{"service":"CodeRifts","version":"2.8","description":"Contract-change authorization for AI agents","endpoints":{"preflight":"https://app.coderifts.com/api/v1/preflight","agent_tool_preflight":"https://app.coderifts.com/api/v1/agent/preflight","verify_receipt":"https://app.coderifts.com/api/v1/verify-receipt","get_decision_details":"https://app.coderifts.com/api/v1/decisions/lookup","diff":"https://app.coderifts.com/api/v1/diff","instability_scan":"https://app.coderifts.com/api/v1/instability-scan","agent_readiness":"https://app.coderifts.com/api/v1/agent-readiness-score","synaptic_weights":"https://app.coderifts.com/api/v1/synaptic-weights","policy_simulator":"https://app.coderifts.com/api/v1/policy-simulator","benchmark":"https://app.coderifts.com/api/v1/benchmark","weekly_summary":"https://app.coderifts.com/api/v1/weekly-summary","signing_key_registry":"https://app.coderifts.com/.well-known/coderifts-keys.json","attestation_public_key":"https://app.coderifts.com/api/v1/attestation/public-key"},"portable_verification":{"supported":true,"algorithm":"Ed25519","key_registry":"https://app.coderifts.com/.well-known/coderifts-keys.json","public_key":"https://app.coderifts.com/api/v1/attestation/public-key","format_spec":"https://github.com/coderifts/receipt-verifier/blob/main/RECEIPT_FORMAT.md","reference_verifier":"https://github.com/coderifts/receipt-verifier"},"does_not_prove":["Evidence is RECORDED — a pinned capture, replayed — not a live provider run.","proof_scope TRUSTED_EXECUTOR, provider_witness NOT_APPLICABLE, externally_witnessed false: CodeRifts did not witness or sign a provider state.","Not externally witnessed, and not PATH B. The GitHub provider-loop is a separate claim.","The grant does not bind the canonical tool-call bytes, so what-was-called is not proven equal to what-was-authorized (planned, not available).","There is no single cross-domain evidence bundle over grant, measurement and supply chain (planned / on request, not available).","A downstream agent is not given a strictly narrower grant than its caller held — delegation attenuation is not available.","No DSSE or in-toto envelope is emitted by any published artifact.","The published tool-surface digest establishes what the server serves now. It does not establish that an existing client connection runs that list: clients may cache the tool list for the life of a connection, and expiry behaviour differs by client and is undocumented (measured: anthropics/claude-code#97369; on claude.ai the saved approval is keyed on a hash of the description and top-level parameter descriptions — a type, enum or required change does not reset it)."],"does_not_prove_scope":"platform","public_preflight":"https://app.coderifts.com/api/v1/public/preflight","public_preflight_scope":"single-spec hallucination & quality pre-screen (ALLOW/WARN only; no execution_action receipt gate). For breaking-change / change-set governance use endpoints.preflight (artifacts[]).","public_preflight_usage":{"method":"GET","query_param":"url","example":"https://app.coderifts.com/api/v1/public/preflight?url=https://petstore3.swagger.io/api/v3/openapi.json","retry":"On cache_status MISS_NOT_ANALYZED or MISS_SPEC_CHANGED the body carries status PENDING and retry_after (seconds). Poll the same GET until cache_status is HIT."},"public_preflight_docs":"https://coderifts.com/decision-spec/#public-preflight","mcp_manifest":"https://app.coderifts.com/.well-known/mcp.json","ard_catalog":"https://app.coderifts.com/.well-known/ard.json","mcp_protocol_version":"2025-06-18","mcp_protocol_supported":["2025-06-18","2025-03-26","2024-11-05"],"mcp_tool_surface_revision":"1.0.3","release_manifest":"https://coderifts.com/releases/atomic-stack.json","sdk":{"typescript":"@coderifts/sdk","python":"coderifts-sdk"},"authentication":"Bearer token via X-API-Key header or Authorization: Bearer","docs":"https://coderifts.com/docs","policy_delivery_docs":"https://coderifts.com/docs/policy-delivery/","snippets":"https://app.coderifts.com/snippets","signup":"https://app.coderifts.com/api/signup","decision_spec":{"version":"2.0","url":"https://coderifts.com/decision-spec/","schema_url":"https://coderifts.com/decision-spec/v2.0.json","how_agents_use_this":"https://coderifts.com/decision-spec/how-agents-use-this/","status":"stable","evidence_quality_field":true,"producer_schema_url":"https://coderifts.com/schemas/preflight-response.v2.producer.json","legacy":{"version":"1.0","schema_url":"https://coderifts.com/decision-spec/v1.0.json","status":"retired","sunset":"2026-09-07T00:00:00Z"}},"decision_result":{"consumer_schema_url":"https://coderifts.com/schemas/decision-result.v1.consumer.json","producer_schema_url":"https://coderifts.com/schemas/decision-result.v1.producer.json","compatibility":"ENVELOPE COMPATIBILITY (v1) on the producer schema description (copied into the consumer schema description). Additive fields may appear; unknown fields and unrecognised execution_action are not permission; required fields stable inside v1; optional-for-migration ≠ optional-forever; field deprecation window UNDECIDED. A known continue-valued execution_action is a NECESSARY condition, never a SUFFICIENT one; consumers MAY add conjunctive local checks (they may halt where the norm permits execution, declared per the acceptance suite's liveness class); an unknown value is not permission under any combination of other fields."},"recommended_usage":{"call_before":["api_contract_change","tool_schema_change","merge_to_main","agent_execution","mcp_tool_invocation"],"branch_on":"execution_action","execution_action":["CONTINUE","CONTINUE_WITH_MONITORING","REQUEST_APPROVAL","STOP"],"unrecognised_execution_action":"not_permission_fail_closed","continue_with_monitoring_requires":"monitoringSinkWired","safe_for_agent":"not_for_control_flow_use_execution_action","unknown_envelope_field":"not_permission_tolerate_additive"}}