{
  "service": "CodeRifts",
  "version": "2.8",
  "description": "Contract-change authorization for AI agents",
  "endpoints": {
    "preflight": "https://app.coderifts.com/api/v1/preflight",
    "agent_tool_preflight": "https://app.coderifts.com/api/v1/agent/preflight",
    "verify_receipt": "https://app.coderifts.com/api/v1/verify-receipt",
    "get_decision_details": "https://app.coderifts.com/api/v1/decisions/lookup",
    "diff": "https://app.coderifts.com/api/v1/diff",
    "instability_scan": "https://app.coderifts.com/api/v1/instability-scan",
    "agent_readiness": "https://app.coderifts.com/api/v1/agent-readiness-score",
    "synaptic_weights": "https://app.coderifts.com/api/v1/synaptic-weights",
    "policy_simulator": "https://app.coderifts.com/api/v1/policy-simulator",
    "benchmark": "https://app.coderifts.com/api/v1/benchmark",
    "weekly_summary": "https://app.coderifts.com/api/v1/weekly-summary",
    "signing_key_registry": "https://app.coderifts.com/.well-known/coderifts-keys.json",
    "attestation_public_key": "https://app.coderifts.com/api/v1/attestation/public-key"
  },
  "portable_verification": {
    "supported": true,
    "algorithm": "Ed25519",
    "key_registry": "https://app.coderifts.com/.well-known/coderifts-keys.json",
    "public_key": "https://app.coderifts.com/api/v1/attestation/public-key",
    "format_spec": "https://github.com/coderifts/receipt-verifier/blob/main/RECEIPT_FORMAT.md",
    "reference_verifier": "https://github.com/coderifts/receipt-verifier"
  },
  "does_not_prove": [
    "Evidence is RECORDED — a pinned capture, replayed — not a live provider run.",
    "proof_scope TRUSTED_EXECUTOR, provider_witness NOT_APPLICABLE, externally_witnessed false: CodeRifts did not witness or sign a provider state.",
    "Not externally witnessed, and not PATH B. The GitHub provider-loop is a separate claim.",
    "The grant does not bind the canonical tool-call bytes, so what-was-called is not proven equal to what-was-authorized (planned, not available).",
    "There is no single cross-domain evidence bundle over grant, measurement and supply chain (planned / on request, not available).",
    "A downstream agent is not given a strictly narrower grant than its caller held — delegation attenuation is not available.",
    "No DSSE or in-toto envelope is emitted by any published artifact."
  ],
  "public_preflight": "https://app.coderifts.com/api/v1/public/preflight",
  "public_preflight_scope": "single-spec hallucination & quality pre-screen (ALLOW/WARN only; no execution_action receipt gate). For breaking-change / change-set governance use endpoints.preflight (artifacts[]).",
  "public_preflight_usage": {
    "method": "GET",
    "query_param": "url",
    "example": "https://app.coderifts.com/api/v1/public/preflight?url=https://petstore3.swagger.io/api/v3/openapi.json",
    "retry": "On cache_status MISS_NOT_ANALYZED or MISS_SPEC_CHANGED the body carries status PENDING and retry_after (seconds). Poll the same GET until cache_status is HIT."
  },
  "public_preflight_docs": "https://coderifts.com/decision-spec/#public-preflight",
  "mcp_manifest": "https://app.coderifts.com/.well-known/mcp.json",
  "ard_catalog": "https://app.coderifts.com/.well-known/ard.json",
  "mcp_protocol_version": "2025-06-18",
  "mcp_protocol_supported": [
    "2025-06-18",
    "2025-03-26",
    "2024-11-05"
  ],
  "mcp_tool_surface_revision": "1.0.2",
  "release_manifest": "https://coderifts.com/releases/atomic-stack.json",
  "sdk": {
    "typescript": "@coderifts/sdk",
    "python": "coderifts-sdk"
  },
  "authentication": "Bearer token via X-API-Key header or Authorization: Bearer",
  "docs": "https://coderifts.com/docs",
  "policy_delivery_docs": "https://coderifts.com/docs/policy-delivery/",
  "snippets": "https://app.coderifts.com/snippets",
  "signup": "https://app.coderifts.com/api/signup",
  "decision_spec": {
    "version": "2.0",
    "url": "https://coderifts.com/decision-spec/",
    "schema_url": "https://coderifts.com/decision-spec/v2.0.json",
    "how_agents_use_this": "https://coderifts.com/decision-spec/how-agents-use-this/",
    "status": "stable",
    "evidence_quality_field": true,
    "producer_schema_url": "https://coderifts.com/schemas/preflight-response.v2.producer.json",
    "legacy": {
      "version": "1.0",
      "schema_url": "https://coderifts.com/decision-spec/v1.0.json",
      "status": "legacy",
      "sunset": "2026-09-07T00:00:00Z"
    }
  },
  "decision_result": {
    "consumer_schema_url": "https://coderifts.com/schemas/decision-result.v1.consumer.json",
    "producer_schema_url": "https://coderifts.com/schemas/decision-result.v1.producer.json",
    "compatibility": "ENVELOPE COMPATIBILITY (v1) on the producer schema description (copied into the consumer schema description). Additive fields may appear; unknown fields and unrecognised execution_action are not permission; required fields stable inside v1; optional-for-migration ≠ optional-forever; field deprecation window UNDECIDED. A known continue-valued execution_action is a NECESSARY condition, never a SUFFICIENT one; consumers MAY add conjunctive local checks (they may halt where the norm permits execution, declared per the acceptance suite's liveness class); an unknown value is not permission under any combination of other fields."
  },
  "recommended_usage": {
    "call_before": [
      "api_contract_change",
      "tool_schema_change",
      "merge_to_main",
      "agent_execution",
      "mcp_tool_invocation"
    ],
    "branch_on": "execution_action",
    "execution_action": [
      "CONTINUE",
      "CONTINUE_WITH_MONITORING",
      "REQUEST_APPROVAL",
      "STOP"
    ],
    "unrecognised_execution_action": "not_permission_fail_closed",
    "continue_with_monitoring_requires": "monitoringSinkWired",
    "safe_for_agent": "not_for_control_flow_use_execution_action",
    "unknown_envelope_field": "not_permission_tolerate_additive"
  }
}