Know what may proceed. Prove why it did.

Signed & Verifiable

Don't trust the verdict. Verify it.

Ed25519-signed verdicts on the OpenAPI diff, PR gates and action-verdict flows — deterministic (same input, same fingerprint), with multi-protocol signing (GraphQL, gRPC, AsyncAPI) on the roadmap. The command below independently verifies that this exact verdict was issued and signed by CodeRifts and has not been altered; determinism itself is reproducible via the public diff API — same input, same fingerprint.

# Signed & Verifiable — coderifts/demo#4
verdict:  deterministic BLOCK · 3 breaking changes
fp:       sha256:70699341…cfec
ir_hash:  sha256:f3de7721…a334
kid:      2026-07-k1
issued:   2026-07-21
alg:      Ed25519

Example from a real run — the live receipt is always fresher. Run the command below to fetch and verify it yourself.

Verify it yourself — four lines, no signup

# 1. mint a signed decision from the public endpoint (no signup, no API key)
curl -sS https://app.coderifts.com/api/v1/action-verdict \
  -d '{"action_type":"tool_call","tool":{"name":"get_customer","capabilities":["read"]}}' \
| python3 -c 'import sys,json;print(json.load(sys.stdin)["chain_receipt"])' > receipt.txt

# 2. get the verifier — one file, no dependencies — and check the signature
curl -sSO https://raw.githubusercontent.com/coderifts/receipt-verifier/main/verify.js
node verify.js "$(cat receipt.txt)"

# -> {"valid":true,"status":"VERIFIED_CURRENT","payload":{ … }}

The verifier comes from GitHub, not from this site — a verifier served by the party being verified would prove less. It resolves the key from the published registry; pass --key pub.pem to check fully offline. This proves the receipt was signed by that key and has not been altered. It does not prove that any particular agent call went through the gate.

Or verify a receipt from a real governed PR

# clone & verify the live demo receipt (honest on GitHub rate-limit / empty body)
git clone https://github.com/coderifts/receipt-verifier && cd receipt-verifier
HTTP=$(curl -sS -o /tmp/cr-demo-comments.json -w '%{http_code}' \
  https://api.github.com/repos/coderifts/demo/issues/4/comments) || exit 1
if [ "$HTTP" != "200" ]; then
  echo "GitHub API HTTP $HTTP — rate limit or error. Try again in a minute, or paste the receipt JSON/token directly:"
  echo "  node verify.js '<receipt>' --keys https://app.coderifts.com/.well-known/coderifts-keys.json"
  exit 1
fi
RECEIPT=$(grep -oE 'eyJ2[A-Za-z0-9._-]+' /tmp/cr-demo-comments.json | tail -1)
if [ -z "$RECEIPT" ]; then
  echo "No receipt token found in PR comments. Paste one directly:"
  echo "  node verify.js '<receipt>' --keys https://app.coderifts.com/.well-known/coderifts-keys.json"
  exit 1
fi
node verify.js "$RECEIPT" \
  --keys https://app.coderifts.com/.well-known/coderifts-keys.json

Node 20+, no npm install. Exit 0 = valid. Resolves the signing key by kid from our published key registry — retired keys remain listed after rotation. Unauthenticated GitHub comment fetch can 403 when rate-limited; the script above fails with a message instead of verifying an empty capture.

Open-source verifier (Node and Python) · Live demo PR · Frozen format spec

Same input, same verdict, same fingerprint — byte-identical across runs. Each run gets a freshly timestamped Ed25519 receipt.

Learn more about portable proof →

Works everywhere you code

7,421 passing and 0 failing — measured across 15 suite globs at commit 82627a1. Check the number yourself: app.coderifts.com/health reports the same test_count live.

Core Diff reads your configured spec files; opt-in MigraGuard and ActionGuard also read configured migration files, source references and workflow YAML — processed in memory during the check run, never stored or logged.