
@@ -225921,7 +226176,7 @@ var require_mcp_preflight_output_schema = __commonJS({
               "blast_radius": {
                 "type": "object",
                 "additionalProperties": false,
-                "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.",
+                "description": "Additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.",
                 "required": [
                   "endpoints",
                   "fields",
@@ -226080,7 +226335,7 @@ var require_mcp_preflight_output_schema = __commonJS({
           },
           "detected_patterns": {
             "type": "array",
-            "description": "GOVERNANCE detector detail rows (src/change-patterns.js; validated by decision-spec-fields.js). Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names \u2286 patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.",
+            "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names \u2286 patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.",
             "items": {
               "type": "object",
               "additionalProperties": false,
@@ -226130,7 +226385,7 @@ var require_mcp_preflight_output_schema = __commonJS({
           },
           "breaking_changes_details": {
             "type": "array",
-            "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).",
+            "description": "Per-change IR/detail rows, mapped from the engine's change IR. Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).",
             "items": {
               "type": "object",
               "additionalProperties": true,
@@ -226159,7 +226414,7 @@ var require_mcp_preflight_output_schema = __commonJS({
           },
           "severity_summary": {
             "type": "object",
-            "description": "Bundle severity axes (src/change-set.js severity_summary). Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.",
+            "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.",
             "additionalProperties": false,
             "properties": {
               "diff_severity": {
@@ -226185,7 +226440,7 @@ var require_mcp_preflight_output_schema = __commonJS({
           "decision_basis": {},
           "analysis": {
             "type": "object",
-            "description": "Tier-2 analysis mirror (src/response-envelope.js buildAnalysisTier / attachControlSurface). Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED from ANALYSIS_TIER_FIELDS + remediations by scripts/generate-analysis-tier-schema.js \u2014 do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input \u2014 a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.",
+            "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED \u2014 do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input \u2014 a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.",
             "properties": {
               "breaking_changes": {
                 "type": "integer"
@@ -226312,7 +226567,7 @@ var require_mcp_preflight_output_schema = __commonJS({
           },
           "human_report": {
             "type": "object",
-            "description": "Human-readable report tier (src/response-envelope.js buildHumanReport / analyze v2 stub). Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.",
+            "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.",
             "additionalProperties": false,
             "properties": {
               "summary": {
@@ -226423,14 +226678,14 @@ var require_mcp_preflight_output_schema = __commonJS({
                   "object",
                   "null"
                 ],
-                "description": "ID963 additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational \u2014 not permission, not a verify-receipt gate, not an ACL."
+                "description": "Additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational \u2014 not permission, not a verify-receipt gate, not an ACL."
               },
               "derivation": {
                 "type": [
                   "object",
                   "null"
                 ],
-                "description": 'ID637 6b additive. Present only when derivation:"server" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.'
+                "description": 'Additive. Present only when derivation:"server" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.'
               },
               "receipt": {
                 "type": "object"
@@ -226440,7 +226695,7 @@ var require_mcp_preflight_output_schema = __commonJS({
               },
               "blast_radius": {
                 "type": "object",
-                "description": "ID27 additive COUNTS (not a score). Not permission.",
+                "description": "Additive COUNTS (not a score). Not permission.",
                 "properties": {
                   "endpoints": {
                     "type": "integer",
@@ -227336,7 +227591,7 @@ var require_mcp_streamable = __commonJS({
       });
       next();
     });
-    var DESC_PREFLIGHT_CHANGE_SET = "Use this when: a change set of contract artifacts modifies OpenAPI, GraphQL, protobuf, AsyncAPI, MCP manifests, or agent tool schemas before merge, deploy, publish, or tool registration. Do not call for documentation-only changes, static readiness scoring, or receipt verification. Use analyze for risk only; authorize requires context.operation for permission. For receipt verification use coderifts.verify_receipt instead; for details of a past decision use coderifts.get_decision_details instead.";
+    var DESC_PREFLIGHT_CHANGE_SET = 'Use this when: a change set of contract artifacts modifies OpenAPI, GraphQL, protobuf, AsyncAPI, MCP manifests, or agent tool schemas before merge, deploy, publish, or tool registration. Do not call for documentation-only changes, static readiness scoring, or receipt verification. Use analyze for risk only; authorize requires context.operation for permission. For receipt verification use coderifts.verify_receipt instead; for details of a past decision use coderifts.get_decision_details instead. Inputs: preflight_mode is required: "analyze" (risk only; no receipt, no execution_action) or "authorize" (may mint a receipt; requires context.operation \u2014 merge is not deploy is not publish). Supply exactly one artifact source: artifacts[] (1\u201320 items, each {id, type, before, after} as the FULL spec/schema text, not a path or URL; type is openapi|graphql|grpc|asyncapi|mcp_manifest|agent_tools) XOR derivation="server" (server reads GitHub Compare; needs context.repository + context.base + context.head; sending artifacts[] together is 400). Grant fields (include_execution_grant, grant_version, tenant_id, executor_id, adapter_id, target_uri, expected_state_token, state_nonce, policy_hash) apply only when preflight_mode="authorize" AND include_execution_grant=true; analyze ignores them. previous_receipt is a chain token base64url(body).base64url(signature) to LINK a prior decision \u2014 it does not re-verify; call verify_receipt for that. idempotency_key replays authorize only (24h), never analyze.';
     var DESC_VERIFY_RECEIPT = `Verify a CodeRifts signed chain-receipt you ALREADY HOLD: cryptographic
 authenticity (signature + key id), body binding, and \u2014 when lifecycle indices
 are available \u2014 whether it is currently valid authorization (not expired,
@@ -227576,23 +227831,33 @@ next_agent_step is a suggestion, not permission.`;
             properties: {
               artifacts: {
                 type: "array",
-                description: "Contract artifacts to analyze together (max 20). Each is { id, type, before, after }.",
+                description: '1\u201320 contract documents analyzed together. Each item is {id, type, before, after} where before/after are the FULL document strings (YAML/JSON/proto text), not URLs or file paths. Omit this array entirely when derivation="server".',
                 minItems: 1,
                 maxItems: 20,
                 items: {
                   type: "object",
                   properties: {
                     id: { type: "string", description: "Caller-chosen id, unique within the bundle" },
-                    type: { type: "string", enum: ["openapi", "graphql", "grpc", "asyncapi", "mcp_manifest", "agent_tools"] },
-                    before: { type: "string", description: "Prior artifact content (spec/schema/manifest) as a string" },
-                    after: { type: "string", description: "Updated artifact content as a string" }
+                    type: {
+                      type: "string",
+                      enum: ["openapi", "graphql", "grpc", "asyncapi", "mcp_manifest", "agent_tools"],
+                      description: "Artifact kind. One of openapi, graphql, grpc, asyncapi, mcp_manifest, agent_tools. Determines how before/after text is parsed. Not inferred from the filename."
+                    },
+                    before: {
+                      type: "string",
+                      description: 'The baseline document as raw text (the spec/schema/manifest body). Empty string means "no prior version" (create), not "load from disk".'
+                    },
+                    after: {
+                      type: "string",
+                      description: "The proposed document as raw text, same kind as before. Must be the bytes you intend to merge/deploy/publish, not a diff."
+                    }
                   },
                   required: ["id", "type", "before", "after"]
                 }
               },
               context: {
                 type: "object",
-                description: "Optional apply-site context folded into the bundle fingerprint. operation distinguishes merge vs deploy vs publish (and other labels); the server accepts any string for operation (change-set.js) \u2014 conventional values below.",
+                description: "Optional apply-site context folded into the bundle fingerprint. operation distinguishes merge vs deploy vs publish (and other labels); the server accepts any non-empty string; conventional values: merge, deploy, tool_call, publish. The receipt/gate must match this label.",
                 properties: {
                   // Server: context.operation is String(context.operation) with no closed enum
                   // (src/change-set.js computeBundleFingerprint / envelopeFields). Document conventional set.
@@ -227622,14 +227887,17 @@ next_agent_step is a suggestion, not permission.`;
                 // OPEN: unknown context keys are accepted (not 400) and ignored by buildChangeSet
                 // except the keys it reads. Do not set additionalProperties:false.
               },
-              previous_receipt: { type: "string", description: "Optional prior chain receipt token to link" },
+              previous_receipt: {
+                type: "string",
+                description: "Optional prior chain token to LINK this call into a receipt chain: base64url(body).base64url(signature). Linking is not verification \u2014 a linked token is not re-checked here; use verify_receipt."
+              },
               include_execution_grant: {
                 type: "boolean",
-                description: "Opt-in (authorize only). When true on allow-class authorize, the response includes a signed execution_grant (cr.exec.v1) alongside chain_receipt, or HTTP 503 SIGNER_UNAVAILABLE \u2014 never unsigned. Default false. Analyze ignores this flag. See docs/cr-exec-v1.md."
+                description: 'Authorize only. When true on an allow-class authorize, the response includes a signed execution_grant, or HTTP 503 SIGNER_UNAVAILABLE \u2014 never an unsigned grant. Default false. Analyze ignores this flag. Ignored unless preflight_mode="authorize".'
               },
               state_nonce: {
                 type: "string",
-                description: "Optional ATOMIC-profile nonce. When include_execution_grant is true, copied into the signed grant as state_nonce (a separate signed field \u2014 NOT folded into scope_hash). Absent \u2192 BEARER grant (today's default). See docs/cr-exec-v1.md."
+                description: "Authorize+grant only. Opaque nonce copied into the signed grant as its own field (not folded into scope_hash). Absent \u2192 BEARER grant. Ignored unless include_execution_grant is true."
               },
               // ── cr.exec.v2 authorize fields (1130-F1) ────────────────────────────────────────
               // DECLARED, not added: the authorize handler already reads every one of these
@@ -227643,33 +227911,33 @@ next_agent_step is a suggestion, not permission.`;
                 // 1363: JSON Schema `default` is a SINGLE static value. A date-gated default cannot
                 // be that without lying on one side of the cutoff. The 1344 mechanism (resolver +
                 // GRANT_DEFAULT_V2_DATE) is unchanged; this is the schema expression of it.
-                // 1384: the TEMPLATE here is the frozen surface constant (GRANT_VERSION_V1).
-                // visibleTools() stamps the LIVE omit-value from resolveGrantVersion so the
-                // served header is truthful on both sides of 2026-09-18. tools_sha256 hashes
-                // the frozen constant, not the live value (volatile; see toolsForSurfaceDigest).
+                // 1384: the TEMPLATE starts at GRANT_VERSION_V1. visibleTools() stamps the LIVE
+                // omit-value from resolveGrantVersion so the served header is truthful on both
+                // sides of 2026-09-18. Decision B (2026-09-18): tools_sha256 hashes the served
+                // tools[] including that live stamp — do not freeze it to v1.
                 "x-coderifts-effective-default": GRANT_VERSION_V1,
                 "x-coderifts-default-changes-at": GRANT_DEFAULT_V2_DATE,
                 description: "Grant envelope to mint when include_execution_grant is true. Omitting this yields cr.exec.v1 until " + GRANT_DEFAULT_V2_DATE + ' and cr.exec.v2 on and after it (see x-coderifts-effective-default / x-coderifts-default-changes-at). The response meta.grant_version is the version actually issued. An explicit value always wins \u2014 pin "v1" to keep current behaviour with no code change on the date.'
               },
               tenant_id: {
                 type: "string",
-                description: 'Tenant the grant is issued under (cr.exec.v2). Defaults to "default" when absent.'
+                description: 'Authorize+grant v2 only. Tenant the grant is issued under. ASCII slug. When omitted the server uses "default" \u2014 pin it if you are not on the default tenant.'
               },
               executor_id: {
                 type: "string",
-                description: "Identity of the executor the grant is bound to (cr.exec.v2)."
+                description: 'Authorize+grant v2 only. Executor identity the grant is bound to (example: agent:ci-bot, host:github-actions). Empty/absent is not "any executor".'
               },
               adapter_id: {
                 type: "string",
-                description: "Adapter the executor will apply the change with, e.g. fs, postgres, git (cr.exec.v2)."
+                description: "Authorize+grant v2 only. Adapter that will apply the change. Conventional values: fs, postgres, git. Must match the adapter the executor actually uses; a git grant does not authorize an fs write."
               },
               target_uri: {
                 type: "string",
-                description: "Target the grant is bound to (cr.exec.v2). Falls back to context.target_uri, then to a repository/head-derived value."
+                description: "Authorize+grant v2 only. URI the grant binds (example: git://owner/repo.git/refs/heads/main). Fallback if omitted: context.target_uri, then repository/head-derived. Distinct from context.target_id."
               },
               expected_state_token: {
                 type: "string",
-                description: "State token the executor expects to observe at apply time (cr.exec.v2). Signed as a separate field; empty string when absent."
+                description: 'Authorize+grant v2 only. Compare-and-swap token the executor must observe at apply time (the "before" state). Signed as its own field. Omit only if the adapter has no prior state; do not send a placeholder.'
               },
               audience: {
                 type: "string",
@@ -227677,25 +227945,25 @@ next_agent_step is a suggestion, not permission.`;
               },
               policy_hash: {
                 type: "string",
-                description: "Policy identity the grant is issued under (cr.exec.v2). Bound into the signed grant when supplied."
+                description: "Authorize+grant v2 only. Policy identity bound into the grant, sha256: + 64 hex. When supplied, apply must use that same policy; a different policy is a different grant."
               },
               idempotency_key: { type: "string", description: "Optional client key; in authorize mode, a repeat with the same key + body replays the original decision (24h). Analyze responses are not replayed." },
               // TOP-LEVEL (not context). Decision Spec 2.0: REQUIRED on every call.
-              // Omitted without decision_spec_version:'1.0' legacy pin → INVALID_INPUT 400.
+              // Omission → INVALID_INPUT 400. The 1.0 legacy pin retired at DECISION_SPEC_LEGACY_SUNSET.
               preflight_mode: {
                 type: "string",
                 enum: ["analyze", "authorize"],
-                description: `REQUIRED. "analyze" = informational risk only (no decision/execution_action/safe_for_agent; analysis_outcome + may_execute:false). "authorize" = operation-bound path; may mint a receipt (requires context.operation). Decision Spec 2.0: omission is an error unless decision_spec_version is '1.0' (30-day legacy pin with soft-default analyze).`
+                description: 'REQUIRED. "analyze" = informational risk only (no decision/execution_action/safe_for_agent; analysis_outcome + may_execute:false). "authorize" = operation-bound path; may mint a receipt (requires context.operation). Decision Spec 2.0: omission is INVALID_INPUT. Do not pin 1.0 \u2014 that pin retired.'
               },
               decision_spec_version: {
                 type: "string",
-                enum: ["1.0", "2.0"],
-                description: "Optional pin. '1.0' = legacy contract (soft-default mode + analyze still carries decision/execution_action) until the sunset date. Omit or '2.0' = current contract."
+                enum: ["2.0"],
+                description: "Optional. Omit or '2.0' = current contract. '1.0' retired (INVALID_INPUT); do not pin 1.0."
               },
               derivation: {
                 type: "string",
                 enum: ["server"],
-                description: `Opt-in (ID637 6b). "server" = the server derives artifacts[] from GitHub Compare via the App installation. Allowed only when the tenant has a proven binding for context.repository and context.base + context.head are present. Omit artifacts[] (caller-supplied artifacts[] with this flag is 400 \u2014 one source of truth). Default absent = today's caller-artifacts path (byte-identical).`
+                description: '"server" = the server derives artifacts[] from GitHub Compare via the App installation. Allowed only when context.repository, context.base and context.head are all present and the tenant has a proven binding for that repository. Do not send artifacts[] in the same call (400 \u2014 one source of truth). Omit this field for the caller-supplied artifacts[] path.'
               }
             },
             // artifacts is NOT in required: derivation:"server" omits it (server lists the set).
@@ -227795,7 +228063,7 @@ next_agent_step is a suggestion, not permission.`;
             enum: RECEIPT_STATUSES.slice()
           },
           reason: { type: ["string", "null"] },
-          correlation_id: { type: "string", description: "Route-owned trace id (ID828); always a non-empty string on 200" },
+          correlation_id: { type: "string", description: "Route-owned trace id, set by the route itself rather than by correlation middleware; always a non-empty string on 200" },
           payload: { type: "object" },
           // Authorization layer (§106): signature-valid ≠ currently-authorized.
           // null means authorization could NOT be evaluated (missing intended context and/or
@@ -228316,9 +228584,12 @@ var require_generate_surface_anchor = __commonJS({
     var OUT = path.join(__dirname, "..", "src", "generated", "surface-anchor.json");
     var ENDPOINT = "https://app.coderifts.com/mcp";
     var VOLATILE_KEYS = Object.freeze([]);
-    var SOURCE_REF = "https://raw.githubusercontent.com/coderifts/api-governance/surface-dc86678e/tools.wire.v1.json";
-    var SOURCE_REF_COMMIT = "e0a9ae6fabef489c7f0f13714396add51519c195";
-    var SOURCE_REF_STATUS = `PINNED TO ONE REVISION. source_ref is the wire-format tools[] as served, published in the public coderifts/api-governance repo at tag surface-dc86678e (commit ${SOURCE_REF_COMMIT}). Verified at fill time: the file's own tools_sha256, its tools[] recomputed under the canonical rule in digest_input, and this anchor's tools_sha256 are the same value. HOW TO USE IT: fetch it, recompute the digest yourself, and compare it to tools_sha256 here. IF THEY DIFFER, TRUST NEITHER -- it means the surface moved and this ref was not re-tagged. A tag can be force-moved; the commit SHA above cannot, so pin the SHA URL if you want the stronger form. OUR OBLIGATION: every surface change requires a NEW tag and a NEW source_ref in this file. Skipping that leaves this field pointing at an old surface while still looking authoritative, which is worse than the null it replaced. HOW THE OBLIGATION IS ENFORCED, on both sides: this repo CI-runs generate-surface-anchor.js --check --verify-source-ref, which fetches the ref above, recomputes its digest under the rule in digest_input, and FAILS if it is stale, self-inconsistent, or its tag is gone. The target repo runs scripts/validate-tools-wire.mjs from its own npm test and a CI workflow -- on push, on PR, and daily, because the wire target can go stale without anything in that repo changing. Both SKIP LOUDLY rather than fail on a transport error, and both treat a 404 as a real verdict rather than a network problem. Neither this ref nor those gates is a root of trust: pin the digest at YOUR approval time -- see honesty.pin_at_approval_time.`;
+    var SOURCE_REF = "https://raw.githubusercontent.com/coderifts/api-governance/surface-497eb029/tools.wire.v1.json";
+    var SOURCE_REF_COMMIT = "0ef58c28475fe1b85dc363da9a95bf566fca4587";
+    var SOURCE_REF_TAG = (SOURCE_REF.match(/\/api-governance\/([^/]+)\//) || [])[1] || "(unknown tag)";
+    var SOURCE_REF_IS_PINNED = /^[0-9a-f]{40}$/.test(SOURCE_REF_COMMIT);
+    var SOURCE_REF_STATUS_OPENING = SOURCE_REF_IS_PINNED ? `PINNED TO ONE REVISION. source_ref is the wire-format tools[] as served, published in the public coderifts/api-governance repo at tag ${SOURCE_REF_TAG} (commit ${SOURCE_REF_COMMIT}). Verified at fill time: the file's own tools_sha256, its tools[] recomputed under the canonical rule in digest_input, and this anchor's tools_sha256 are the same value. ` : `NOT YET PINNED -- THE TAG DOES NOT EXIST YET. source_ref is the wire-format tools[] as served, to be published in the public coderifts/api-governance repo at tag ${SOURCE_REF_TAG} (commit ${SOURCE_REF_COMMIT}). Until that tag is pushed this URL 404s, and --verify-source-ref FAILS on it deliberately: a 404 here is the obligation below being unmet, not a network problem. Once it is pushed, verify at fill time that the file's own tools_sha256, its tools[] recomputed under the canonical rule in digest_input, and this anchor's tools_sha256 are the same value. `;
+    var SOURCE_REF_STATUS = SOURCE_REF_STATUS_OPENING + "HOW TO USE IT: fetch it, recompute the digest yourself, and compare it to tools_sha256 here. IF THEY DIFFER, TRUST NEITHER -- it means the surface moved and this ref was not re-tagged. A tag can be force-moved; the commit SHA above cannot, so pin the SHA URL if you want the stronger form. OUR OBLIGATION: every surface change requires a NEW tag and a NEW source_ref in this file. Skipping that leaves this field pointing at an old surface while still looking authoritative, which is worse than the null it replaced. HOW THE OBLIGATION IS ENFORCED, on both sides: this repo CI-runs generate-surface-anchor.js --check --verify-source-ref, which fetches the ref above, recomputes its digest under the rule in digest_input, and FAILS if it is stale, self-inconsistent, or its tag is gone. The target repo runs scripts/validate-tools-wire.mjs from its own npm test and a CI workflow -- on push, on PR, and daily, because the wire target can go stale without anything in that repo changing. Both SKIP LOUDLY rather than fail on a transport error, and both treat a 404 as a real verdict rather than a network problem. Neither this ref nor those gates is a root of trust: pin the digest at YOUR approval time -- see honesty.pin_at_approval_time.";
     var HONESTY = Object.freeze({
       pins_bytes_not_behaviour: "This anchor pins BYTES, not behaviour. It says the tool text you received is the text that was published. It says nothing about whether the model read it, understood it, or obeyed it.",
       scoped_to_its_profile: "This digest is scoped to the profile named above and to nothing else. The default-profile digest says NOTHING about the surface served with include_advanced_tools, which is a different tool set with a different digest. A hash without its profile does not identify a surface.",
@@ -228337,10 +228608,25 @@ var require_generate_surface_anchor = __commonJS({
       }
       return v;
     }
+    var lastDigestTools = null;
+    function buildWire(opts = {}) {
+      const anchor = buildAnchor(opts);
+      const doc = {
+        schema: "coderifts.tools-wire.v1",
+        tool_count: anchor.tool_count,
+        tools_sha256: anchor.tools_sha256,
+        tools: lastDigestTools
+      };
+      const recomputed = `sha256:${crypto.createHash("sha256").update(canonicalJson(doc.tools), "utf8").digest("hex")}`;
+      if (recomputed !== doc.tools_sha256) {
+        throw new Error(`buildWire: emitted tools[] hashes to ${recomputed} but the anchor says ${doc.tools_sha256} \u2014 the wire file would be self-inconsistent`);
+      }
+      return doc;
+    }
     function buildAnchor(opts = {}) {
       const includeAdvanced = opts.includeAdvanced === true;
       const tools = mcp.visibleTools({ includeAdvanced, now: opts.now });
-      const digestTools = typeof mcp.toolsForSurfaceDigest === "function" ? mcp.toolsForSurfaceDigest(tools) : tools;
+      const digestTools = tools;
       const profile = buildRequestProfile({
         endpoint: ENDPOINT,
         method: "tools/list",
@@ -228348,11 +228634,12 @@ var require_generate_surface_anchor = __commonJS({
         params: includeAdvanced ? { include_advanced_tools: true } : {}
       });
       const digest = crypto.createHash("sha256").update(canonicalJson(digestTools), "utf8").digest("hex");
+      lastDigestTools = digestTools;
       return {
         profile,
         tools_sha256: `sha256:${digest}`,
         tool_count: tools.length,
-        digest_input: "sha256 over the canonical JSON of the served tools[]: object keys sorted lexicographically at every depth (arrays keep order), no whitespace, RAW UTF-8 with no \\uXXXX escaping. Python consumers must pass ensure_ascii=False -- the default escapes the 58 non-ASCII characters in this surface and produces a different digest over identical data.",
+        digest_input: "sha256 over the canonical JSON of the served tools[] AS RETURNED by tools/list (including x-coderifts-effective-default at hash time \u2014 do not freeze it to v1): object keys sorted lexicographically at every depth (arrays keep order), no whitespace, RAW UTF-8 with no \\uXXXX escaping. Python consumers must pass ensure_ascii=False -- the default escapes the 58 non-ASCII characters in this surface and produces a different digest over identical data.",
         source_ref: SOURCE_REF,
         // Machine-readable, so a consumer can pin the immutable form without parsing the prose above.
         source_ref_commit: SOURCE_REF_COMMIT,
@@ -228438,6 +228725,25 @@ var require_generate_surface_anchor = __commonJS({
       const check = argv.includes("--check");
       const verifyRef = argv.includes("--verify-source-ref");
       const anchor = buildAnchor();
+      if (argv.includes("--emit-wire")) {
+        const bytes = `${JSON.stringify(buildWire(), null, 2)}
+`;
+        const i = argv.indexOf("--out");
+        const out = i >= 0 ? argv[i + 1] : null;
+        if (i >= 0 && !out) {
+          process.stderr.write("--out needs a path\n");
+          process.exitCode = 1;
+          return;
+        }
+        if (out) {
+          fs.writeFileSync(out, bytes);
+          process.stderr.write(`wire written: ${out} (${buildWire().tool_count} tools, ${buildWire().tools_sha256})
+`);
+          return;
+        }
+        process.stdout.write(bytes);
+        return;
+      }
       if (verifyRef) {
         const r = await verifySourceRef(anchor);
         if (r.ok) {
@@ -228503,7 +228809,7 @@ var require_generate_surface_anchor = __commonJS({
         process.exit(1);
       });
     }
-    module2.exports = { buildAnchor, runCheck, verifySourceRef, canonicalJson, derived, derivedJson, VOLATILE_KEYS, HONESTY, OUT };
+    module2.exports = { buildAnchor, buildWire, runCheck, verifySourceRef, canonicalJson, derived, derivedJson, VOLATILE_KEYS, HONESTY, OUT };
   }
 });
 
@@ -233561,13 +233867,14 @@ ${HOOK_MARKER}
 #
 # Re-install after CLI upgrades: coderifts hook install
 #
-# Exit map (fail-closed when configured):
-#   CODERIFTS_SKIP=1          \u2192 exit 0 (explicit loud override)
-#   no apiKey                 \u2192 exit 0 soft (not configured)
-#   BLOCK / STOP / UNKNOWN    \u2192 exit 1
+# Exit map (fail-closed when the hook is installed):
+#   CODERIFTS_SKIP=1                 \u2192 exit 0 (explicit loud override)
+#   no key + CODERIFTS_ADVISORY=1|true \u2192 exit 0 (explicit opt-out; same flag as claude-hook)
+#   no key                           \u2192 exit 1 named (absence is not permission)
+#   BLOCK / STOP / UNKNOWN           \u2192 exit 1
 #   INDETERMINATE (no decision obtainable) \u2192 exit 1
-#   ALLOW / analysis clean    \u2192 exit 0
-#   REQUIRE_APPROVAL / WARN   \u2192 warn, exit 0
+#   ALLOW / analysis clean           \u2192 exit 0
+#   REQUIRE_APPROVAL / WARN          \u2192 warn, exit 0
 
 # Explicit escape hatch \u2014 never the default on error; human must set this.
 if [ "\${CODERIFTS_SKIP:-}" = "1" ]; then
@@ -233575,13 +233882,23 @@ if [ "\${CODERIFTS_SKIP:-}" = "1" ]; then
   exit 0
 fi
 
-CODERIFTS_API_KEY=$(git config coderifts.apiKey)
+# git config wins when set. Do not clobber a process-env CODERIFTS_API_KEY with empty config.
+_CR_GIT_KEY=$(git config --get coderifts.apiKey 2>/dev/null || true)
+if [ -n "$_CR_GIT_KEY" ]; then
+  CODERIFTS_API_KEY="$_CR_GIT_KEY"
+fi
 SPEC_PATH=$(git config coderifts.specPath || echo "api/openapi.yaml")
 ZERO="0000000000000000000000000000000000000000"
 
-if [ -z "$CODERIFTS_API_KEY" ]; then
-  echo "CodeRifts: No API key configured. Run: git config coderifts.apiKey <your-key>"
-  exit 0  # Don't block if not configured
+if [ -z "\${CODERIFTS_API_KEY:-}" ]; then
+  case "\${CODERIFTS_ADVISORY:-}" in
+    1|true|TRUE)
+      echo "CodeRifts: no API key \u2014 allowing push (CODERIFTS_ADVISORY). This is explicit opt-out, not a missing-key default. Set git config coderifts.apiKey or CODERIFTS_API_KEY to enforce." >&2
+      exit 0
+      ;;
+  esac
+  echo "CodeRifts: this hook guards the push and cannot ask for a decision without an API key. Absence of a key is not permission. Set git config coderifts.apiKey <key> or export CODERIFTS_API_KEY. To allow without governance, set CODERIFTS_ADVISORY=1 (explicit opt-out) or CODERIFTS_SKIP=1 / git push --no-verify." >&2
+  exit 1
 fi
 
 # --- helpers: three-state git blob read (present | absent | error) ---
@@ -234034,8 +234351,10 @@ exit 0
       fs.writeFileSync(hookPath, PRE_PUSH_SCRIPT, { mode: 493 });
       console.log("CodeRifts pre-push hook installed.");
       console.log("");
-      console.log("Configure your API key:");
-      console.log("  git config coderifts.apiKey <your-key>");
+      console.log("This hook guards the push. Absence of a key is not permission.");
+      console.log("Set a key (git config coderifts.apiKey <your-key> or CODERIFTS_API_KEY)");
+      console.log("or the next push exits 1. Explicit opt-out: CODERIFTS_ADVISORY=1.");
+      console.log("Loud skip: CODERIFTS_SKIP=1 (or git push --no-verify).");
       console.log("");
       console.log("Optionally set spec path (default: api/openapi.yaml):");
       console.log("  git config coderifts.specPath path/to/openapi.yaml");
@@ -263459,6 +263778,212 @@ ${USAGE}` };
   }
 });
 
+// ../../src/core/mcp-lock-drift.js
+var require_mcp_lock_drift = __commonJS({
+  "../../src/core/mcp-lock-drift.js"(exports2, module2) {
+    "use strict";
+    var crypto = require("crypto");
+    var { scoreMcpRisk, SIGNAL_CATALOG } = require_mcp_risk_scorer();
+    function normalizeMcpManifest(input) {
+      if (input == null) return null;
+      if (Array.isArray(input)) {
+        return { tools: input.filter((t) => t && typeof t === "object") };
+      }
+      if (typeof input !== "object") return null;
+      if (Array.isArray(input.tools)) {
+        return { tools: input.tools.filter((t) => t && typeof t === "object") };
+      }
+      if (input.manifest && typeof input.manifest === "object") {
+        return normalizeMcpManifest(input.manifest);
+      }
+      if (input.server && typeof input.server === "object" && Array.isArray(input.server.tools)) {
+        return { tools: input.server.tools.filter((t) => t && typeof t === "object") };
+      }
+      if (typeof input.name === "string" && (input.inputSchema || input.description != null)) {
+        return { tools: [input] };
+      }
+      return null;
+    }
+    function manifestContentHash(manifest) {
+      if (!manifest || !Array.isArray(manifest.tools)) return null;
+      const tools = manifest.tools.map((t) => ({
+        name: t && t.name != null ? String(t.name) : "",
+        description: t && t.description != null ? String(t.description) : "",
+        inputSchema: t && t.inputSchema != null ? t.inputSchema : null,
+        // scopes / annotations if present
+        annotations: t && t.annotations != null ? t.annotations : null
+      })).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+      const material = JSON.stringify(tools);
+      return `sha256:${crypto.createHash("sha256").update(material).digest("hex")}`;
+    }
+    function extractLockedManifestsFromLock(lockDoc) {
+      if (!lockDoc || typeof lockDoc !== "object") return [];
+      const out = [];
+      if (Array.isArray(lockDoc.mcp_manifests)) {
+        lockDoc.mcp_manifests.forEach((entry, i) => {
+          if (!entry) return;
+          const raw = entry.manifest != null ? entry.manifest : entry;
+          const m = normalizeMcpManifest(raw);
+          if (m) {
+            out.push({
+              id: entry.id != null ? String(entry.id) : `mcp_manifests[${i}]`,
+              manifest: m
+            });
+          }
+        });
+      }
+      if (Array.isArray(lockDoc.mcp_servers)) {
+        lockDoc.mcp_servers.forEach((entry, i) => {
+          if (!entry) return;
+          const m = normalizeMcpManifest(entry.manifest != null ? entry.manifest : entry);
+          if (m) {
+            out.push({
+              id: (entry.id || entry.name) != null ? String(entry.id || entry.name) : `mcp_servers[${i}]`,
+              manifest: m
+            });
+          }
+        });
+      }
+      if (lockDoc.locked_mcp_manifest) {
+        const m = normalizeMcpManifest(lockDoc.locked_mcp_manifest);
+        if (m) out.push({ id: "locked_mcp_manifest", manifest: m });
+      }
+      return out;
+    }
+    function buildLockDrift(args = {}) {
+      const serverId = args.serverId != null ? String(args.serverId) : "default";
+      if (args.liveUnreachable === true) {
+        return {
+          status: "unreachable",
+          drift: false,
+          // honest: unknown, not drifted
+          server_id: serverId,
+          locked_hash: manifestContentHash(normalizeMcpManifest(args.lockedManifest)),
+          live_hash: null,
+          risk_score: null,
+          level: null,
+          signals: [],
+          findings: [],
+          summary: "Live MCP manifest unreachable \u2014 not scored as drift and not claimed unchanged (absence_is_unknown).",
+          live_error: args.liveError != null ? String(args.liveError).slice(0, 300) : null,
+          interpretation: "absence_is_unknown",
+          note: "Drift is a scored finding of measurable change, not an accusation of intent. Unreachable \u2260 drifted. Monitor only \u2014 does not block.",
+          scorer: "scoreMcpRisk"
+        };
+      }
+      const locked = normalizeMcpManifest(args.lockedManifest);
+      const live = normalizeMcpManifest(args.liveManifest);
+      if (!locked) {
+        return {
+          status: "missing_locked",
+          drift: false,
+          server_id: serverId,
+          locked_hash: null,
+          live_hash: manifestContentHash(live),
+          risk_score: null,
+          level: null,
+          signals: [],
+          findings: [],
+          summary: "No locked MCP manifest supplied \u2014 cannot compute drift (not a clean bill of health).",
+          interpretation: "absence_is_unknown",
+          note: "coderifts.lock v1 records observed agents/ops, not MCP tool bodies; pass --locked-manifest or additive lock mcp_manifests.",
+          scorer: "scoreMcpRisk"
+        };
+      }
+      if (!live) {
+        return {
+          status: "missing_live",
+          drift: false,
+          server_id: serverId,
+          locked_hash: manifestContentHash(locked),
+          live_hash: null,
+          risk_score: null,
+          level: null,
+          signals: [],
+          findings: [],
+          summary: "No live MCP manifest supplied \u2014 cannot compute drift (absence_is_unknown).",
+          interpretation: "absence_is_unknown",
+          note: "Provide --live-manifest or --live-url. Unreachable fetches use status unreachable.",
+          scorer: "scoreMcpRisk"
+        };
+      }
+      const scored = scoreMcpRisk({
+        oldManifest: locked,
+        newManifest: live
+      });
+      const locked_hash = manifestContentHash(locked);
+      const live_hash = manifestContentHash(live);
+      const hashDiffers = locked_hash != null && live_hash != null && locked_hash !== live_hash;
+      const scoredDrift = (scored.score || 0) > 0;
+      const isDrift = hashDiffers || scoredDrift;
+      const unclassified = hashDiffers && !scoredDrift;
+      const findings = (scored.signals || []).filter((s) => s && (s.impact == null || Number(s.impact) > 0)).map((s) => ({
+        signal: s.signal,
+        impact: s.impact,
+        detail: s.detail,
+        data: s.data || null,
+        // Honest framing: finding, not accusation
+        kind: "measurable_change"
+      }));
+      findings.sort((a, b) => {
+        const sa = String(a.signal || "");
+        const sb = String(b.signal || "");
+        if (sa !== sb) return sa < sb ? -1 : 1;
+        return String(a.detail || "").localeCompare(String(b.detail || ""));
+      });
+      return {
+        status: isDrift ? "drift" : "unchanged",
+        drift: isDrift,
+        server_id: serverId,
+        locked_hash,
+        live_hash,
+        hash_differs: hashDiffers,
+        risk_score: scored.score,
+        level: scored.level,
+        signals: scored.signals || [],
+        findings,
+        unclassified_change: unclassified,
+        summary: unclassified ? "MCP manifest DIFFERS from the locked baseline (content hashes disagree), but no catalogued risk signal explains the difference. Treated as drift: an unrecognised change is still a change. Compare the manifests directly \u2014 the signal catalog is not exhaustive." : isDrift ? scored.summary || "MCP manifest differs from locked baseline (scored finding)." : "Live MCP manifest matches locked baseline under mcp-risk-scorer (no risk signals).",
+        interpretation: "number_is_what_is",
+        note: "Drift is a scored FINDING of measurable change (tool_removed, schema change, \u2026), not an accusation of poison vs legitimate update. Monitor only \u2014 does not block. Scoring: scoreMcpRisk (existing SIGNAL_CATALOG; no reimplemented weights).",
+        scorer: "scoreMcpRisk",
+        signal_catalog_version: "mcp-risk-scorer"
+      };
+    }
+    function buildLockDriftReport(pairs) {
+      const list = Array.isArray(pairs) ? pairs : [];
+      const results = list.map((p, i) => buildLockDrift({
+        ...p,
+        serverId: p.serverId != null ? p.serverId : `server_${i}`
+      })).sort((a, b) => String(a.server_id).localeCompare(String(b.server_id)));
+      const anyDrift = results.some((r) => r.drift === true);
+      const anyUnreachable = results.some((r) => r.status === "unreachable");
+      const maxScore = results.reduce((m, r) => {
+        if (r.risk_score == null || !Number.isFinite(r.risk_score)) return m;
+        return Math.max(m, r.risk_score);
+      }, 0);
+      return {
+        status: anyUnreachable && !anyDrift ? results.every((r) => r.status === "unreachable") ? "unreachable" : "partial" : anyDrift ? "drift" : "unchanged",
+        drift: anyDrift,
+        max_risk_score: maxScore,
+        servers: results,
+        summary: anyDrift ? `MCP lock drift on ${results.filter((r) => r.drift).length}/${results.length} server(s); max risk ${maxScore}.` : anyUnreachable ? "No scored drift; one or more live manifests unreachable (absence_is_unknown)." : "No MCP lock drift detected under scoreMcpRisk.",
+        interpretation: "number_is_what_is",
+        note: "Monitor report only. Existing poison-gate / policy engine remain the blockers. Unreachable is never treated as clean or as drift."
+      };
+    }
+    module2.exports = {
+      buildLockDrift,
+      buildLockDriftReport,
+      normalizeMcpManifest,
+      manifestContentHash,
+      extractLockedManifestsFromLock,
+      SIGNAL_CATALOG
+      // re-export for tests asserting reuse
+    };
+  }
+});
+
 // src/commands/lock.js
 var require_lock = __commonJS({
   "src/commands/lock.js"(exports2, module2) {
@@ -263523,6 +264048,7 @@ var require_lock = __commonJS({
       return `${JSON.stringify(doc, null, 2)}
 `;
     }
+    var mcpLockDrift = require_mcp_lock_drift();
     function loadDriftCore(deps = {}) {
       if (deps.buildLockDrift) {
         return {
@@ -263531,21 +264057,7 @@ var require_lock = __commonJS({
           extractLockedManifestsFromLock: deps.extractLockedManifestsFromLock
         };
       }
-      const candidates = [
-        path.join(__dirname, "../../../../src/core/mcp-lock-drift"),
-        path.join(__dirname, "../../../src/core/mcp-lock-drift")
-      ];
-      for (const c of candidates) {
-        try {
-          return require(c);
-        } catch (_) {
-        }
-      }
-      const err = new Error(
-        "Cannot load mcp-lock-drift core. Run from the coderifts-app monorepo (packages/cli expects ../../../../src/core/mcp-lock-drift)."
-      );
-      err.code = "CORE_UNAVAILABLE";
-      throw err;
+      return mcpLockDrift;
     }
     function readJsonFile(filePath) {
       const raw = fs.readFileSync(filePath, "utf8");
@@ -263819,6 +264331,176 @@ var require_lock = __commonJS({
   }
 });
 
+// ../../src/core/counterfactual-adopt.js
+var require_counterfactual_adopt = __commonJS({
+  "../../src/core/counterfactual-adopt.js"(exports2, module2) {
+    "use strict";
+    var { analyzeSpecs } = require_analyzer();
+    var SCOPE_NOTE = "COUNTERFACTUAL only: each row is what analyzeSpecs would have returned on the supplied before\u2192after content. It does not assert the change was actually harmful, and Step A does not join real decision_outcomes (outcome correlation is Step B).";
+    function mapDecision(result) {
+      if (!result || typeof result !== "object") return "REQUIRE_APPROVAL";
+      const od = result.omega_decision;
+      if (od === "ALLOW" || od === "WARN" || od === "REQUIRE_APPROVAL" || od === "BLOCK") {
+        return od;
+      }
+      if (result.should_block === true) return "BLOCK";
+      const pats = Array.isArray(result.detected_patterns) ? result.detected_patterns : [];
+      if (pats.some((p) => p && (p.severity === "CRITICAL" || p.severity === "HIGH"))) {
+        return "BLOCK";
+      }
+      const breaking = result.breaking_changes;
+      const n = Array.isArray(breaking) ? breaking.length : typeof breaking === "number" ? breaking : 0;
+      if (n > 0) return "REQUIRE_APPROVAL";
+      return "ALLOW";
+    }
+    function mapExecutionAction(decision) {
+      if (decision === "BLOCK") return "STOP";
+      if (decision === "REQUIRE_APPROVAL") return "REQUEST_APPROVAL";
+      if (decision === "WARN") return "CONTINUE_WITH_MONITORING";
+      return "CONTINUE";
+    }
+    function extractDetectors(result) {
+      const pats = Array.isArray(result && result.detected_patterns) ? result.detected_patterns : [];
+      const out = [];
+      for (const p of pats) {
+        if (!p || typeof p !== "object") continue;
+        const id = p.name || p.id || p.type;
+        if (!id) continue;
+        out.push({
+          id: String(id),
+          severity: p.severity != null ? String(p.severity) : "UNKNOWN"
+        });
+      }
+      return out;
+    }
+    async function buildCounterfactualReport(changeSets, config = {}) {
+      if (!Array.isArray(changeSets) || changeSets.length === 0) {
+        return {
+          change_sets: [],
+          per_detector: [],
+          scope_note: SCOPE_NOTE,
+          interpretation: "absence_is_unknown",
+          summary: {
+            change_set_count: 0,
+            would_stop: 0,
+            would_request_approval: 0,
+            would_continue: 0,
+            note: 'No contract-artifact change sets supplied \u2014 empty is UNKNOWN, not "clean".'
+          }
+        };
+      }
+      const rows = [];
+      const detectorMap = /* @__PURE__ */ new Map();
+      for (const cs of changeSets) {
+        const ref = cs && (cs.ref || cs.sha) || null;
+        const date = cs && cs.date || null;
+        const path = cs && cs.path || null;
+        const before = cs && cs.before_spec != null ? String(cs.before_spec) : "";
+        const after = cs && cs.after_spec != null ? String(cs.after_spec) : "";
+        let result;
+        let error = null;
+        try {
+          result = await analyzeSpecs(before, after, config || {});
+        } catch (err) {
+          error = {
+            code: err && err.code ? String(err.code) : "analyze_error",
+            message: err && err.message ? String(err.message).slice(0, 300) : "analyzeSpecs failed"
+          };
+          result = null;
+        }
+        if (!result) {
+          rows.push({
+            ref,
+            date,
+            path,
+            decision: null,
+            execution_action: null,
+            risk_score: null,
+            detectors_fired: [],
+            would_have: null,
+            error,
+            counterfactual: true
+          });
+          continue;
+        }
+        const decision = mapDecision(result);
+        const execution_action = mapExecutionAction(decision);
+        const risk_score = result.risk_score != null && Number.isFinite(Number(result.risk_score)) ? Number(result.risk_score) : null;
+        const detectors_fired = extractDetectors(result);
+        for (const d of detectors_fired) {
+          const prev = detectorMap.get(d.id);
+          if (!prev) {
+            detectorMap.set(d.id, { id: d.id, severity: d.severity, fire_count: 1 });
+          } else {
+            prev.fire_count += 1;
+            prev.severity = worseSeverity(prev.severity, d.severity);
+          }
+        }
+        rows.push({
+          ref,
+          date,
+          path,
+          decision,
+          execution_action,
+          risk_score,
+          detectors_fired,
+          would_have: {
+            decision,
+            execution_action,
+            risk_score
+          },
+          error: null,
+          counterfactual: true
+        });
+      }
+      const per_detector = [...detectorMap.values()].sort((a, b) => b.fire_count - a.fire_count || a.id.localeCompare(b.id));
+      let would_stop = 0;
+      let would_request_approval = 0;
+      let would_continue = 0;
+      for (const r of rows) {
+        if (r.execution_action === "STOP") would_stop += 1;
+        else if (r.execution_action === "REQUEST_APPROVAL") would_request_approval += 1;
+        else if (r.execution_action === "CONTINUE" || r.execution_action === "CONTINUE_WITH_MONITORING") {
+          would_continue += 1;
+        }
+      }
+      return {
+        change_sets: rows,
+        per_detector,
+        scope_note: SCOPE_NOTE,
+        interpretation: "counterfactual_observed",
+        summary: {
+          change_set_count: rows.length,
+          would_stop,
+          would_request_approval,
+          would_continue,
+          note: "Per-detector fire_count is the default-flip evidence input: high-volume detectors are false-positive noise candidates; rare+severe detectors are safer default-block candidates. This report does NOT auto-recommend a flip set."
+        }
+      };
+    }
+    var SEV_RANK = {
+      CRITICAL: 4,
+      HIGH: 3,
+      MEDIUM: 2,
+      LOW: 1,
+      INFO: 0,
+      UNKNOWN: 0
+    };
+    function worseSeverity(a, b) {
+      const ra = SEV_RANK[String(a).toUpperCase()] != null ? SEV_RANK[String(a).toUpperCase()] : 0;
+      const rb = SEV_RANK[String(b).toUpperCase()] != null ? SEV_RANK[String(b).toUpperCase()] : 0;
+      return rb > ra ? b : a;
+    }
+    module2.exports = {
+      buildCounterfactualReport,
+      mapDecision,
+      mapExecutionAction,
+      extractDetectors,
+      SCOPE_NOTE
+    };
+  }
+});
+
 // src/commands/adopt.js
 var require_adopt = __commonJS({
   "src/commands/adopt.js"(exports2, module2) {
@@ -263883,20 +264565,9 @@ var require_adopt = __commonJS({
         else process.env.LOG_LEVEL = prevEnv;
       }
     }
+    var counterfactualAdopt = require_counterfactual_adopt();
     function loadCore() {
-      const candidates = [
-        path.join(__dirname, "../../../../src/core/counterfactual-adopt"),
-        path.join(__dirname, "../../../src/core/counterfactual-adopt")
-      ];
-      for (const c of candidates) {
-        try {
-          return require(c);
-        } catch (_) {
-        }
-      }
-      throw new Error(
-        "Cannot load counterfactual-adopt core. Run from the coderifts-app monorepo (packages/cli expects ../../../../src/core/counterfactual-adopt)."
-      );
+      return counterfactualAdopt;
     }
     function listCommits({ commits, days, gitImpl, cwd }) {
       const args = ["log", "--format=%H	%cI", "--reverse"];