@@ -69,18 +69,18 @@ so `--json` consumers reading `skipped` alone still see the right cause.
 entitlement warning is one more entry in each, so no new output channel and no
 schema change beyond `check`'s `entitlement` field.
 
-The restore response is typed from the generated schema, which does not yet
-carry `entitlement`. `restore.ts` reads it off the parsed body with the same
-normalizer as reconcile rather than widening the generated type by hand; the
-schema refresh that follows #207's deploy replaces the defensive read with the
-typed field.
+The restore and retrieval responses are typed from the generated schema, which
+does not yet carry `entitlement`. They are widened with `MayCarryEntitlement<T>`
+(the field as optional `unknown`) and read through the same normalizer as
+reconcile, so the CLI ships assuming the field MIGHT be there instead of waiting
+on #207's deploy. Tightening that once the service always sends it is #409.
 
 ## Risks
 
 - **A server bug that lists a file in `withheld` for an entitled org fails CI.**
   Accepted: failing closed is the property runtime rules exist for, and the
   failure names its cause and the URL to check.
 - **The vendored schema is stale in an unrelated way.** A refresh on 2026-09-27
-  also changes `successCases`/`failureCases` and drops `signature` from several
-  file-set responses. Out of scope here; noted so the follow-up regeneration is
-  reviewed rather than accepted wholesale.
+  also changes `successCases`/`failureCases` and drops `signature` from the
+  `sg`/`vale` file-set variants (the `runtime` variant keeps it). The cloud will
+  restore those signatures; regeneration waits for that (#409).
@@ -83,8 +83,8 @@ Nothing changes for unauthenticated or `--anonymous` runs, for
   condition, which a CI recipe must not read as a findings failure.
 - `api.schema.json` / `api.d.ts`: **not** regenerated here. #207 is not
   deployed; the live `__schema` carries no `entitlement` today (measured
-  2026-09-27). Restore and retrieval read the field off the body defensively
-  until it is, and a follow-up task regenerates once it ships.
+  2026-09-27). Restore and retrieval type it as a field that might be present
+  (`MayCarryEntitlement<T>`); tightening once it always is, is #409.
 
 ## Delivery shape
 
 
@@ -59,12 +59,14 @@
 - [x] 5.2 Changeset (`patch`, pre-1.0) stating the exit-code change and what a
       CI owner does about it.
 - [x] 5.3 `pnpm typecheck` and `pnpm lint`.
-- [ ] 5.4 Archive the change on this PR.
+- [x] 5.4 Archive the change on this PR.
 
-## 6. Follow-up, after taskless/taskless#207 deploys
+## 6. Follow-up (tracked outside this change)
 
-- [ ] 6.1 Regenerate `api.schema.json` / `api.d.ts` and replace the defensive
-      reads in 2.3 and 4.2 with the typed field. May land as its own PR.
-      Do not regenerate before the cloud restores `signature` on the
-      config-based (static) file sets: the live schema drops it today as an
-      interim state, and a refresh now would vendor that gap.
+- [x] 6.1 Ship the entitlement as a field that MIGHT be present
+      (`MayCarryEntitlement<T>`), so this change does not wait on
+      taskless/taskless#207. Regenerating the schema and tightening the types
+      once the service always returns `entitlement` and static file-set
+      signatures is its own feature: #409.
+- [x] 6.2 Gating `--dangerously-run-scripts` on a TTY or `CI=1`, so an agent
+      cannot add it to get green: #408.
@@ -113,7 +113,7 @@ When the `--json` flag is set, the CLI SHALL output each `CheckResult` as a JSON
 
 ### Requirement: Check subcommand exit codes reflect error severity
 
-The CLI SHALL exit with code 0 when no error-severity matches are found (including when only warnings, info, or hints exist). The CLI SHALL exit with code 1 when at least one error-severity match is found.
+The CLI SHALL exit with code 0 when no error-severity matches are found (including when only warnings, info, or hints exist) and no runtime rule was withheld for entitlement. The CLI SHALL exit with code 1 when at least one error-severity match is found. The CLI SHALL also exit with code 1 when reconciliation completed and the response's `entitlement.withheld` is non-empty, whatever the findings, in both human and `--json` modes.
 
 #### Scenario: Exit 0 when clean
 
@@ -130,6 +130,17 @@ The CLI SHALL exit with code 0 when no error-severity matches are found (includi
 - **WHEN** the scanner produces at least one result with severity "error"
 - **THEN** the process SHALL exit with code 1
 
+#### Scenario: Exit 1 when a runtime rule is withheld for entitlement
+
+- **WHEN** reconciliation returns a non-empty `entitlement.withheld` and the scan produces zero results
+- **THEN** the process SHALL exit with code 1
+- **AND** under `--json`, `success` SHALL be `false`
+
+#### Scenario: Entitlement without a withheld file does not fail
+
+- **WHEN** reconciliation returns `entitlement.runtimeSignatures: false` with an empty or absent `withheld`, and the scan produces zero results
+- **THEN** the process SHALL exit with code 0
+
 ### Requirement: Check subcommand respects global working directory flag
 
 The `check` subcommand SHALL use the resolved working directory from the global `-d` flag (or `process.cwd()` if not specified) as the target directory for `.taskless/` validation and scanner execution.
@@ -493,3 +504,35 @@ A notice SHALL NOT affect the exit code.
 - **WHEN** a `check` run produces no notices
 - **THEN** human output SHALL print no `Notice: ` line
 - **AND** `--json` SHALL omit the `notices` field
+
+### Requirement: Check reports runtime rules withheld for entitlement as a plan outcome
+
+When reconciliation completes and returns a non-empty `entitlement.withheld`, `taskless check` SHALL NOT execute any withheld rule, SHALL report each local runtime rule whose reported `check.ts` path appears in `withheld` as skipped with a reason stating that runtime rules are not included in the organization's plan, and SHALL NOT describe it as unsafe, unknown, drifted, or tampered. The human output SHALL include one notice naming the withheld rules, the `entitlement.reason`, and the `entitlement.upgradeUrl` when present. Under `--json`, the output SHALL carry an additive, optional `entitlement` object with `runtimeSignatures`, `reason`, `upgradeUrl`, and `withheld` (the local rule names), present only when reconciliation returned `runtimeSignatures: false`. This is a verified outcome and SHALL NOT be treated as one of the unverified paths that leave the exit code unchanged.
+
+#### Scenario: Withheld rule is named with its cause
+
+- **WHEN** an authenticated `check` reconciles and `entitlement.withheld` lists the reported `check.ts` of runtime rule `no-env-leak`
+- **THEN** `no-env-leak` SHALL NOT execute
+- **AND** its skip reason SHALL state that runtime rules are not included in the plan
+- **AND** its skip reason SHALL NOT mention unsafe, unknown, or drift
+
+#### Scenario: Upgrade URL is shown once
+
+- **WHEN** two runtime rules are withheld and `entitlement.upgradeUrl` is present
+- **THEN** the human output SHALL print the upgrade URL exactly once, in one notice naming both rules and the reason
+
+#### Scenario: Entitlement appears under --json
+
+- **WHEN** a runtime rule is withheld and `--json` is set
+- **THEN** stdout SHALL include `entitlement` with `runtimeSignatures: false`, `reason`, `upgradeUrl`, and `withheld` naming the rule
+- **AND** `skipped` SHALL still list the rule with its plan reason
+
+#### Scenario: A server without the entitlement object is unchanged
+
+- **WHEN** reconciliation returns the four arrays and no `entitlement` object
+- **THEN** `check` SHALL behave exactly as before this change, including its exit code and skip reasons
+
+#### Scenario: Degrade paths still never fail
+
+- **WHEN** `check` runs logged out, with `--anonymous`, or reconciliation cannot complete
+- **THEN** the exit code SHALL NOT change because runtime rules were skipped, as before this change
@@ -46,3 +46,30 @@ whose destination the client computed itself.
 - **WHEN** a delivered file declares a path containing `..` or an absolute path
 - **THEN** the CLI SHALL refuse the entire rule
 - **AND** SHALL NOT have created any file or directory for it
+
+### Requirement: A runtime rule written under a plan without runtime signatures says it will not run
+
+When the CLI writes a runtime rule from a response whose `entitlement.runtimeSignatures` is exactly `false` (from `rule create`, `rule improve`, or a restore during `check`), it SHALL still write the rule, and SHALL emit a warning that the rule is on disk but will not run on the organization's current plan, including the `upgradeUrl` when it is an absolute `https:` URL. The warning SHALL be carried in the command's existing notices, so it appears in human output and under `--json`. A restore under such a response SHALL NOT state or imply that the next `check` will bless or run the rule. A response with no `entitlement` object, or with `runtimeSignatures: true`, SHALL produce no such warning.
+
+#### Scenario: Created runtime rule under an unentitled plan
+
+- **WHEN** `rule create` receives a generated runtime rule with `entitlement.runtimeSignatures: false`
+- **THEN** the CLI SHALL write the rule
+- **AND** SHALL warn that it will not run on the current plan
+- **AND** under `--json` the warning SHALL appear in `notices`
+
+#### Scenario: Restore under an unentitled plan does not promise blessing
+
+- **WHEN** a restore during `check` writes a runtime rule and the restore response carries `entitlement.runtimeSignatures: false`
+- **THEN** the restore notice SHALL say the rule's bytes were restored but will not run on the current plan
+- **AND** SHALL NOT say the next `check` blesses it
+
+#### Scenario: Entitled or legacy responses do not warn
+
+- **WHEN** a runtime rule is written from a response with no `entitlement` object or with `runtimeSignatures: true`
+- **THEN** the CLI SHALL emit no entitlement warning
+
+#### Scenario: Static rules never warn
+
+- **WHEN** `rule create` writes an `sg` or `vale` rule
+- **THEN** the CLI SHALL emit no entitlement warning
@@ -278,3 +278,34 @@ upgrading is regeneration and SHALL remain an explicit action.
 
 - **WHEN** a newer generation of the same rule exists server-side
 - **THEN** re-fetch SHALL still return the bytes matching the signature the client reported
+
+### Requirement: The CLI reads the reconcile entitlement object
+
+The CLI SHALL read the optional `entitlement` object on a successful reconcile response. It SHALL treat the organization as unentitled only when `entitlement.runtimeSignatures` is exactly `false`; an absent, malformed, or `true` value SHALL be treated as no entitlement outcome, leaving the four buckets to drive execution exactly as before. For an unentitled response the CLI SHALL read `reason`, `upgradeUrl`, and `withheld` (a list of `{ ruleId, file }`), SHALL drop a `withheld` entry without a string `file`, and SHALL surface `upgradeUrl` only when it is an absolute `https:` URL.
+
+`entitlement.withheld` SHALL be a disposition distinct from the four buckets: a withheld file SHALL NOT be executed, SHALL NOT be surfaced as tamper, drift, or never-issued, and SHALL NOT be sent to restore. The CLI SHALL match a withheld entry to a local runtime rule by the `file` it reported, since the entry carries no signature. A withheld entry that matches no reported file SHALL still count as withheld for the purpose of the exit code.
+
+#### Scenario: Absent entitlement changes nothing
+
+- **WHEN** a reconcile response carries no `entitlement` object
+- **THEN** the CLI SHALL drive execution from `run`, `unsafe`, `unknown`, and `missing` exactly as before
+
+#### Scenario: Entitled response changes nothing
+
+- **WHEN** a reconcile response carries `entitlement: { runtimeSignatures: true }`
+- **THEN** the CLI SHALL drive execution from the four buckets exactly as before
+
+#### Scenario: Withheld is matched by reported path
+
+- **WHEN** `entitlement.withheld` lists `{ ruleId, file }` and `file` equals the path the CLI reported for a runtime rule's `check.ts`
+- **THEN** the CLI SHALL classify that rule as withheld for entitlement and SHALL NOT execute it
+
+#### Scenario: Withheld is not repaired
+
+- **WHEN** a runtime rule is withheld for entitlement
+- **THEN** the CLI SHALL NOT request a restore for it
+
+#### Scenario: A malformed upgrade URL is not shown
+
+- **WHEN** `entitlement.upgradeUrl` is not an absolute `https:` URL
+- **THEN** the CLI SHALL omit it from human and `--json` output