wholestack 0.5.6 → 0.5.7

package/README.md

@@ -68,6 +68,29 @@ Run ShipGate's gates on a generated contract:
 wholestack prove ./contracts MyToken --property conservation
 ```
 
+## Prove-gate (any repo, in CI)
+
+Gate ANY Next.js + Prisma repo — not just generated ones — with the deterministic
+prove-gate. It proves tenant isolation (RLS) and authorization-completeness (no
+unprotected/orphan endpoint) over your code and exits non-zero on `NO_SHIP`, so it
+drops straight into CI as a required status check. Fail-closed: a check that can't
+bind its artifact is reported "not run", never a silent pass.
+
+```bash
+wholestack prove .                 # gate the checked-out repo; exit 0 = SHIP, 1 = NO_SHIP
+wholestack prove . --json          # full machine-readable verdict to stdout
+wholestack prove --remote --github owner/repo --ref <sha>   # hosted, HMAC-SIGNED verdict
+```
+
+`--remote` returns a verdict signed by the ISL server (HMAC over the canonical
+verdict: `schema · verdict · score · checks · blockingReasons · sourceHash ·
+deepTierTargets`), so a stored or shared verdict can be re-verified offline and any
+tampering with the SHIP/NO_SHIP, score, or blocking reasons is detectable.
+
+A ready-to-use GitHub Actions workflow is in
+[`examples/github-actions/isl-prove.yml`](./examples/github-actions/isl-prove.yml) —
+copy it to `.github/workflows/` to block PRs that fail the gate.
+
 ## Requirements
 
 - Node.js ≥ 20